3611c4b31123df7689f7b74817e55285d7963a56e8d12a4b89e4cb7b8c28a1b1

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f2c63f5213f861604b8b369d39cfb9.html
Size

161KB
MD5

c8f2c63f5213f861604b8b369d39cfb9
SHA1

a08f10a13d14e05595893e95fb4fbcf199b800c5
SHA256

3611c4b31123df7689f7b74817e55285d7963a56e8d12a4b89e4cb7b8c28a1b1
SHA512

058d9f98ab1e6ab751fe83b88ad38fde46b683687298c84d6bed831278573146569fce596443401d7903cf29630142a05e301a871ae93e09efc581481daf974d
SSDEEP

1536:LIb7wDlNBw/a1fIuiHlq5mN8lDbNmPbcNyHcp6BnF2:LIHwDlp1iT5HzBnF2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{191BFAB1-E216-11EE-B54F-5EB6CE0B107A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06377f12276da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416591374"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000042a1be0baab074f9eeddc4dcfceafeee34c9dca1245e60999bb997aeeae610fc000000000e8000000002000020000000edb7405f47cea4b3a44b95d81f4fbd4a8cc39f0d81d495cdd58972a5ed575cb290000000772e893b15c18c23e4feb390f7e3dbc8998a1d9250f4487b158857bd997795f8e46437970dcd681b77b4b7548e5b1afd6d82d7f6c3154033295180442435bccd22915dba9c48f8296f2dc2adac02dc013774fefb90737c51a078a7ff453868df599f538fc8da75c78b937dd688e6b24afe5bed57ef63f244c16cd62c85298ef38a1d281e07aa626aed17e2c06e678f8d40000000acd60f78ced2afea858a6b480b5965cfe5752b4bc8d09ec7d4b3106dba175f2ea0aef63df21a850f3e42563e9a288dcd71d457e363b21a84f86c12848c800497	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000024ed39e313b7523c9f466c2466a0cf00d01aebd7cd52991c4b322491ea3ddb6e000000000e80000000020000200000003c99f176f09dad24ffbe2404fac657810b0ef4ac9b977f4ffe468ea621ec62cc20000000401375a4eede62dd039313dfd592a1837ad2ccde6e66433dcc7213b2809003ef40000000a430993d05cef3ff73a5f13feae2427d2d6f2017aa165e1103d649dcbc3bf781bcfd0e71c0cd963cdef75d8e54812bb9cdeba48caba8cb1f5a8734fb7f283bec	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2972	3064	iexplore.exe	28
PID 3064 wrote to memory of 2972	3064	iexplore.exe	28
PID 3064 wrote to memory of 2972	3064	iexplore.exe	28
PID 3064 wrote to memory of 2972	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8f2c63f5213f861604b8b369d39cfb9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
2a34ce354af3f2d55047b79cffa5a21f

SHA1
648fe2875042f6c8b9f7075f7d397d40b0f42baf

SHA256
73630542dd3bfbae4c3a1eae40e327a4c6d9a18eec4ef62826fcdc7c2b63a822

SHA512
a8b9f87de535d4a6cc0bf0b2621dcd2bf1b7b2a43fcae6d1cdef1da7e24e2577fb7ae4dfba6be215e260bfa8ed19f5f218a42fa06c4e4eac7b8ebd41bf91c12b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
1583e5bd9355e5e5f32f416aaccaa1ff

SHA1
0df8cc617d04a66cdad7c25a67be85d12d9add22

SHA256
29528f8d58681d38abaae0d68bf255ca782d9e60f1d8815d21f68a0b88dedea1

SHA512
d8640cbd27cd32d864f303f79c60f200cfff38f49c8453d89c04b1d8de63eaa60877fc86fc0999d17d7247247f16720718541a6311f1a42ea4dfa207c94a1e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65e989259a1376e9cebf53abd2fd41c2

SHA1
6f91ba1cc25f5abdb505d34a5418508c434cc9e2

SHA256
0bfb4acb93df514d98dd44d779aa7d5380997fa24373344dac1d554d31539be1

SHA512
7345fac47441c0494247d8c405ef34d5ee01220431f778e30ae4fec514b29d25f3156ce79be77d45d0ee2a92a66f5f9a50a65b9c604a23fe21531df3230f82b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd8368e637fa139171092f192fa9527e

SHA1
ac6bcdb50f532f047b58f7f04414e158471217be

SHA256
80eb753bc2053f0e7107eda7863342400982a086b9a7db4839e70ed3808c80fb

SHA512
2d9c5fb87a772ec34db311084e4374962f81b27983d346ca2e5789d9fd4bd77051607d1deddec7049c73273bd163633660c978c9b94ab874c8908b77757ae87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58ea1ea7c8ed73b61cb59ed8da749849

SHA1
5cd0adb7ef9b9322fd3d4a140140744269dc398a

SHA256
74bd21fe3ed59f996144805cd77b3ab907876efdd544d0328b087f643e07ec06

SHA512
eb081163455bcf9f8361018152acda3db5a4d9467045fc60cbf18df9577d8adff1c09b8a15c5009483c440738555a8ce9939f260cc46b9ebc24c5a6f7de2452a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d49f55ed3b26d8785232fd2466b65d32

SHA1
e5bfe44b3ede0ab3705b258efdbe85851df4a7c7

SHA256
386e8182d9cc8fe59c97d87f489ba72eb68f693c7b9dbd1b90cb6ccadd15fb94

SHA512
a31124164567d7668eecffbd16da70af2dec0a58cd5ab98d55c6f9cd7b7adb8d14dc3a8ff98fb9044bd9f204c4ae5511a53b5b9ad6c049ebbc1fc68a6380fc3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6da1f3dd4c12bb9b39740f3c73746ffd

SHA1
262a43243d45a16dcc1498b78760b5c833685328

SHA256
467ee7ddadc10b922f2f27d5fe2450be481ff28ab7b3666fc4af473cddac84f7

SHA512
6fa7a653fdc28540ed9fada37a2d4fa56ddc733f79f0507b3f4fb768531ea4fceab31a70adc0d3ee03194ef2b87f9f1fe9cdc4b953b1da137302d58d82a2fccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb16254789110c0fddc1a541a7f5c61

SHA1
3b78c2d2365fccd67fb4659fff6e46c88b4f0094

SHA256
f09f6185c47645d58649e5f074e97c4c5939fe6a8cf3ce963d55644fc76600d9

SHA512
f94adbd390ac7234b1e576a326a592414f1e106392d04777705a0cecdc5633622a047428607fbe4a6de1d8ffbcacb7d5176c044ea9c5b2a574ae5fb4bfd1e2e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df9bb0e18ecbdae757e62ca0f9585a09

SHA1
1f8c66ecfd9ceeba81be6bce3da42a26caeb3396

SHA256
ce88b4dbf546967aaf2fc1759bfc6b57d693f8a5e5eefb90928a8bdf56e3178b

SHA512
244d45f9cb401c5edefd819f747ecf8f672055f9647d328da5780835a590b8f4cdaa5f52b8e9618f6085f2a9e12a1fef4e1c9330b703f22d529fd85eaf178df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8314bc761a69201bd089338d4721478b

SHA1
1b2d3a986cd42a4ddeac69c3fbdf46a4002860f9

SHA256
aa4210f166fb0c84c29abeb5a1a8fef5c09c0669a86b995d9a486b50eec36d43

SHA512
3de9dd06a0907f585fe8497ab9f2bebeea14b610bccbbb71427bb1315522678e18b357fe5ad78444881ae9dfd8d2d979131aacbfff6f1e7da165286aa562a438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
06fd4ea470042290e91bee517420a894

SHA1
586d12245c4e83c50babfd1806646fe4987ce613

SHA256
927f4582136396753b55cca4ec3b7bc34efb4d1ea7f9c93a5d428c1e087aa105

SHA512
c151c0647cf48eb18823ce8dd676bdb798f89767615dce3f0ac2e6372d136b7b72bb66e26c6bd70a8377af8e76b549d180916c8d512111bf82f33efce60f7792

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB2A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC3.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit