d97999db538ffaf48abc9f1cd772b0846d33c732a3ded528fe046d8b812e489e

Analysis

max time kernel
121s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb99c777ccfe390ff464606668aec808.html
Size

25KB
MD5

cb99c777ccfe390ff464606668aec808
SHA1

70d5a9a27850a16b8fb17e08b90dcdf39ff65d56
SHA256

d97999db538ffaf48abc9f1cd772b0846d33c732a3ded528fe046d8b812e489e
SHA512

3347e88b82c20ccd7a26d8853fc2041b66ac75a9f5a1acd303ab3507736c13399fbd1347e170f0fe7e8f70f575ce91acfc36ce04c79edc72af9a5ec2586f8079
SSDEEP

384:UvOj0rXwTu9gaBU7SP3izS+AxbvL2fl6LfW8AMcEBN4De1FWUOyLBFz1:DgrgaBUbHgveUd9MeDhB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BEEA0F1-E2D5-11EE-BDEB-E299A69EE862} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06d1611e276da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416673468"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000008bf8b2a47cd8006a9a68c743a16c3b8a8f805c1f0ee32dd02a6fab09cbbc97ea000000000e80000000020000200000000d43b6aba3ab56e051c00a7e4eba7468900080cac7db8090526c55bd631b6ee52000000025f48b56bf222d4b2a3ac243744d967e5c6ae90a61567ea9086279ff8d7fc0094000000098757bdaf1babb78a4bf9ad9df7e34bc171b547bcc8524647dc6763aee2ec4e7a0668f5c427f9f7f7f2b02591ae5b4fac27db09f5b60bbbcd5ac2448679259d3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000afede42b2049654f10d287205a9f52e5cc2bf01e1540864567049dd3eb7d25b9000000000e8000000002000020000000e2f93b41326d9862ceeb58426ee6589e4bb820bf1051787c04c1b7afc9a019d790000000915b29c9356004c715c5d762c4855493cdf1124c5e3ce8a6e89da5f87d1420f17d02f0c7590557375cd91781d266b4e88dcf7135927629379faf51e2ebf3b55710345dbc20f8b84e5404e9825819b520f61c36d8933db34a234cab55d666903729c84f8b1dec03452bb2fa9d3e1fb1b5fff0c8f7151545a5ff5a5a2cce22d505511518d1f7dc57e5a04b7c1464afb82640000000610cf62fd06d6960ea646ba5531965f7fd04207ba9fdd4050494c953e4de503e38cee3cd5c33963f5e9209bae83ff3ed7f672b48c93e385c171ba70e080775f2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2544	2632	iexplore.exe	28
PID 2632 wrote to memory of 2544	2632	iexplore.exe	28
PID 2632 wrote to memory of 2544	2632	iexplore.exe	28
PID 2632 wrote to memory of 2544	2632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cb99c777ccfe390ff464606668aec808.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1c6ce2af2ede21fa46fdc2b63d7cb48

SHA1
8beeef41f76a1b9e94aa2f2c9fabbdcdf00dfbf1

SHA256
e3e9a82250eb7390de96007c2b87e50b2845a18525d13f134e3d6346bc49946b

SHA512
2902d02d523ec02d5c51632538134971f1d8af4e937e72b889a1d5cd17246737722c48e16d918732a66b0f20f52353ad15d8622070ccb463e1574caafbd6acbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a798da24b36138f6cf132cd1e5db89b

SHA1
efd878ad8f068928c01e3e191278aa97fcd6582b

SHA256
daec4ffa6ae7856745393ffbe3d9ef9164d26639b1c2db2bb0155fc4da0b6e6e

SHA512
a7d6711a5ec04dcaee568ccca4ce8212a61a2976d7336190e65a2e50409cb96985856c89a2c4ccc1832ebd3ebacc964f434ba2538d5f001479518bc2458f8705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32755c16f66e762e74ca0a1e05b9127f

SHA1
b353ce1e2be5502fef6ad6fda24a1d05214bc6c1

SHA256
68c31f6889f2541e47bd110618f75a11d4b38cac1dbec00900929d89d67e070a

SHA512
4cafe13dedc43fe8a9d1d29c619f017681f3474114c1ab0d24ec921c37e4e46b217a6deca10d312663bf3edcc10ec2e863e145abba25565dba8747daef27d17b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8a0e3c93196591a8a5704d0f9623c67

SHA1
5cab5a9afddf36d7b3ec4c9939cdba215ec5fcd1

SHA256
67b5a808c93ce7d952dc361bb400a3818b57def85d48b80f3876ed4f7045eae7

SHA512
f0078c9df13ab689bd43e97ce0827fb794f88f64f0b5f30080b8574ef1f80cb4651bf06878b46e4d3e8ce09c776446005a8c4450b75355b0ccdc815d2a08c6e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
327254f12fe99dddc12e16929c68817b

SHA1
decabc4b255f0929d0ccda5f2283b04ec9c65a24

SHA256
e5fc5ba648c6f45afabd0e5a4b8d1d1512dd246d3783e06bf0e6339b640da1a9

SHA512
6f22eeaaae2fad6f961f93ddecfdd22803bad4fc475a2bd8315d852c1c3140870c36a5011243162216918dffc507e8d689e2c98e453f07d8981c16d0693cdee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f2da427d44670414ef6a5930df91b50

SHA1
1f225484592b658afecb562f1c1a7f36893115c8

SHA256
185c445882bd99f0a6dd3046b21fb6d11531d1c19fd13239d97796be123e48a4

SHA512
4fd56c2905283ca60c8780a8910cc08b29c98aa088034b116914c1484e64c33c3cf59259cf96cbeb3c8394e654d15e098627a4e609575b456c9319709d2eda89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16e698e9fa68c07c2737ddf574b41930

SHA1
48f5340e0c787144ea5b771b4da4a00855d03c10

SHA256
076cf1d38e1f72e7d1de86a0e88df3286dd13dce063fcafd3cb6e8526c13d35a

SHA512
1d86337ce041b9773f680a7f5b94d9915ef6039f928a068e95d4b64e5e2f757402cd2c873d5abfced8298110748da90178e6e5acd2870520f4a363c30fdb635c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfe35466173f0014b8cb0e01052ae0cd

SHA1
aae0b19f31320a60c56f92dfb127065f46a3b647

SHA256
d246c1d9a08a4f5bb302559db06b76b8874965cfed76af96f4534f5d82286bc8

SHA512
fc24da27b93e9709a15006a98ea628986a8f159a8e749d95b7e87196addac5cd11e55396b13d4c51530790b8fcc1cf5ed44a9f25d85c94113345770bc7d65c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
230b27ed965ed06c614e2f2a2bfb4d51

SHA1
1aea271188b2e1eec18a11910d14659644d91b7b

SHA256
60a3f7f84bc74c64c235b16be53ffbafbdd19d9c62aa00c3581dac32c7394930

SHA512
a59639bbb7534e3463d2ae696d0ac4f5403582e815096ba600f515a6902a4731fde01d8be8b90712026eef2a30c5f86966a327c374d7d355f4e98b8672679557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78afa480c0d2a03021ed4a0324c883b2

SHA1
fca8e36b0a5629343078a588397247bca51d0c70

SHA256
5ceb43ce9c57e92747c6843df1bdfe5c61d2aa4ad3096f064892ebaf9b6f4cfc

SHA512
bcc9b0cb7abe831b8861b5b2a71cd4cc1bb5b2d34c01c9b60806dad29f401db8875b7ae6a6c0b28e54d7f709359b102aee586272ffe174d6e1b8129848dd2c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d43fa843427af7462f4aa39e24137434

SHA1
2324ae0ed806b19eda202bff056cad038a63e5d4

SHA256
d20d49f58bd2b9808cac93abf459a3eb2b0b6bbedc10dc2af47d2c084a834730

SHA512
b1d6fff15d6aaa0204abeb9f811aff22c0641554a4a48b62479caed23426bf165b392bcac5c29c5d57c985e4d9e07250cf45af943133e286a63889b0514c8afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
664ec437678e7d36e79c9ea83eb34c3c

SHA1
878bb1ea7866e7a07c63646e6bd46b2e1a9c4df7

SHA256
bc57ff2865778f804db39165f7c040966c5a3bd8003aa0da10d6ae2c2a1ea594

SHA512
a314ff1bfceabb2b58ea0c3c05638e5e5973e8c980cc0efbecbbfd4ba5e8bbe19c5920ab3048085cc8fafb548f0b74f60716246f64e1edb4592450b0860adab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C7A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar919F.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit