b6872823ff60a777cc361e3b692ae05948700a224c1545994ee9e84f532d91fa

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb836c99e1cb86ef17bf7a6b1cd1a206.html
Size

44KB
MD5

cb836c99e1cb86ef17bf7a6b1cd1a206
SHA1

903ea8a61e754a169e9c7012a52827a5184d6136
SHA256

b6872823ff60a777cc361e3b692ae05948700a224c1545994ee9e84f532d91fa
SHA512

e46cbec4f191a41756cd8215fa6553d88c98b5ea8c9022fea56d988e06da389fafc5420e6584757323bfec55bd150ee4e780309760e9601ed78a2888c405ac58
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2oLEelgyvMAs/dkAk:mZJtFEelgyzl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9015cbc4db76da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b33a7678341a8cf37e5a0dbfd49200e6599b6fa164e36e479dcb9db8e3ae9a14000000000e80000000020000200000005d71f20ce7816acf91811d719c971e89b79747da57fc1a9fe1c8ac64084618ba200000006e5ad797f8d66ce3917925c6af948035e1a7488255fdc45b8c531e93196ae94240000000947942bea4f696fe1380b7d55c38e03a32dc94ca60939c2cb67ec12af8030747acddc9cde3971e77bb0dacc42623e0a8a2c6badd048b56c113952da49c0c83f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b0cb7446a0ee544797ed5d17b65338961e2f1a883f406b79f84959dd785a0e17000000000e80000000020000200000000d4dd88355a01618edf5d2c6bc1fb2d6001046170e9b7cb0036cb66cdde991f59000000085348ac7fbae594581586a98e7e0ecc7dcedda3d21cbfb8ae79e996477a66ff70f0e17eea1406084d34861ea4943c1770aac082157adbfd5812de2a1f8a6ad47fe7d667f60b6620225f68a9cd805f97a0807749f1180dc1df86bcc9f4985534e89e369fa7766cce0b3c76c53b2abb3987075fecb013e3b739d8000dd0711ba122a5f5ec6f0e624d90a668e4e4f50e1e5400000009e57dc447d6c9e788c56c3933b358d5551eff15d3fb0f55771c3f02bf28a479f7234d8f51c75ec1f34ccca198def82c0e08e63a1ffd0340b1b40dcf09363adb2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416670675"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCBFAA51-E2CE-11EE-85B9-4A8427BA3DB8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2988	2360	iexplore.exe	28
PID 2360 wrote to memory of 2988	2360	iexplore.exe	28
PID 2360 wrote to memory of 2988	2360	iexplore.exe	28
PID 2360 wrote to memory of 2988	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cb836c99e1cb86ef17bf7a6b1cd1a206.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
462c82a0998a59defadeb6796a424dd5

SHA1
5e25b9250c1c18b5a29b45e31d987d4f5eb69beb

SHA256
a568b388ce61a9b0a6ba016933a525d447b50f09c1d4c7dbc8a4c9f77a6780c8

SHA512
0f4b8b586badb1bd4c046c0595e45be3a94b10be41cb839e8b9532f4242c473de38f196b53e4f032329912ad7a5eac51370d223c898d2ed7442794e7a616f90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed0195c76bc15b4d7b2ca946a690c6f2

SHA1
008fb21e90c1498c7530739a46cb774c36c66ef4

SHA256
9d5ee1cd8f2eaf4644a84c184255a1b103e065a2e44c2ae36eebff2083c638f1

SHA512
6e96934ce4a65979bbee473a000c1162da00ddd9e8eb967f0d7487f8b901c838364bed0fe2771f80a4c383e32a08ac79fb021ac4ee37cb4405a662650d432680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe3f517feb19e9c4c6a382eb6abaa10

SHA1
f5ebd030864aa48c71614341e32aae7ffe53eaf7

SHA256
8165de5733f234dfab5090aad42ef56d905d572326715e1c85dce67d21461b64

SHA512
aa3bf67543caa2dbe5cdedb4a6a200a54bb3593c07b3d0399273a6fc3ce3160d6c3f2c1f9659828d19ba41436b084800fe3265d7e3f0ece59f05e474585968cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
651b707722d5dc35656a7e5c3f22e6d0

SHA1
221f6a8dc0e94e658f387fe54a07faf7c27257f4

SHA256
fda8024866ce6e32535c13e16cc13724f64225022a5a3375f0c7b1a8c01cd34d

SHA512
a0dc4d584b1a0913a77dd6ea21fe6ae691badbfa4f6dcdcf0e7a4fbb877509738c1426539ad3d29b4179ccc1cbb7ab4edd340f9bc1e79cede37839b315e1cb18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3351f27f84336b35131183b29ae5f54e

SHA1
810272fe885896c464ea240c4d4c58cc7d3bf15a

SHA256
415a25dfbcbbe88be7e0b762a328a020644ea8f1cf32dd63b941f13cc44b5f32

SHA512
c26c160393a796dfd834a42936284b28728c0fc3f1fb84f36e9f85ec11a3d93e1228b167d182e3c74b258a1905008a13c3c89e3e45504628f6d0f4a6b8b1334c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f96a373619e924bf2b17daafb8a430f

SHA1
e56f2c2d220fb7c8878c6c0c8b99c4e3d266ef5a

SHA256
8b65f587a0ad76b97c3942bbbaf6bb4c75592ef4353a9d5e3f15705554207c01

SHA512
235ccffdc666b5d6e78bea7fdf4cb84cb4dcd63b23178d531a627985d35c69e856ee4e885d97c34ac6933e4dfc562a561b0b7155419e5b5b1de301571a5443ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
452b5be3cf22e91eab5ad846f9a6f1e8

SHA1
0e8bf50b98c864067d83a519d6e1d74990aaf9ec

SHA256
b00e3fb053fe1d224a8727c93dffbb84b4d402b522015c239eb45ad4ed09079b

SHA512
3a87c437dae336f81e38a4d612812522270f2de55122358038b3950c3c85836bf1227c3b6b9b49c39dddad0d042288e608a52d0973239f8ce9eeb01ccaf64237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c01f92331b1c2b7da838060d26b6ec74

SHA1
ffbbf83084b676a23e17ee133fcbb62258da2a92

SHA256
30f64c71990896bffe307d457f7aba4ad9904c5ad94da507a39ca3ff0f17bde0

SHA512
a55f048b21b2b8294c4677a2124781612c3f222062fa2d56cc89f0893791a106f41ae9e3c82ff17c7a460aa52a023b063b1a9bbe55055069bf649c79aa860795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40e20317537f8a83b6447d8cdeca9b7a

SHA1
68bde1b92be26c48092360a948eb131980970f4f

SHA256
38e9cf8c973f5f68267ef1a14c7d0343cf3008c2c12973505a56eecd8694b638

SHA512
13bac29bed6872e0674c831df5d78ea91b7b88115d98e864892522d3f12e1ba0927b40acea83942b189fdddc2585f0518c68378526d5661b8188c1c701e9a4df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f05759fd679c18397fa1d6c8d0637d

SHA1
cd56d1ec1069f8885edaba579cccea51e112e2e1

SHA256
e893dc8452f176a1dbd3296e93de73b0b36ab7bc4108c7fb90af6530bc6458fd

SHA512
68a9c63ca706fc4b0114ef883410af6bd15d5ec9e16474bfff95152092f119acf034a00e919f376804183717818b07eaba5dfbf4058070b2fdb0d7eceac4bb31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
701b076b608345335739fd8b477a2ed7

SHA1
3f3a8eb0f2d8b72f11509caf15f776ad71f7dab2

SHA256
40bf06606bcd82d4847f3af639943b6d1a12cb4c7d10db45c3ca3ea0d5dcdbd9

SHA512
42dd3bbc1f5e6a74c8f90c9fad7e326cf6419e9f370eb78e56c8e53f8b3fb0952476e4c8b033e049b4fcac07e5d1edfffc8fb5ae2dd38a888fd80f15986ba531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f6665cd28f48910c40616df5b3f6107

SHA1
54209ba33191901c283f1825ba73b136c9b17784

SHA256
0239c6145f8701b74a48633c7df27c3ba2310cb8c20a5d8042e3074cffcb14fb

SHA512
96139920f90c9ee43da94d57680b9ba4afa39cbecd5d1fac2837ee8a887dfc760fb06df4c1106a899abb79307bdec10bda3f5110311f13649615cc6af4469f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabED2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14F1.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit