dc2973d73034c40911c6733f2ee348bbddccea572b551bba40a4ca258140fc33

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c900085db114a92c814c8f10b7f5856a.html
Size

1KB
MD5

c900085db114a92c814c8f10b7f5856a
SHA1

005b2c4e39cb7b8839b931b1dc941e219d4f5e8a
SHA256

dc2973d73034c40911c6733f2ee348bbddccea572b551bba40a4ca258140fc33
SHA512

709d7bd7dc3cc3b1e57ef5bf2095fedf31064eef7d5dc54c70a83c69f56175bf505dbaf35d43686a78fb969aabdfb91539b37f0485ec48402c1796acbc1361ce

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D534DFC1-E219-11EE-86DB-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907cc2ad2676da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000086860fa17a2f22cae819c1a7b1dbead60195afce164dba4375d7d4cd6a5ee687000000000e800000000200002000000084910d44d39a95cc76fe8b70d6afd4a5e2afab6c532ee9539f36417bf521a38b90000000af9f3861d46da9eb75f2054ea01bf7290a11e8ee9f3e432ff57d164d197305fa41c74a8a3c91386cc20036879dbc248f00f963b4383543412fab79a8ec11691d4f784338c23e324ee543691949e1f346e414294ff0ac8b9203ba8a0befafbf82e79278054f3094ebad86c30acd326dddcd3f900abdf74422a718ee3f3414889de55c9b698b28231197c1d8820c68faed40000000dcdfaca93afdeca415c44e512f6de02091b16938f69f3acf8e5b0a13f3dac3601f4b28eff67c1f0599f6a9269dc1f94dabe6ff1fe8d81fc399a4f05a1c0f333b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001a7cafb76a8685a125bc7e68ddcb8bd8b19e5cc2a39c5f44eeae448c4f6b813e000000000e8000000002000020000000175d67ba1b699ba64bb7b41d07aca6191a16a58557e00af120f36df1189c5d6020000000fe6ea2a74b12b0217591818aee4285bdec403a5d946218466f6e5f0072b3c9a3400000003b5abda54c77105e6f83c3f559c49f89635bdf49bd11ffdfc393b4b9f5e1d6c87789c7002fd9ad6ecd016f7aa5eaf435dc0e3e7ef7f8983a73aab5e10d0018d3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416592979"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2544	2388	iexplore.exe	28
PID 2388 wrote to memory of 2544	2388	iexplore.exe	28
PID 2388 wrote to memory of 2544	2388	iexplore.exe	28
PID 2388 wrote to memory of 2544	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c900085db114a92c814c8f10b7f5856a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d5c05ad24c57be3d0156f16ba6c5c0b

SHA1
47b52bfda2eb68a4e2804000f3d53ae69fc32dfe

SHA256
9cba1d06a95bd17a2e34fd04f2b6dfd21cc61a5888b15d4883a31d95bbde5a31

SHA512
9f18402c4fbaf5bb449a2ede97e8fc5e780f8cf4c7bbab8bf416ffe87d12f212fc50e371a091c0354c14919d4b2f08c89f6a9deaad12e01b3301bc9aaee8ae85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a06c46c516d0796805d2a47b698c5f6

SHA1
1679ec7c830fc0833a9d9716fef80b87382edfc8

SHA256
21cffb30fc123acba821f2dbe12f25cd2c73e09cc9d59f7228c31e12787113bd

SHA512
817bec607a1fbf598400e92a404cb64872a7d5c1b57de86e008f3273fe3acda51ef004d58d7c3eab9f5252252d0830f4cc7ad5d155048c2a8a731484a858604b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b249e696df56a5a92f16ebdb4d60d446

SHA1
846866d30e9ed68ea55f662d8bcc527c088b1778

SHA256
79147483a285ff5b3277311f8df65d0522f6ffb042ab4f78c1b0cfb411970f66

SHA512
6739f12aa1f92e016dd0f2f06735645d2a8e5f02ed2735470b72c1da4d97f9ac63acbc0f34a06a7f858d38d97a1fae3f608f14de8cfa0768262d00a41be24c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e517be70d3d31dfaec84c93b05c0927f

SHA1
66b8904fad835ea0a40781c5c7b08687ecbec14b

SHA256
be9b14c86b483a2d763c6c9580520022a60036b99e2baf07ed1803067a5178f2

SHA512
48020f48f262b670b797e16fdf220ff87d41ba343081dd92e696fc32dc24ac8e82db27abdc9ecd75e2693288c8f62f09393cacd19acd4b33da8c08f04643be0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e74f963fb9a04de1870a5d629f77d0c

SHA1
258dc169ac9b856502631c8ce8dabda5fc689c0d

SHA256
fa02a5982a8b4a4585537ab0d29ec0e69650b3b40e52fcd44d1ab32d41ce002b

SHA512
f35b60d977022a92e9bb0850a3d2789b127beb56337cd4891e722d65c08bdc7f9ed56dd7fff35a8962670bdf0d23ec0da7454a0e250eff6e5d1d3d1c127e4fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddd4b16dc1e20e200b0d37809959d47c

SHA1
0b517bf1f1480dde8242691053788834163fdb11

SHA256
4a08e96fcccec86aa696d937180f3123bbe500954576556a8038827264530503

SHA512
e82d4d17d3248d2f4f72b239e940ff5661e8f93329860f54f146c2e5eb61ee489a30f9a40998d3367ee6c22e59fce22564f35db2a15160911f873961f1993fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d6198be3da69598366650ffed47fa31

SHA1
41134e48206a815d5e1a79c20422b575213c6b2a

SHA256
29785b359f0665b800353f8419f7e0307352d3e4d6ecb8bfec05856242086462

SHA512
16585f04b18e5301ab361d79e8d9e71887c8ca39066e0f705d3778b3408c6f6246b4d370494ce6ef5a6d1d8c5822b17935a2c95e9db954c3fa82ee3e484d19db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89bc08afca4a51f33086c3cf49250bc7

SHA1
6ad83aab39f2fc9eaf703be10c3d241cd06dc658

SHA256
f217587b53b4b6af7588128cff92f5da276903c6bc88b0b7180370c92320ea21

SHA512
2262b739f1375810d41ea97032a39d48627290f1fa17969fad81efa609491fbe38d398c5cdb6909774e05235c373407d78f005b0ca0783a7628417e7fcee0b11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49BE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4DDC.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit