e67e9d723e37397046cab6a0167effc176c2de825fd562f87f26f7ca7624fe98

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc0951d74d35c5f7afaea0630f1c41a4.html
Size

41KB
MD5

cc0951d74d35c5f7afaea0630f1c41a4
SHA1

07209b8f3c901d6027a54f6ddee3b74931e8c930
SHA256

e67e9d723e37397046cab6a0167effc176c2de825fd562f87f26f7ca7624fe98
SHA512

a0d042f98b800e964cd58989753f1045ca2ece3188505827cb51de83b519120d0807a10d885f14308e76518112f77d57460cf03a4d7c2aac20a6ce2082fe2e0c
SSDEEP

768:S4IWYCHRPh1RjuYlSQbQc1NPeFPmx1mhwpc1fGqqB+mLDVPsSs2QlsLoHGKezud:S4I3gFbSQbz1NmFPmehw+1fGqi+GZsSi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D1178F1-E2F4-11EE-970D-EE42DE2196AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416686729"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409620320177da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c699075b7e7f770e318c90c794e333a35fe9be4c986fde4fb25f5ee5873dbda2000000000e80000000020000200000008e13f1dcc1825a2b4541df82ddee3d5a6d3f35314182ea5753f194ce9c7af98c9000000086b0c183b5b1ad87332d97d0334a48cb8a308f7c81de6273765f79c645018d123cf37843f742908a26a9e42a06cd9943609825416dc8ae18282bdb157e675771e30061702224d74e0bb1bdde22af6f22d1a8493756f0a100e756c9218ee6a035a8fad3a9026313102ccaba5abf6e7ffd949bf901e9b8a87aaa2849b8c5cad04c38426178ce34eeed7432923a87c881914000000026dd8759799e301b83e98c1d148be2c55de6120160c5e11f13e159b94978aa90c59c68b3b293b28b92895e5f75e4996ffe9e366e27e4223970c57c56ed7c7eb1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f629134a51197a34459d05076ac4d3bbbc584291b5fb0a01183fa6090ba3a727000000000e8000000002000020000000049a292a8946f5c1ebdb242da8e430d994d67d67f5eb919926f1c200e2bff0a920000000ce7ec43dceef507702e5df902dd0b08e21ea1b1f6c3a177f921ae25726d3e9fa400000007741c79aabe977ac15e6662748da60b0a3b91c81bd7cc962bd336e64f1462bef50105e50c0b7dd47d5671867676b61d476e15e8cb2482b30bf94b08d1f7c4b46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2368	3068	iexplore.exe	28
PID 3068 wrote to memory of 2368	3068	iexplore.exe	28
PID 3068 wrote to memory of 2368	3068	iexplore.exe	28
PID 3068 wrote to memory of 2368	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cc0951d74d35c5f7afaea0630f1c41a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f7a22c07491aded46c9a0b1ad1ce8270

SHA1
fb856e8107f47f084646d9f0f2e23a76be471300

SHA256
6ba88e683bf691d425e847f29b6b91150a09a7c15b90070d0493ac6557312762

SHA512
81bedf5bffce4620721606f86f36a68448f7d197c6aa6e1acd78d1440c5324b796e0fcd8292732dc11ec64838b83dc2bb7fa8a40ab88af912b3ef2330930c242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e366530bb03b318b96bb2a2d0f4444c0

SHA1
70d623183c50a30e22f0fd8b4199f3212bd8c322

SHA256
ccf6d304fc04af60fc2435f808f03aeaa4c26e6bf829ff8c1789f4a667ebb76c

SHA512
d6738fab84adf1f847b0d62e3fc5262539b08531bd8a8ca1cfc508442b9daf72de9a46b77c8c9a1765e9b0c37774c9c6648a7e25fbaa7581952ae8b7f16c6233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0cf2b3c024a6d3e06182397ca18aefbb

SHA1
720ceac06f809d333f87cc4559cf921d887fb3d4

SHA256
08ddd356990741fc72d327023d94a7714d3c0cdbe2a6e5f9f6a087835ed87184

SHA512
7d839639357ef65da92832111e637bc5d1ac143bfe9508ea9890c9c96e000902b5cf3504a977a2fff21fc210c5d09b6efe29c9760c7953dfe5322797d1a622ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
840eadec0aa3cff20a47ea1a7c28025b

SHA1
34a72dfacf00618927f299b11087dc5d651a05e5

SHA256
374bb47d45181f4b6d3cd79b32c70a87899d57ba9d274dfa398ed290585f3d7d

SHA512
6630d91e34f056ac2d4690722caa6054725abdb44e96e6dbacb950bbcf82a557cb74d7bb2e8c897985beea6d1fadabf93d09be096efb3bbddd400b0d4f1b1569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fab00e4fa715c25509f19cb3b99346d7

SHA1
d5e9572c22c1740d284889d19363134721c896f1

SHA256
8664a51546a842458ec1daaee639afb87a8f524f78913a25dc94737f98a6098f

SHA512
4ac04b8a6c340a157f60a411fdd062c6831bedc65810e42faf807879567778ac91b600da84601bde143b7a37f1aad583dd54087c3f12e31cf92b18e3e7f5f5ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c9abc523676dc976a7535b32828a7177

SHA1
7ceed6450478ba9ce84e2f45210c888cfe6b20fd

SHA256
b3bb3fe132abb66e83efaeb17b2ba2b6f85b06a4ed3a2f072541c1f36c902d87

SHA512
7e327d5ab7eb776bcb682b6df32828a419dc141e1c8a31e92ace8a8514ea60351bc11e991f84857d37564868e578b2077050bef1aaedb9d1466e2b81e4feb411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
705dcada618ca382ac54f707fbae78e2

SHA1
c3e9637cbfd796ff20678888ffc43a32200478a7

SHA256
69bc61b33d490b33657678712c6b3050de3cd77d207544540e6d7719ad51a09c

SHA512
5d94fdf8b4e8faf95a6dc7d137f4fa15aafdd9feea95c69e70c14dbd981d5a74b3d4edf01981f596bf1079053e8f6518ced838f91fd450496008c2f9e71425db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6e19aeffbfc9bc9201ee4cdaed5a0d09

SHA1
4f2a58fd112628af5f0f804ad6cc4a0aa710ee10

SHA256
02160e4e241f7d59e693fcb0c6d25e7f758e1eb155ccb916194c5ba3464211be

SHA512
0b0183a8915a84b787be2c641c8256c451f14fe8b555becde61889dc360021611b99c7ccf1a6a43d6333d7ba0183c998918a110bfe5ff61b27248b0224717881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9bc116fd8ce616c40bef29fd0745f9a6

SHA1
e2c3bea1ef5627933157aca874ce4510074fb63e

SHA256
5f8dcaa91b1ab38893c29fbd90821dfa77d5f2d678eb15b18ff4cb1fb152f39a

SHA512
de26419595a16b6b25602a643a1e80106f5ac231b0b72aed7ac46b2ddffad36f2e39eb5bda8e3b72e288cfa452ae995ec382a8a6851f7d709abca3efd7a5ab87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
06b7e3982e93e0a60a13d49be76d419c

SHA1
a279c13668ab0861ef3604e4a79f24f7a326262b

SHA256
6fecaa3f0a02bff282f3ac4aeb51304d9863c1e805806b5b3f0c2a7d05c01111

SHA512
ae0177d211dd3a5571e14c3cff7d4919f0295f877fc89fad5e36809e10891f57068c59e79775fd238a30bd72cd99e2171f9810180e55c012cbf94916815ce339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9386c45c88598751f7fabafacbf205ac

SHA1
9c173a9e762e83da84afe5fb8693fe0170ea89e0

SHA256
8f03b69775bca64f0402112bebe026f5d4b818e2dfa35cb5cb018f2cc1ffa84a

SHA512
fb0799934e269809baf05d0f410ff64e64f8eb8d59f57b37e4ebb5d605b0a16fd18d6d4a96a30a149c5223de024f16cac5c04228b4b86868c81f4bba64c3a813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7b0b580d1b1c4ddce3aa6b6b050ad366

SHA1
be2c7f459e2e4b476805b62b0d35d1e4bca92a91

SHA256
07085f92d38a2cfde2bc63eb132e63655fcd9af8345b6b4f4d66019d7d65f39e

SHA512
bf0bce390af6fb3d6d60c17ba01fae656b0beda34546dab26fed11b4018640fa34c7286e483df625cb8194e4b0c0da4170d936edffe70726ffb342a12ae78e5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8b1a5da43b3a977b94ede450b3849f34

SHA1
63e636459bef276db34b00706affc21db5343b3c

SHA256
0245df4ec4a27115d31c7637483e942f6d7e3011fc171f5f05f3c440d9b85a22

SHA512
9c82f562c19e38b64bf48faf32dc5a0244b54c072f1dfe684875a24c11a9bb239003faf5d49285c8d0a50edc0764ffb37c4328dd1249caa4df45606712349912

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab780.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar882.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit