cd11ad9d356a9e5e6cb1a58b38514331e69cf215ef0dff82e5dd4118e8bb9543

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9256c4461a67077d746cc731e03e4bc.html
Size

3KB
MD5

c9256c4461a67077d746cc731e03e4bc
SHA1

8bd0431cc68f8dbaa154f892a9b8643de76cf376
SHA256

cd11ad9d356a9e5e6cb1a58b38514331e69cf215ef0dff82e5dd4118e8bb9543
SHA512

7a025cf9984ff167bd3e1f87a93167671c8f30fe51d3e3c846656477c6007933593b033a325c9c054a7009ca569935a01cc7141ec63688b78acc5ba5b4871157

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000087c7a806229b169d44e7227f359f02dc983d7aca9cc498020d068ed807f98461000000000e80000000020000200000002e74853c19c41dca6e9daa8425b2cc122ffc82adadec307fc74a2cfb575beae290000000eb4cba41b0860c00fea7c94a3c319184207d34cc1324fbd81ddcf505b3a442e8b376c250b6c16a3af0150ded8e990744f891d675f90397eb7c76017001569f797232503058ba52fedc5e57f5a31ad70d556b82ccbd89fdbeccedd3a1bfbe3d2d7d31e78845eb208e76bcc06491a602216c977ab9ed94bdd8163f8ec7e435c3a52598b2c155e44d9dc65e4a9f88f6082f400000009637d1e81c894f658c5da2967a1624e389fdcda9f85bee5ff4ec81e31375b209202f7fee8885454f4967f51ee2e2156bf48092a9f5bc4fdecbaabeabbf9c38d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209b8f723176da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9DBC8D81-E224-11EE-A63C-D2EFD46A7D0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416597609"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000119886a253b8d9b4547c1ab8b063da133b9b2922d3a32e68d104e165459ab39d000000000e800000000200002000000077150cec394e8ca323eda3a5c8414a163ea101a07bf56f5ce2086146ec44179320000000f2a750a16dae753d34b9acf1c4ed229e8a7178da1f7c38489e0548fe6288f21c4000000051295f71f25d5127a4c53f248c4dec0c08e5c29ec8874824a81f0a09f5f66a653f532b97554bf2a6ec9e8be0fcadefcf86f03dc54c1de50be823d1fc141c5c3d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2708	2072	iexplore.exe	28
PID 2072 wrote to memory of 2708	2072	iexplore.exe	28
PID 2072 wrote to memory of 2708	2072	iexplore.exe	28
PID 2072 wrote to memory of 2708	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c9256c4461a67077d746cc731e03e4bc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74013652670b9d9dc7e499b664239eed

SHA1
24f8c0d32c6846f310b18a580d8bd20c6fa5dd75

SHA256
c8f125dd24323e98dbbf1b83894dd4e0d648a4a0e1f0cdf77a0ae108743a7700

SHA512
0552d1d4652eaf329b45975206dc760f015c6e19ef9e799f56b385f7e71fc815634f556ce7217afb3bf4b4e74fed8bc7c2a016655718aca95fe2b7fc38ec5549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e99e600e8a731e3cb56e2d4dc459cba

SHA1
524696de1096b59aa42afd3fa86b05240e80809c

SHA256
a2b78fcdc1fe591ba16a2fb8591bbc230605bab9b5330211c513d26482d8b301

SHA512
eef6abfc1dfd2894ffbb58c9f1dace1dfe5416af6d79540c6c4d99f9f8b8ba3014e0ce876ce6b772564abb39f521e7aa61d5b967cf2dca23b686035f117df311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4d469c1ea5644cb52e273e46457b083

SHA1
6ff5be635f46afc6e888bd835e5541f5dddc1497

SHA256
2826c5013e710d45a7710c404c381fd9f9dbf81545be8587a43b1c464368e11c

SHA512
2aa204b095ca9af31607fd46c1365e82647a3f4baa2adbb2e42f304ac885cf5f782f715a9b5d01caa6d62a40a731a800825d2717d309d57ce538cfd2e2ecb655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02f2117e221f184defd510ff3deb7481

SHA1
965673d88c08f2750ba9a97f7e5840084912f5a0

SHA256
bcac810be59c646409aa0fc60e626e9dd5548a3454b55ea7d32fb44ecb58dffa

SHA512
a727b18d70450603af28d712662df3f2a707dac648d554b08f652f1949940e5f0b6af0a815db65d988ae55e5f6da6a57f63ba2df1ae1a977ef2275e6975ac685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c5cc7be7c386a9b9e02e2657235d9df

SHA1
cf7047fc7b6a6e734febc150201bd9093740b2a2

SHA256
5ba5677108e6e5e6acdbbca9921ad5c016d5e074d1623d99351c7114f15fc905

SHA512
35b07c621d4cc70c97913ae9b50f76cc0b699cf243810ec555ed98961ce0924c0e3b2db4519de68851b669efac87b16225433fa879bacda0e86e736ebc9b441a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c784989da57c22dfb9c070b48b226665

SHA1
700903487c170ea8f5efc00e3c799c385a92403d

SHA256
7c55351d6270c4c9c7c43f8146eb45184b808b0a0afacb10c2658b43ef99340d

SHA512
bace6e47bb248919b82a9d62829c75e2efc0c168d7126d770642462367446404cac15b13a064e89444eb1635ca778d3c9a16305d911e8ae3806d16db850f67b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09e21c5b4dc04053a0dc66a353d7d76e

SHA1
1056f1f4a41b0d71b8bada0a3897833704f1685f

SHA256
dc779d7a9c010bd731a9f64f49f6da60287faad857335a28242ee26f8f3221ec

SHA512
04e8616edc84ed36dd6a7e9154153b49333cb8fe4bcc01c591cfc4f57ccaa8695369c904508c10977ec0b401966a12430cb2d4e24a13c7677f1ec2c22380386c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddbdc754d1e1ecb02c1c4ba97d65c01f

SHA1
0433c2b6410ed5b62c7f0c4477163dce89781738

SHA256
794102572701747458dc376ab471750c6d2bf95d54ec9632f107a781d1d72e97

SHA512
76fa6f37e645a130a8e0d02087cfef1e2fcb27c38e4846064dc1cac4296225b4ca7bd6ae52b2511370c1b18632d2906070a8502cc2a8487ca2694c3e3fdf06d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd77040d9a45891456a5ad2c85d6459

SHA1
1a11676f8f612ea4e7033bf76a9dc75f385e4ec0

SHA256
c6708c7a2f83f7ff94c38de444f09f212a37f0d46beb8378f6d83fdf0afc01b8

SHA512
18986c2e92a85db05ab0564f9569501297f77ad741e8ee626bf239b21eff6db0602d483fd143901a65327dfd99bd8f475a7a2a1f7097ce4d7acc9f2bf9cbf2a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d64ca780bf166d25d1ffacc7ef19c8fd

SHA1
2d4db6aa7b6132a66627b79e298e17c6c7b9cf56

SHA256
44421349543c36ddfc98798ed57d15795fc3dca078499f19f00fb6713199659e

SHA512
20f3ce3ef2ca7b12df441a42f893e06c1060bbb2d6cd5e75b90fab3b20fa61cbeb42e6ec464109682d6db0ddb3b2b412449ce78adcc2bea769e229782cd03634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f6b258cbe2424e6d9a0f6bd2ee1322f

SHA1
5c34c070d9428d52b02957c991948b951eca9656

SHA256
644beb939d0549cd5cef693ced594844591634a46b88f2425682b4c14302a9e6

SHA512
d06aec3b499113855412bc17d37da18a58c19fa9f408df6033a293d52c786b3d15783d2a8aff3de23a639a4c8113ce465fd2012463b2b6693f4ebbdf11d7fcfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6caf2931ea63427371c5059ae87da29

SHA1
fd8a48c848cc8035a437aa15da2b1824fa5e9736

SHA256
2d985271b581875c4be44b1cce4bd5b0f9b6c641179d516074d2cb4d07c46e68

SHA512
d2716a3c629596f0d504704dda3a1c1903d99a2b53ced246ea9ece445cfa0191d2ffbf40e5f3920ed85fc93bcd2172d67f0b5ea0caccf39a611fe9fa0ecc2fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86833e7e93032c435541eaa725b419bb

SHA1
c2bebc0b1e5e64eba7a01c83e6303be8d03ece0e

SHA256
b3022cd7e44fd809c9695fdf2b8404d13573b6a3b17a08da461846139e625bf7

SHA512
ca87ed6d41612836021828bfd2336c8e3c52c66edfdb5848bd4a9a500af80f461a81209d3a835cd564e67776bd1839fa82823e85c89b92c97ad6ba00558b6a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85F4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar88D9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit