8b92ff75be6e8c85aec8369e24dce2bdbf71593a429e279f3ada814d7c8ee233

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa73995dbe9474f6b0ba1436f0c0292.html
Size

296B
MD5

caa73995dbe9474f6b0ba1436f0c0292
SHA1

ce9e7f739ff08601552b3d9d186dd82a56b86477
SHA256

8b92ff75be6e8c85aec8369e24dce2bdbf71593a429e279f3ada814d7c8ee233
SHA512

d05856e6cf275cd405b8a28268632a89d9924f7d5b67cc3a8a21a5c4fce0d356058b9e8b8a4903ddc43351c620bea9bb54a1d4462aa0e1fe1ed6b5ce962d8e22

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02422ad9d76da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d1b2616e2c6ff2879dd1eb76ece0c53b848887156d03a7f900fcc7d800a77632000000000e8000000002000020000000cb18346f7f561abe7ef10daadeccaabf9e722c30b9cd69193bb82426a0a3c8832000000072d010b6660e87f53a9e697306bbb71e36a90e4b97e07056b6d1d11cf192c78e400000008c6f7702f0889a2e3fc94ba3d1a7d49633e8b099928c66b938e49df17cd2ab3eccd8703bfb72d63819bf16a2806387a360927ce1860304899f6d29c6a34f3d7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8A1F9F1-E290-11EE-9AB8-560090747152} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416644095"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000068f3d842d8c58677bfa1f1b515b003e65fe19659b2bca1dde25e39febdde9b65000000000e800000000200002000000018b09b7e0ae4e56a58faf5468db16f1682435bf7dbf96f7a7eb9a2ed0a06ee1690000000de0b8d521079dff9bc34b02b3f9e0a4ef358ba791ffb277fa09dabc3c84d21fe9018d423e26dfba63cbf065e0589341eb3b4e9b8c2cc4d2b334aa15c6bdc16c3ee57008a74f9be329c6d5d14da4002601181242a078c42fff248e3fca59987afc1814dc56a7536f35e125b886b70f5b4681f71cfbc6e1e66fe61058c35c8653c455b78611558c49d740ac9c1a4e283804000000099362ffd11601d98ab72acd80412512b333c1ca1eeb6bf5c33408d35931d93df30832b5c65c0c83183ca0c057410ccf102124767941a67f1b1196f07c5efa01f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2816	iexplore.exe
2816	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2084	2816	iexplore.exe	28
PID 2816 wrote to memory of 2084	2816	iexplore.exe	28
PID 2816 wrote to memory of 2084	2816	iexplore.exe	28
PID 2816 wrote to memory of 2084	2816	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\caa73995dbe9474f6b0ba1436f0c0292.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e6afe5e45795bb1f51478621e2e0d7a

SHA1
54bca12ff008c466458d9d42cb32da279453a339

SHA256
bcfc3fde8d70d6004bd24ff6398e0fe539672579092205b28f56243a4197f31c

SHA512
a62cb6ab9103041127013133b8dc220a9e3a247d56e7426e1869e60fb0902cfbf3bb38e116576d885780df6ac3f91d3654548d35ac22db40ecd78c573b50e588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7ff3dc72fbff5585b92b998519f7952

SHA1
a5bcb0d0fabc627fe9cdbca052c68819caa499aa

SHA256
6ca022e16933be0505f2db9a1c687fa2554cd8ee14008ca314286996872ef8b3

SHA512
c217f3bc930dc41d78799288231d5765b1470f60ebbf75164abb6914b20a94940bcd08270ff560146fc9b784fc01a90a6687b410daf0a96ba3bc89c2183649fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d032d36769c9791af416a8a70ca115f

SHA1
d49bcc827823a4b8ab6cbae464c3deefcd01bf3e

SHA256
18fa50a40d7308483f25689d09e5918be7992eecdaad2e2c3fa7b6ecb35c0214

SHA512
9f3d84136a20fd1e9162aa056329bbd5316e1151fc3d7a6fb59244e4f615135f4edddc800d96a124eb697315c35a5f8a7c2a7b676aa7f36c0a58fcbe09ea83ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
886b00ef8d51e916ea04a01b901fd57b

SHA1
e0ee8b5e3125c248e186d6b2766c948c827828d9

SHA256
738db16f9500457a58ea2c17d8335b4c17a10a40685290d8cd6e6584c53e6a1f

SHA512
48f393df5b5e4d4ceb7afca99cafde2a22440fe56736c3f3226b0bf7c32ac9d0de8f564b8f89a6ed32bae1cbc367a4e5e45c56a54f5363cacba1d1a78685172d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
987f8918c4c4119ad5b2a29b2d94736a

SHA1
abb52e5eb117a32bb7a55c9d2c81efd2f61935c7

SHA256
fec030b03664c8c770df435df2d6b80cb193052cd1e8cd1f4f685a1b77b78969

SHA512
bda9d5dc13429464abad9304f0d7936ae2e90e1c2f72d7efc2d9474e80509261c703a701685e60d8042c5335188a1974f69a6f2944b1a713126bada384b2139e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45cc211bebd0ed1b3a6cd9f278f41918

SHA1
280209f80bd1a4740bb50732d400e5b8e82e005d

SHA256
3d6e3e52ffac66de1efbee3cb4fd0533a485896a2b20763c58b74f2d5a9fc6a7

SHA512
4f187a1545e4191d86dc319dc1e198de9719bc2418974acda043c44fb8542e98d48fbe9f81003b783b88d62574c3441faeb0513e63ca9ce2ebd72463bb703288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6648781f28368e8e1e432d5c0a50bea1

SHA1
76dee961606405dd02a128581296f538a090e68f

SHA256
264e25852ed1c40a1dd64ffc5a394f59587186e7cd2da11f888e09b0b268d964

SHA512
77373d69af6a1386fe9ebc655da230ffbb6da804f9ca0c229c7c5d8da9dd2d704132a64ce8385607319f5c4d92bce2a9a2b95e892f887511e8b00c5f85798413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99a5fdabdbbd901606ecaed507ebd4c2

SHA1
061ec1844cc7bb79cb2982af94b7c2dbcad1c1c1

SHA256
2348eac679e7f1c6f6788151859f43f599f42373cae85b91f98229efa9f0c2a7

SHA512
5e32abc3c730127ca0be81abe2ffa6811f1dc7cf5664f7d8ef73b0af24884efab5312031bdbb9f8d32ab3097875d4bedf6ea70ef0474632282df661dac40336c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
056af5624025ddd044dcee92b8b96ce4

SHA1
280253f9d59124c4e5463590b24ef957cb3a89d0

SHA256
6f8bb83cdb0d3a22602b98773f98b14af6aa9726134b794b1b9e4dd956babde8

SHA512
0c6d57a62633071e1de3cd36b7af13cb8886b69b4fd745eed54e0d0dba5084b9b03a1c81bc92794df5c8fe7fbcebc4240f01b5dbed3e4685ae2d85b2a1e2859f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0088be79d765054da6661372b8359fb

SHA1
8a2908e094119d99ab4bfeb6b3766278c6ad96c7

SHA256
ff9ac20921eb7772f5136bf9c17c8c119ed38cb5e19bccf469983bbc8b4c3f54

SHA512
ccb5a4c456df6f92ca5542815b3e0b76adb6a18d2649e0a3ef8ce26dce13e6b7b329d8b47e6eb3888334fc0c47d8853597908f338f9bc4405d65cdb189d7a500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89dd2dec8ba5408cae8279b15a107c60

SHA1
78492a8cb1f852b6a8d031b96001524ff802c2eb

SHA256
f54ea143a4ffcf4060ad3763238c13d7be20d251787bbba4f213c0df9741d4f3

SHA512
39b237e835c4f084a668ffcac7291bd686e02753c65a55af8f1e0d1f6e385a78f51e6970c801c692ae6251469b4ce3689f32c28d8f98ba07b345b6672193ff4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdc87a7571b4f2635c982cda1e1a3188

SHA1
bb831b5a1b0c0cc0476f69708e338ab0886c59e9

SHA256
06391f9531eb85d0d77198f86353a853685135f9e67a7cb172db660c0104103f

SHA512
d7010b4cb93dd64589d3472b8dd4a6392e56ae8608a13bcbbd41893af5ea605407bba4fe6410771df8c2e1c08fe1c63692752dfd1468246187e83c5a99f72af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b543b37facd6848b1594a0a56195503

SHA1
762cf0fb04856b2186da72fcc1bdda01b3b92236

SHA256
455d6e2169a5fb4303385e5c1cbca74240329a34058918a5aede540be57ca4b4

SHA512
0f34108ea2032d3d9edd9db4817724a12ae79e67ee9bd94397a69fe50ae5c716c27fda94c831297e5e49b5c65610fa3cccf5465cb078ff35db9ffd3db5e919d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab280C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29C9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit