0b19687bc00e5ee139a805c8eb993333889272941a14bff08117e6d6f9fb4e7c

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb7c30f54557020e16b06678a788be80.html
Size

1KB
MD5

cb7c30f54557020e16b06678a788be80
SHA1

e271601a1f81ea7e126a71264649e022cc0386c0
SHA256

0b19687bc00e5ee139a805c8eb993333889272941a14bff08117e6d6f9fb4e7c
SHA512

1a4351b235fb9fd6495dc212e6c230d99045384ba92c403da84cca44bad59065c99bac9976d59a16d729a33f93ab4300c5ab5e7b4c036ba420b73e6463124ce6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416669829"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C517A151-E2CC-11EE-9C17-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000ba0bce229d68f320263b2548806b3dbaa87583a19c813947f2deb26bf3fc22ca000000000e80000000020000200000007406615553e9a1e99b414297148b260084675f5d11a206c3afb26fa9d6be902a900000003e12d4df3c163272f3845d523cb794ae7f22df8f6d6991f3cc7cc299154a1c897c5a30b6aae24e4a4fd87ac5622cda56175bd1ab95e345903b0d0a6a3868672ddc40e0e718f5138573bced15f4ba5681d5264423f136fee5bf1a05ac5fa64bed6de34ed1fcf62d6a24b10360b53706ab6305b1e3f17ad53343df74abd47eda465cbfff9a96c5c25c87921cb1ff93b7b1400000001027de63780d7f88a84f3cebbfcc08902b03ebdb92fa766e9d68d0b5b599bdb7966cdf94c3d05abf695ed9cf21ef9df4af6689d818e70ea5ff1986fdbc47caa9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04f9399d976da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000843dc2533ae42384e38d6ec72a8c0f31f6cc49d1f04bb20115aa9e5314155ab4000000000e8000000002000020000000ae6c3060a6f01f129cb326c5799f8a5b0ea72036afd51627ed0209de4b0c37ef2000000024104f0489226ae5e645e64c9f8eda5a0376bd6a82fd63ee5c51477c025007bf40000000f807fedf1f266b67facdf20545d4697812f0fed1dbabc8267accb2cb2b889d5c5cc0cd3cf6e354715efae294159a73392a8aa3c934f4647e95fbb64ecb3dde98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2620	2228	iexplore.exe	28
PID 2228 wrote to memory of 2620	2228	iexplore.exe	28
PID 2228 wrote to memory of 2620	2228	iexplore.exe	28
PID 2228 wrote to memory of 2620	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cb7c30f54557020e16b06678a788be80.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b86fb067dce377051bc6af2573bfe1d

SHA1
9e69035afd107932a22ab08657ad6636506dcf41

SHA256
f8a2ee9753005d924ba548ff81583c797e1d95f29ec7bc01698708d95642fe50

SHA512
44c59ecc804c34bf3fd6e0dc06c17b92df140c3efb1d5a2ccf4e06b78bce27261bdfbea5f98ee6b3831eef12d6e32d86e6426db79a2ef87ab57634e858a8b4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
838b075065b4c3f8daafb999840d27dc

SHA1
5cf1a978ae1e0a821ad823c9f9ca9307e3eee5d3

SHA256
107d259d47ed3902a93ca4f70105dd4ddfdf1585a7b841d3f80100eec50801a5

SHA512
046023475c58aec6f961a835a7c3c245653a0da12fe42a0b40866e49820a8e0afaa380e8c983eeddce6650d6aa0dd23cbecaa388fa42803d49e0a914595960e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f5d33c8d3a4fb26cba73dd6a6c6a89

SHA1
80e5fcfaabc4394745c7a71bdeed36793b2f8e3e

SHA256
8ced545e49ddf0e842391f6118f5a19d9c26d89c7d2dbce216db2de47fc4db9e

SHA512
0a8817dcf9663ef92d0b88f3a125e21edc200cbc22c4fd863302e6f1790cf57525a0aca0fd6a057716bc2f5e5b9c7b4e553ec89fd96999cd3545a4252808f539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b772e909bf3553ecd91f5f64f81fecb8

SHA1
93475c97d5c5e416e3f108a0632431dfdedd58c3

SHA256
f6c6dbb2f26f95dc96650ac8c728b443c3df307fa4c5b9c56c5eb085209e1fc2

SHA512
5cd24d2864da051714e8c9b3ca6d799feffcbe4bf5e1b22ba0758ee65ce6cb0fae900fc2ab63a98083ee78ba6f66aaf8d2aec6ddcbfda3d6e3f4c33bcb58ff62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4863b2fa6a18001db417eeed290bae2

SHA1
71ea92c6cee4a4b9d117bb47002a7f5ec45b0b0c

SHA256
cf2b3a24fbc51b0b05668b10635a59d3ef23f530f855ed61ec8497f625a87a5a

SHA512
6d17228e24f6f6e24f9ce834e25cc3dce49bebc590d7845e525f41e3998c7c920ae9bce12368e7bd7f9a4d2d1f9f372ab1f59c0888535ca2084a207e9484d11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c57e62ef273d24c06e254740886969e

SHA1
05f549dbcbf137e7a356fe2eae9554d2be30d87b

SHA256
48e16be7af11fe9e97a0bd17221ac5723f7b5a40fbcbecff3dcb4296ac620e81

SHA512
44ca5568325b1b7c245ee4cc6f2e3d7cd57d69f229c687961964a9cdff7086a79d381be681ba833438c5b52fa84cde71839c8a3718a9ae5bb2e053cf7f95d304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67813fdde5328fca5fdb0fabe72faf53

SHA1
6b252e42b712c2689c0815ca3a0ec385aeb78e39

SHA256
8ebd7be10eab4d6cfbbb6a4310133d49ebc0175b67b1bc95a93a5bdee6d11b93

SHA512
ff902c23faea4eab22d3480240284e0e3c14d39e12230611959b91a677d8fb99b5960b8ed830ff7b714a0522f8b4405950da98050d62f661bda674174fd10857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13f7884a083cfcc30d7706471968c26a

SHA1
ffbe6fc850a47b6be617b2414cbc1db0aebb204f

SHA256
078179a365393c3d1b7d56c8a59e82de61123cf805636a90df268573b3d67aee

SHA512
dd05a8d7e2c5388757ed5d7583e2c6356b648e623491f0896de0f068f3857feb5216b11fe9714c0864169aea19514277e295d320b6a9438cfe7a8f47507ce5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6baa6cdcfa44a21e3057d693cf14418

SHA1
31d659b8e3336f11dc74187ad72ccdc4480c4968

SHA256
534cc7f014fa572d386b0841565eee051a1e91b898e46d48fe4eb53ea56dfab7

SHA512
eee2542a19ce58c77202da1a68066470ae20a7f56c3a8d6b1457a1a0505da77642ccd8ef9267df0b6878053d0cdce8d1ea529717cd51597e158870946c9a8580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d82fe734fb6375092682a46b58ca9397

SHA1
ff91f1ed37af1b6a920767ba6b9b843bff842d78

SHA256
46c18ae1f4c1ccfeccdcbecbbd36d0c16f06a6465b751278935dee164c2b1f84

SHA512
0a2e1ae2bb31f1bdf988ad080452b4454e227e2ed154e73527e61606d96e242a03b40c6fce0a86dc2dba0f56621716d0e5e4bf6ff1b996496279630b392df76f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe583d531c790cc1c5af224c70176e8

SHA1
ca4d374bb6690d094751f8f0afd838326466864a

SHA256
0d182f16392fdb3ef28f73c513e89b5db32a26c6a6042ccb8d24960805e25ae1

SHA512
f6b4acd4a0e0089aedc4370ed2b757c3984d6b1f715b4c6bae2f21e54f7ee297230df5dac7f132ee908ea5e03293eff2db52b31670fc9db4c46f9789815f3ff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
953ebb4f47527d604a14a3b75986c39f

SHA1
d131ceb53f2f2c43cb25b112d4ac7f768342a200

SHA256
95bd2c316eaf563999edc2250d3223a88c0fccbba1816b7081553591741d7c4b

SHA512
b07e75dc1b98faa3fedbc6c188363d39d841e8c2539295baddb8c9c50a12e51147165dc062ce7f4ee167e97cfebe96e5426bb300b169a6f1892e9192dc3a1b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdb1af1a116c97adf92116cb48a0b4d3

SHA1
ff2ad23b06a4f0d40886222ea28276041c381c38

SHA256
a9748d7bb1efd16b2a1152a19e79a131e50b81008438f4d066fe0d09b90ebaee

SHA512
07a80622ef3f2dbca5a39e490a1fb4a52d831fb797de690acf171885c796bee0cb5bac505aa54a8cd68ab581e7f7f84ce82a9ce0ed1623da80d2d4d17bde51c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28d8fafd87f67a7092c5e676422d71df

SHA1
e6e5e1b17398971e3146af9aa495de61521b8e54

SHA256
fe7ebe023e72474ef4a05e150b61eb8871164ef190f9d3fa81fbcc5264be1bdd

SHA512
9f4e9de97eab5c21b81755c152eeb81a70f6cc5433f9bce5cbba13dab44682d2bdc697921a75373dcbfb497bd9fa50d33cb2018e69a511f51a375ada7d95e843

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C70.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E2C.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit