0bd78b82f16cc8c885fc68d8fc748b6f3ccd0e5c9ab77326f63c4f917c3a2f53

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c94bd32bf93b12c11b8bb4fe8cf2c6ba.html
Size

4KB
MD5

c94bd32bf93b12c11b8bb4fe8cf2c6ba
SHA1

2b90ff1415bcb1b8d66fa3c41e7718ee54adc7bd
SHA256

0bd78b82f16cc8c885fc68d8fc748b6f3ccd0e5c9ab77326f63c4f917c3a2f53
SHA512

64d973c85a970d2c65d4ae0a12e2ac1e341659f8b3163ae782a7d439868e60adfec580fbd9b0197a9ce6ea8f06e91202c0bd46a92a0a8d94d6444a63cb0ba6f3
SSDEEP

96:rf9seakGiwLsvfpFFOxUEwvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIabvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5064e5db3c76da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000d8ff54ca23a97a9d0b5d407b960e0c3a0c7a9f1b0f1a3dee569a5386bbaadc15000000000e800000000200002000000010579a9a91d81a7fa7c7cdf5eecd580f7ac0d98159d45b29bdbc52d3754004892000000021525be6ae1aa7feab0821deda93ace31e1eab309eb409e1082f58a3d04589084000000073def35aea049f33e2d1b37eed22d15656113abf31700a2ff0f6c1f4a6ef0d9f0eaaa3a626fc29ecdf51a131292ffc97803b0aeef4f5b30d87ec55b48540fcd0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{074B1221-E230-11EE-A3F8-62949D229D16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416602511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000766508e85ddd54c5232a1ffec855a01df09137ff2910fae06dbc367e4a02939f000000000e80000000020000200000007bfb61e090f53d68535c6945c7a67c18753a7c4e4264ebc159aec4b2694b65ee90000000c3bfd8e42ab98218c99e130663aab40bae251ca4d25bb41e4df09b761d1517f84244531b18ca82ed5cb2daa5931b520d3cf36665c0d7be111efb962785b39db14234661ff6e1a4cbc998c3a8a3246a8e7ef899ac76ab7f9989f647b253ab5196626c342399e3541bf83ab90df2e5e000d63d0ea4bb5d4541b735504e6881350e20dfacb45c132b38de6218b22c32b0b04000000037610294e7d77cfcfdcdc4b80bff9e2bb0d48d9ac05a39bb2ba1acf6267b1b852aee4d70b1a05570091b997bbed11b2a41e906759a98ff6fe728c87145434add	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2556	1992	iexplore.exe	28
PID 1992 wrote to memory of 2556	1992	iexplore.exe	28
PID 1992 wrote to memory of 2556	1992	iexplore.exe	28
PID 1992 wrote to memory of 2556	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c94bd32bf93b12c11b8bb4fe8cf2c6ba.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
947fd9f51bffaf72195265dfef0d150e

SHA1
b440925c5a0496a71b94a719cf1ecaca54c20435

SHA256
a9550930746f88d28682ee0f2a008b3ea75453bbe134496b7ec2f937ea961515

SHA512
7b9b0620c6b2e1648fd8fc4ab3061f4a10ae7d5ac169df5a2d17f0c35c13e6fde21f80e77429075a4cb1c6838f93ca50c21b898dd01d234c995581165172fda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff4bc008e28792f1d3c6fd6189a776e6

SHA1
ffa0d5f32e0d1f847ef82fbb33ea553ceddcb611

SHA256
1b7309fd7a6196a986d972cb365a8b92a44475dbda9e41923d9fc10fcaa35ff7

SHA512
928a0795f9ba1196b522fac717cd056b3e3999ba52a588035ad3b4bc157c41364254d38984d4766a6de02c5300ebaa38d6af0be43bf17df8df190be6b5fa8115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28e84ad0bda91162d354506626c4492

SHA1
77b12e4eff33b776862e6db34fd768ea392a1bb6

SHA256
dc2713ea323c6dbe360fc9c5a20fb443c28171d8b2c4749a28c6c2939329319c

SHA512
2f38aed7f2bb0b2a23b0fd740fafdc8a4a17c54f8a54b0ecb59744e1a9803261de203c8c2db2147a93ddf6b653a0e308e7a4542997149b7af94cc9a0cc669a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b8e365e498ac557d131e225ef9bc5bb

SHA1
903b2218a0507e0444db07264ee32e191ad10696

SHA256
474ee7f3665acd485b57d7c32afb7a925ae38c7d1ced2220c127386a4fe3b51b

SHA512
8e5ae135c011dbdec1b78cfa8d0c4dc695efbb46d40a41a7751eeab62db5ecd663087388f328a08d1f0bacd00f11764f067464572a1ee5ac2aa4fd45dfa476ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7f47c53edf2d15058ca92c88b325627

SHA1
e40dbfe7be42340652d0090f283620764bf9adf3

SHA256
548850b964ab6ebb9e691859544a653bc93556d7d0698c448dab72d7867e3876

SHA512
2d8000c348605c04ef8fe2de721be0574e22ce16221084b1fd1484173f79846f92a2b14c45cd825fe8cc763213e49493a01dbce970c4268e953d9beccdb24d7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7b977a6b453183d285c6db5156af71c

SHA1
4baa40fbf86ae0ad7ab19e975ff31adfebf8a833

SHA256
8b571750e25061a9229a841c59a15d452dbd32498f938f73cf7cec4e55722101

SHA512
90e52263d87a323d08bfc14e4abd00bfce89160737e6e94c17ad6a5d870c8f98c681996af7726ffea616eb81f0faac9bef8b0f78ad9454e75429421ca523d2b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f253cad9353b3505248e5ac0dfe44a8

SHA1
b3933fbc4a3d0cec82199fc301661607f7a4f9e6

SHA256
d40cdce4c963f316342b87f9393f137df62ac5cc2277b51b923e66f6ae55135e

SHA512
20bc1dc70d9c98155d0be511fcd71e9117900611e2dc47a17641876fff8d552d09b162bb01372152178fa1ad439a7a2144724a20bdddb902acaa6c238fb12189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dac5a242c4a6c3dffa0bfc50804dd09

SHA1
466284d494025cca9e50511c5dcbdd771013d9c0

SHA256
a0284da1f64c99b2a260aebeb758b7642e497378306c3f6038b7dfebd38c5d06

SHA512
b6eab59e623218242834ef0d520ba968716361ffcbc40ec05a03615e5146a562850bb5fb3f0d10a71a6ed1411e0f17afae5c6727651766a23087eda590bb8a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac955eb8f1a1813f70bd989ec1cc1862

SHA1
ee2c049be2daadb26160fa220f9de6505cf686ac

SHA256
b97ca2321acdd2751863cff515e8bce56c4f79324eab20aeadf5642c993af08e

SHA512
809a198db979aa745c1c026f57e37777404ae058641027308a3fea2d6fce27f2bb1e063d1956e78f94992b9e64233e4a0048e378b266ec6e6dc3794fc7031bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C30.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit