8da9a466fd8e138bf59dcff1581f80eb6905701d4d53af5855771a9c7242610a

Analysis

max time kernel
122s
max time network
158s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb20bf511fe61471bf1e77a3ce1d6eff.html
Size

43KB
MD5

cb20bf511fe61471bf1e77a3ce1d6eff
SHA1

28e9b5471a3d0084ed89746d7a052b665e7143e2
SHA256

8da9a466fd8e138bf59dcff1581f80eb6905701d4d53af5855771a9c7242610a
SHA512

8dee754b00df1fec08ec5c1e8f7ec1bc4b079286deaab91325d6a56b61b2ccc6e3f8d92af2ccc759d6136bb6947b1452a9c40e7ab45c76986732a0ca14b04f4c
SSDEEP

384:S+7Ak4Kw3EE13gksNV2XjQPt/jgoB4nodgF6R2M7LXm5:S+sk4KwU8w2XjQPt/jgoB4odgF6LK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDC7B241-E2B3-11EE-BE94-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416659112"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000009a7ca40ee8ce8074a0a9d866e7ad94b9646aadbfc3d70b458ebd8f1408f8bad2000000000e80000000020000200000007a20fd002099d6611d307c33ef21e0eca53af14e2eb3a63d2f99833ba6b1eba020000000382e49ca2b53483c3ed5dc0ed7f0f3c825e15b69616adac4ee5922537a69dd5c400000004432c32b44d586018fb3b407f7d49233ffacc1e86a4d2894c522d678c8d68884c78c8939b844225b5c97944be77819ad3d209de71b45b2c77ab227fbf7795ef8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bd3fa4c076da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000b5f9fd3a16d3dfee0dced88006c9fc4f4442c3584f65641ff7b1f65c3ef122a6000000000e800000000200002000000004cd1ae8fc8f184afdb7800e9f019b963f14d0adeb5d5d9cd26f17223142e2af9000000083b23f2d9990ff4da3d010db0a2cd1208c864fd5d7daa1731a76ccba9f9f8248a2af4885d190176ea2018ae3acf97da26d73c80a5713c7cb3aa8479fae10129144208bc42c875a033667f57c68e24cf0826b948f34973e51a907213cc15e3949e80bcd4d9b69576207a48c62b914abcf07b4e67c9027a7008e7129812e5e116efa8bff0e8906e8083f7eff37c37037bd400000008a2a6df1c26efee6191cc4666eed7727586b140f30e9d85c421ac469f0a31c5bb1aef94576963a063dba6d594f9111c0f19d90f5a1ff96a7b370a07faa40758f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2556	2016	iexplore.exe	28
PID 2016 wrote to memory of 2556	2016	iexplore.exe	28
PID 2016 wrote to memory of 2556	2016	iexplore.exe	28
PID 2016 wrote to memory of 2556	2016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cb20bf511fe61471bf1e77a3ce1d6eff.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de0829138bd08c8e80c5e227f31cee26

SHA1
6f6d27632848233dd5220d0f7f8771a1f2c40f06

SHA256
028d98a3d6d3203736a70cf3bb797ac632e1a9218dfe98f611979a65cadcdbdc

SHA512
4b1fa5e4aa9288eecf0531bf22dd183c2e7c88a2fafdbd3e9dc2dd3b31109f2b0f72e3345c5dc3f1158390c0f608712c8b7d6324932068b3617042ca21aa5c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
770f199eee2b9aec3eb7430030949c13

SHA1
f33f849acb46f0a90da23f4dad828357e92f72d9

SHA256
0ee07dbbc8755389cb244582ec839839fa300baa0b370e2481985145447c77cc

SHA512
64123bb976642a4792ab92e0ee942046e0c848ac62f120397b323d3350d63435812b480b6217a8687cee3d5e4c5d2e39627a50d60ba5615e5adf743092d9b22f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0873ba3567b60bf6b013e54c6d7b5d7

SHA1
bcedfe927fcfdb9c3c06ba227f092ed4ffb223cf

SHA256
64cf9ec4588b01a5abee2f47df535295e025a40c6333d650631cda543905e7e2

SHA512
5ac86f7e32f92954995b8cf5627b474f15c9aee84a002757cdcab2d76b8c224dadad09f7a30feebc7a59dae77e4c111f589f4a2fae58a98119805c1f46d3c65f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84fbdaf7426799b61952ebf1bb06cbbe

SHA1
0cfad23fa7a3e12ae0bc7f89d71f934ea79549c2

SHA256
a3c5d8f8156c7eecf392de34713a0bebec5d74a6621e7b05679522e3d321cf0a

SHA512
a2f48dbb9d78412c4790f450e6d757aad5da1b3fd6fc0d58d85bbd558f86ee50d90f2d6dee2ff4ab54ef266157f54775aaec5bf03528605642be56a025f52177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3153ce34d1eccede0f7db13b7b01682a

SHA1
34e5680f1bd4875ec79869650827d4cb520c33cc

SHA256
5790f2a18a5e6270699d781601fc9b3b83acbd391af9ba2bef5e143c9e5edc52

SHA512
d63a1945f30a36bf56f59f31737a7983f8cde434114d54887f5c946b183a35fa410fd687829ce30e123fabaf586064b07c6c0a2ab415c9a6950e7e0c7b618cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d29807be01a11968d6853acc5367618c

SHA1
5c327a7bfccd14d6a2e9fda79746d002f809a4ab

SHA256
374687394db4baf3cd0cf4edcb52a6d98adc4c61b12be2544e3ca76f012a6853

SHA512
053845fe061fcd5d1a73e6b4e27ca80d2e922ddd6a3a1e698c677eea6b782374370fe0e80e30640cad578a55e40522838955c4578d4ac3113bcbc173ccd799a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd82603cdf8379cb7c7b75dc02cb67a7

SHA1
8fca068e7d90d2badc58fdc368b4afb825eedfb8

SHA256
3b26d409225b0a29079860447a010b0341a01a0750cbb8f88619fb2fc1aa1287

SHA512
8863f7ce3bdde9e497972e235d2eb6e5454cd5db28fa0d90ddffe476972609aa92a895e1ff52c2fe33044dd333c64665a23a26293715025bf91cd2e2a5500726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55bfe12144aa7848aaaeb9fa61b6d245

SHA1
594c81d177dd27acd746ae5cde67869bb40d814b

SHA256
d00c709c901e83b3a6545ceb8f84794821735e8f8d4abfc23c6d0ca712ba5006

SHA512
903400e6223bc67df341ad1d0fa9cf08111ca7af93f1faf77f091d0340b257c21ef9ab5804506f2c45447812d07ef8dac389c4a3f758fcea381c78a593939742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c94966fed8f55ae7eee82d1dc40c305

SHA1
73434e2b73637aa2523fbf7fc1317ad547f85410

SHA256
4c9126507a67ce89216726dd4bb93d05f8fcceabaa8010e63f75bc1cd21b1010

SHA512
cdb111fb2b9b52cde1ad44c10e70c4283c57fc4b20c7268e672685c6e77ec9db8e0ff76f1dc3888bb0cf7741ea5dc43c99ff7f21abdbc771f89885965f5964d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b90f74ee75dccaf102ed8b266de44c15

SHA1
12d78f1cdfa1ff631896a4972adb9d2d58aacdfc

SHA256
740ccf4af50144a0d7849c4a72aacdf4000ab453fa86881a631f147f0afc99f9

SHA512
e2f2a1b372a966c71db804b05459478d407ca50e386f811edda2fea135a7ee98b8a11027dcbd918c167f4f29ff3244a38d6363093ff9113fae22eef7f49bf183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f022e1b1001a1e162a371cbabb919ba1

SHA1
0186563f71e0cab3a0e1400bc5046008b3ace935

SHA256
d2a6213b9bd32181266cf412a9aad45ed136b8e9556022685e487c43b8454187

SHA512
ceba1315dbdb22e63bf34834a49f298e2d24936d9de29f96b3101fc295b493cc0242e91187dc1548132cab6403a47104cc534b58c1ec6a1c6c75ab20e9d2f279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0593013687b40ca9c33eb0245ce43e58

SHA1
7f33f80533afd8fac00d8d5405572b2df45ce30d

SHA256
2eb562cb4bdb6802283b3969195d940be1754b9658692174cb9d30d0538e2458

SHA512
bdf5a42186a86ee6c7021004992cb09e3c6ed0e8fa0c340b942663dd04d7705b65f7fa70263dd394f9c414ad4fd30fb28a55b9a121d99c1c73a57e1eed9fc001

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA19F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA54E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit