b643b9dcf9090d3872c607ba204a5329195fe9ff55b69566a52658fc777f4e64

Analysis

max time kernel
140s
max time network
134s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc1a6ac48f88f67f3ba6454d3cd82eed.html
Size

13KB
MD5

cc1a6ac48f88f67f3ba6454d3cd82eed
SHA1

4306ae9e810e8d6ba3be7c8f970eb83dbb05b4e8
SHA256

b643b9dcf9090d3872c607ba204a5329195fe9ff55b69566a52658fc777f4e64
SHA512

41c0ea17bf82701fa5e10beb04e6658e32e9da4f618e91776210bbbecab6e94b3dbefd1045fe5baa609f59c05cdd1bc839f5384de43763999646912d41450b4d
SSDEEP

384:4WNC/G2OWgfs1Oq16fpCmSP5iQlWZOcfbiVnjAlC:442OWgNhCmo5nlWZOLVnjAlC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4A82C31-E2F8-11EE-A499-62A279F6AF31} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003179a6e21ab28a0cbe2f8ad86b8cfb33f45aa141b78e26a0304788e3234dd63c000000000e8000000002000020000000e7d653e10a5611ce1d3460355d47b60ee17bc67e479726aed93b20a071ab9fc6900000006f91df589cd4242903d790acb03a53b63d35773f74c58b7034091910d773518777b41185b26898dc52bfb3ead4709529abf88dc78de58a676120c661bb06f305f77fa904b53abfecdf7b8974c079cd6988f1b9083efa0aee7df8defbd2fee4360e890ac35fba5b26ffe76b1ef3d9de4a4858b4dd6cf92a9453b31cdbf5dae01e05003dc7ebc09873b63cd03603ff20de4000000035fac1ed2bb84b09fa13a032027d140e99dae9ead08466188ad3e6cf1aa40ddaf55123c97e5d99e689688ef059e16a557847a36f823e78e35420705758168b60	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f137262befe0181a13f5844df98b66c9cb603f4ec21280bab35cba07870cdd44000000000e800000000200002000000085082dc441119c363462f9d6b59c5016b63a55cc58cc83e3f5e726651356b54220000000e6439d6f717b649359d1ba1042331013bf9fd534f02ef6a4d457e64c75ae492d400000005bec9869032ac145aae25f6badcb0a15231316a729e6a7ff14e5cf9ae31a5391ed3508dcbc385220ce3c7e41955ad59a1da601011955b8053ccbcb3a3983724e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b02aa90577da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416688758"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2516	2000	iexplore.exe	28
PID 2000 wrote to memory of 2516	2000	iexplore.exe	28
PID 2000 wrote to memory of 2516	2000	iexplore.exe	28
PID 2000 wrote to memory of 2516	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cc1a6ac48f88f67f3ba6454d3cd82eed.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29229e2a2b36afe656ff6cef404c6498

SHA1
0889cd25d65a16fb9e384fb8f5b227f1ca77fa26

SHA256
16758c2a75401db4d2347a0d681ff22f8a8530b266c1513ba360abac4ddc4f4a

SHA512
81e68efe5d349507e16e1097c91dfe39ead9df976de16a7d690a4777b9f0d5f7de8d7f7ed0d57e17c2a6cfbf16587f18d5e7a6e4b3afcbdbc2fe27f1eb7c05e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4500a0ceeea6bf2b2f4ceb5dc90aed9d

SHA1
7e57e72a3aa5d81fee666037af2911128030c543

SHA256
4c539c8c8234f8dd8c7a687090eb58bf12356916b64e2f9cc3e6e560f8faf4e9

SHA512
1a564f5c8ebc941d3074975dceb7be79eb1de38e46bb7ae4328d3ddd95272c04719904899f974f72502601add146769d52f81108af7c40449b8efa5ed7bf9896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
480c160d0a58d106ae35d60186341e37

SHA1
72b9819c9ff5fc6793ee489c8df50506d2bfd3b5

SHA256
c265e5cfec7eab06423b3dc09f4177e0452fd2b7d5b7401bf096f9361e76b1fb

SHA512
d76b051132f75f4d2914ac20981a762f78482c4723d8d31a4d7ce3cd597f605e0ee16bd3f2a0299083dac0729ce7fc0ff0ee23f0ecd9ed06eb74fdf272e65b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04c79f3d29f3162f72d1f664b90cbbc3

SHA1
682ae2545901234cf39813135f60130b1e41a937

SHA256
295dda2b8cf196ec99f877c3cd736b05ec7f202b90cdbc163c057518bae2fa1b

SHA512
b5e280fe7162cbd4a288996c33b745e33b0e7816fd95ff008ae7d2be81f59346955f42c347d3a65d320e3d3d5c41f3f7570fc60f687f9fcde40121155588215d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8e0a9221ff8d8e8a5ec1668081bc352

SHA1
28a1f66d51a993e844a217587d3efe974e67a6a9

SHA256
77a59a5fb63fc6081ea1ebc38366ac561bc1aa0c91bc1c6eacac031e6ac5977a

SHA512
6393aa9be14ba00ab4ebb9fdcef331e7b5d6630966e2c57385b546f8b38a087539a62d756ff0496d9092686c518dd3e9b1387465db25c598eae1e2ebd2aaa877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1818f0dd90e478954b4ea5c4ca244072

SHA1
be3e411fe92dc49f53a59f46aaf39445c0c5331e

SHA256
6b72fd8d1b5a986b610d6e7cc33b5e0bd3c3fd477e3b0fd5a2031a7857f6a0f9

SHA512
ef91275f959a1f2831e07a7c1c02d8e5776d998d0417284e8e0754c52ba6276a71ed944e2198c37095c9aea28b18daa1270a90cde2dfced915ace37447861ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05775ddbffb6a5b8ce61c3b3c31007e4

SHA1
8b9c3ceea9c103ea08159b54d0f99afdd7d1a0aa

SHA256
6c712fb7cdaf7a663f10ae64efc9200ad228a99aff4952e3725c4e775136adaf

SHA512
e1638110d6b62670fbca57f14f5c99265178707db36bedd2c4586d60d9eb619513c296be514b7c26a020bc3abdc65482cdc4cb64c07d48b8939099df97531c77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf4ef2044364e53694a9445bbf8aa2c8

SHA1
ced5b06d30f457c55af1df1312cb15a19e849f27

SHA256
2f51d60b513b09566b9bc83c104315ada02123db1b77f9d3cdfcda8be3d08599

SHA512
82f41da6a47d4446833f3d57b37552f52675268dbd56750f0d03864fd0fd9670cc907bedc84a71bee7df62626806469e436c5e7a8274f51d44d0b3e90e3a6940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb09b5a195e0bae5ac2ad9d8c896f09a

SHA1
efe5bc61c6f35195dc3034205e9f988a15a6681c

SHA256
0420b08f5381a85f4000cea76e7f8a29b6e27bed16e29bcdf19959d04fd66ab2

SHA512
8d9f404caec15b1f44e5833783e84879b8631ff03bd54d66979dfa64e8ac2feb57d2d1242c4090c43f104dc1265c63699092145b2b0d94e179c703f5ad76317f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f54ba99de9f1c0e6f52f041b7c5144f7

SHA1
7b95165898035f646b34256774d47894a3fb3617

SHA256
60b781cf8f95b8e842466eaea6edd49cea5160454773cf22e6ec6501e5ee5dda

SHA512
9ab30356f9350ada4fb1861d7e72fd364ed5ef40f8125be91d18e64b3c4e2ca089da45b0998ead9180b376008a5c3f80ea5856a421981ab59ff32791d7e3dd17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f31a73e1c5f9de68c952910bcc223ef

SHA1
24938843b29e7ec2efbdb6c996c0de664e8a1b52

SHA256
698b722e94d7026291412fd8b51c759c84769cfab7f60f4efb936dc181ae70a0

SHA512
e744bc2dfcf63281eac9c54d244a5d9f344431ddabd470ae859574d2b7f136902f7b7639aebe5165dbeb794fc830150432ae45e88cffb89764478eefa80a4fbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e457aa3962e93f57a0852c8c13e2117

SHA1
6d57b295ef72d22172b1b984ef8f1bd2420e739a

SHA256
c3551ac5bd6c025256735b93f7525882e84f6a680b17932734dfb90175cac7f6

SHA512
9ad3e0f345b9cecab3a65c262defb874be0f7ce1757aa98b0d7e09fa9b64a297b9b062237aabea7edf44495a7ecef3ba10cff8758e73ef50e5592826cd444c92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f5d03bc7e97d28f01b1479b160ad9ea

SHA1
3fe149b15f0b0de0626472b58c9dbdb2e3c9a5a3

SHA256
bd0f42668e8565467f387fdfbde488c0e58f018ac4e0468e22f3e9d0460fcc7a

SHA512
2d3428661f6bd8b5b446b8293a7e9c806dbcb4bec2c7f61aa1ff8a87360deb393a15542a52a231c60ed45a43e0a63078b32985f4ffc7b5c1afee1879081fe28f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60de35ea7e2f86fdbe9113cdd5f7439f

SHA1
de4eb19c45abfebad99e8dabd892216e897429ad

SHA256
c64f31a072312d78f4b925787252a413957429d6cbca4c9e1ee2160bfa575dfd

SHA512
0454965d3f878da445e560db24d77dca77ad771b585854f6bb52808a74e08bd0e1f499217074c980b29966666f1ac07b7555c4806046773ea52aad67ed957ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5231ad09a52740695968aa7724dee171

SHA1
d4e0d5c13aaaf2277e9187a335a7a169cbc1d265

SHA256
57358675bbfaf826d0d47e692d5b1a8185ccaa61a87d027b77fd4e2a53140da9

SHA512
51d5e64ff498a45937ff8ac2bb63270f33ac99d083fdf113d64ef5c2b3d6fd9a5df2a5e4fa3c0733bd99ee1759fcaa8829a7f6b413ddfad511fc0385cd4063a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3592e2983fa7f93c97d7240242b86fe

SHA1
d5884ea3408ea0111a45e50de532a488260a5507

SHA256
a1a2b1e53a9a5500e5e56118cc7bff7d8b6048406b50d8c86b4a0aad25d33215

SHA512
f9074a27074ba4466da54d3c89521d41d4cef3f617868d679ff7db9b1b0e90373837326fa2c65b480d454690a25ec9fd3df9444a08f3b0a5aa57de39c26ba6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2905.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E3C.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit