88baa94dea4465ab189b6e0b2ad6e100c8e70c2e65a1ac497aff097cf3b8afd9

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb945a3c77429047a7d9b680663c0fe5.html
Size

30KB
MD5

cb945a3c77429047a7d9b680663c0fe5
SHA1

b9d7aa9e60fa35ae8527e97c1918087236980125
SHA256

88baa94dea4465ab189b6e0b2ad6e100c8e70c2e65a1ac497aff097cf3b8afd9
SHA512

d8304c387df158f2e588c523e50d69d1e5e3454203aaf7f17a83aeb7330ed09a7678cc966c6fc072c1721221865b1d3fc68471153e2338a43424aadb6bf5dfa9
SSDEEP

384:Y39ylPMFbl+3x6gMltnzoLZAsK1UBoOcucu:w9KPMFbl+zStULZJKAoOcM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0db849ee076da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000009eee58e104c39d3931f84c425ce68e60e789f7a75bd07e9d4b8d04366c47142000000000e80000000020000200000002568e07e3fd5b76685fda3ded6a7881b77bb9d986284a2190a81c3c42b44319f9000000091848f3dcfa99c41359c9455e6709cce70ddd8f03dd7f51122688c66e0c02f2c74212b953548ff97a012c684de39d11a571df3fc9167740bfa2afbb3817feddf2a831d718af30f4ac20b704678dec9904afe329df6dfd5f9949f20c8f7b82ac438e34d67f1f1be6aaf48880e1d5e8b2470648d2eebb131c38bd3696bb4209d1fabdada5c40ce9018dcd58d64bc94e49540000000fee8e8bb01d09d76bfac397b93bfbf4077b366d887814299e3deba013a6ee019ad0a99a9cc9bfe84d17d050fcae06ebae9989dd761f0048e7a4decbf2d221482	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416672827"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000092a0c2cdbe405501d211a68d0ceec95e5454ef32b73831c5f33f3a34e0b16b73000000000e8000000002000020000000c41c54615579689943aec6ac76cbe78420e4ce579c93ae02b44d07d78ab52ba4200000008ff66efb5af27a2fe7feffe4f77644471f4af582df53a69dcb182f90053eb0be40000000c46a39e198e0b840369fe895bceee163f8fa17a818fa6396ca3c6ea941673c1a55e842b8ae0fbf370d0284a7f02a8e8ff588d32152a763581c00b912308c5d45	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF54F181-E2D3-11EE-85E5-5A791E92BC44} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2532	2000	iexplore.exe	28
PID 2000 wrote to memory of 2532	2000	iexplore.exe	28
PID 2000 wrote to memory of 2532	2000	iexplore.exe	28
PID 2000 wrote to memory of 2532	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cb945a3c77429047a7d9b680663c0fe5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5677d00f137e0cb9289ff9a721593c26

SHA1
7d3592316dceecf7b620359139d7f77cef0d1a3b

SHA256
cfa3bcaaf3c257eb3f8b8ed11a4ad37ca029fbddd2861bedb1fbc9a48cbb640c

SHA512
4828261277f021ca8f0a5bc7e7aaf7b02a097ce05598d7a9cecc770445062c6727d120ef004eb7be57c763c53bc570967842ad82c6ab0b2a69f5376908150142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eeed399b189d8e2950c1a3f124e4a17

SHA1
60fa642a65c0ee9f98642ae0936931e2a5b0edbd

SHA256
2d4ab4b6a4ceee75e9df7f2e4bee8fe949ab0b3ec721363ddf6fbf0862377836

SHA512
c35037521797d88d1afbe2bbb374fa6549fc4986f7683fd51498e52ff3a817b15f8e620f49f6737f9f2f1a5b1d9b10274a0d4c03eb4a568dc94126a6fa4e295a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a6e46623bac815167639d5304fb2be9

SHA1
3516d33186ebd883526c89ea2ea85b9985726abc

SHA256
181d5fda19bf4232341410c769ff069f77ee3f104d39ad69071abbad7e593219

SHA512
abd83e44b3227a382dc31625d03afa43d16961860ccfba1b2dc0405f844691c20ef2721752ea33954d3cef9810b269e0193221091381c44857070aeee4b08168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56dac9698a53d8e78bbd479a8f15cfe3

SHA1
0adcecda8c876e68b81e337bb57d390e387a9966

SHA256
ab6af75eedce4c9e3a41aa5523340634dfdac149020b5c92662b083eb47a0d86

SHA512
9c18c5dd997fe1ae494408a3d55fd654a1e0d786354f87de8d6321d19429116bb2b5b3846c44517a8955140875712395d2ae723d7d1c44c2927ff2e2a8b861fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa8165b98ba15ab1728a5815875a193f

SHA1
0dd8ee2f7a330263431a511872d11f9732ba33f1

SHA256
1bdb0650dc584f182ee91774f1173ff5dd1b02f1e9f355b322370dc1a17fcc42

SHA512
dd43bf4ec4cfb05567fd7e5e771b9b8830c85204860c219bb4e67839122ee0120ee0f8ce03a3b39b64ff9ca4afb4899b192d832d88a1584a72ccee36bbee00c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6539f6c25c349e0ad51acb281d282ec2

SHA1
d274261ae1b012273d2b1ff55c9348cbf02643aa

SHA256
42777b64835b58ab2a934a31b4e13b14abbffee6c9ca85f56f4e9f0a81438093

SHA512
e40a146985440b41568970f7d5548602f23ff1377b76b965e10c83f8fb335be4afbda308d0e25ee664962fa20c83c81d273259f7deac9f4738640cd0e719a557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224a8c11e1594be7483c921878e623c8

SHA1
160a3b318e5301e853541c9acc909613fb8f9719

SHA256
51bcd7308b9c31ea04f660157045d11917bdeca3f8d508c68dae94568d715e16

SHA512
3bca4682bd0891ebf39c9c898572f2717a91115f5a158f44b9bd38134002d28330031ccf44de7b20e3043cc432adbe776a3f584a64074240de206d8bd9bf710e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4cfb21ddd49d0143ed8f9fbc3d6d833

SHA1
4aecb72a83c0015f4fa0353cb89b12c81ee4754d

SHA256
9c5ddd2ce400ae74b7a718eb7b11321692efed3041aeab0492aa3284591c4768

SHA512
84cda74c6738301d311757606715ecf71f09a73b43331fcb43f3e8865d81058d8c9cc0376c49b68451d0bfe9004a27d183fd29f22bfb1a15f13bb6f296e30ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f81a08070e996a869313e5a05a7f9620

SHA1
39b1f76681125fddc4516b6133dad334bb4b2779

SHA256
7b87852c22f93b20cb3708766aa2ec92d4458e386a1905bff7e38b81c6ad4f6b

SHA512
d82d7b2a6df9f72d4a3bea3fd2870c245a66d9f00f06095d5ec46d6cbd6ced0f7900117c8a0da3e318d089b441c7d578a1e12657f26e6665a8a8912e13fca9f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e779201de58839e9a1e488d4f46b67dc

SHA1
94c91b657e1df279cc3bbe5d4f9c92e46cddcabd

SHA256
a4ace7e94917cab5a0ae07be9d672b393897832dc42aacf7a247d73e6b130314

SHA512
0a0eb25c465c9c749f46378b12e0c4d96c8f1a6135293aba20d28e6dcc561fe9bfc8159a24caeb2955218af8394ee6b8d9a6a3ef0f2e058a9dd1b28c5be20eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af018527b101fa41669132883f00a9eb

SHA1
c8468dfa23ffe6ab5a50d143adef4fb3139c413e

SHA256
1c396acf6f3e0bc476d8a0d2580dfbdb4216446424387b752a98b22594559cfe

SHA512
6d065e7a1345e301a1597497aca795e9d3d9068dadc501515662225ba5160da4f104fe2e64bff095b3e2db1749399246c9cff29278898696171b9fca4d94c8e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a72b19ba75c9843859e09ce06d920ef

SHA1
8299827547a8d85e4f0b617a345b244b03626883

SHA256
8a6da6364175eb588dc1193a8fc2661c994634d125b1f77d36471a807b11332f

SHA512
68df1606c5b7d336525198451e85dc5557403dfbc40d7d19b9560fae93c353c9ed9e84d91c9ba4f246679e6ad4b3b786f7e71733286864981eccea76de9d4a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
714d0ab5485dc6472ab1e3c92d97801d

SHA1
4cecb6453a0d4d5ef04b363d633f3b8896e55d84

SHA256
87adf3822455b5a103685d6e9ae63154052a96ddb753083f0fb74bb4f222cd00

SHA512
73c6c927612dd1f020e08d8ef1fe1552c2a903383fcd7c3aec782b64f4312e1756a5b64f9cd4cd6f6c45117bc03896a4d2ceaabd1fce993fecbddcbf67ce5e1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4409c636617a1e1561393b4ce78b4ad6

SHA1
a6c2933bb800f17bf67a36a39080dad460e12736

SHA256
e34447f6e5013c067516bf9c9245855883f420591e632f5c7b1791eae216e992

SHA512
541e20873e7c1b16f57aa95f0b92d1f7cf1e585864185b20cacfb34b3605e157c5ad1dccbfed8bc6cc0d441f9146ade4088a40387c7fbb9043492a3396b07723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89c07c6361d670aeb03bf96c3e09f253

SHA1
e20b2166792409058e456ba0ffca0e89cc5cfbe6

SHA256
fbc2580f3cb14d0e78e565ab111826d29355e03e62f904b7251506445cffda83

SHA512
e44774fcb9d3afd49cee0ad0eb732ded43a1c61f880b6aa49d46efc56a687ab1c878c6958566fa1d9d6a98ecd4aa2b12c4711bef9b98887824dbbef238c79263

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB896.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1BD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC388.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit