e8d697bfea10c55ce2f3fdd959678ea536edc8acf3c0cd66e5d7c5465f0ae3c1

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc27adf4056bffe0d7d2753482ddbbfb.html
Size

6KB
MD5

cc27adf4056bffe0d7d2753482ddbbfb
SHA1

ce5b7ea8ab7fe44dfbd3275cf94b546ebc2397b5
SHA256

e8d697bfea10c55ce2f3fdd959678ea536edc8acf3c0cd66e5d7c5465f0ae3c1
SHA512

fd2a5362bf51fcd298a19b575029ee6acb9f2cd8a2f193a145cebdaac3e905449129c8736555c3baa0b97f01f8c0bc44a0e088512a8fd25aba12a2929f7178f3
SSDEEP

96:uzVs+ux7v6pLLY1k9o84d12ef7CSTUoZcEZ7ru7f:csz7SpAYS/jb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d682920977da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD746D41-E2FC-11EE-AB14-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008737b5406374d207e3088511d2e82d8156db07da5899959dd2dace311e80ba9f000000000e8000000002000020000000d1bed0c6de8a9daac8dc84143d0f27025f9967a15438159c37e14ecd8ef0173d900000005f68c3316162b9aedfcdf585e36302ad401f638b1cdd8248214b3a85221706275939ae6fb275e19545374cceebfa721e33c2f577890966b36d45892b0265de41f4a05ef4c5f1872a39b3a02cfe85948c1b09876fe1dc500e1d3f1a8bb50811d72e50eb78d16ec512483d3f641ed1b633d8ae27991aa69770849152cf9e86142cbfa98242153f99504f3ba89a43d8529f4000000019133afb2598b921b0043c6c1f260462a8e0c2ff0fd44aa320190fa8a96fcdf04ee0d3c7254be93e600697823e3c7507e4fec826dbd15540336ad5792b9457d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000058ffc0a2cdf878c119b3ab7cbb6e8539aa55cddc7d6763217b81aaff9d50c8ff000000000e80000000020000200000004afd6f69d13f4758f37561b2bc0599201130254fc4d5481ca8f1e30d7b4cd1572000000086d33743df9fc55a27bef00c26fdc52086a92288884c4061bbbd60a0c2e3108240000000a6c3be4a657183ddd96af0b13ddb61c3ed5e6ac12124087ee86fb614ba63f58e95d12f4b3583adc057f6c24be38b59ad6953b6af708973d3afe00ad72631f671	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416690431"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1688	2612	iexplore.exe	28
PID 2612 wrote to memory of 1688	2612	iexplore.exe	28
PID 2612 wrote to memory of 1688	2612	iexplore.exe	28
PID 2612 wrote to memory of 1688	2612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cc27adf4056bffe0d7d2753482ddbbfb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6a9dcbbf2e21de7532557aeaa300474b

SHA1
1336eb005b7a868ab9c014aef4033f329e940ea5

SHA256
619a788459fa16677fa89e5d57f0ba820e0f1959741509967415999d22c10ef6

SHA512
05139a9933d9b6d94e6e50870b7395808fcd9dc576317dadeb9288a7ed3bd659d618ef41910a68e34dc909dd83867501b6641559a751ad58469365b978f665a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cf31017393a1c385f4dddcccd3cbba06

SHA1
509761928c6932828b915e39196f6aaf0970fae2

SHA256
c651a33d9ff7bed577a187a528bd041682be35da91615b63a7c2bd8eca72defb

SHA512
7e414076bddc529635cab43240c436656988319620e3971d9f205e4ef204b3971910ba4fd07efd89dfc82b5efbe4534aa938b5224a88d777691e4ab77a80f8ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
31b0fa2273ff4d4b0a3bfd29b845cbb9

SHA1
1a4a8987cc922c53bbc6e3e05666fc69146d7182

SHA256
b691114856353775fae4cc637186b345d35d8deebb22d6565f59544cefffedd2

SHA512
cbc62e37b1be6aa973335646c5df359c10e44c7883558c66dac3593b9e36ab68ef883ad2109278e7e127edb262cd27a0b86a116e261f242f2f49ab19b7dd0410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
56eb08576117145702bf7eed4327b5fa

SHA1
49f1ee1bdf7114a5fe4bed0a1f5903bf16b1de39

SHA256
32f6311c4b8cac25c89dff187a8a059fef37aeee20a2ea248ca264ae4c0b8337

SHA512
5d0ccebee91ce961813868340d7ba14b1d06f71671ee42a7caac48337d2843f987236b7ac9f936bb8d575ab591b820e8af0f16c513a96468a867fb62d451dcc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4240c153cf43c76c6c21bea616790315

SHA1
ebc15491ef72f8deb94c206cd69b377b73b736c7

SHA256
022766f7e8fb91a935cc876f1ebf27df508d8b7448282ab621c8931014300f28

SHA512
42de984053aaa9419d0fc38110126d92132374901a460f6a9c13e337767cd3617f43a2769dfe5f6d846631cbe3da2a22c8a12424bb4a805c9eedc663827e8a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
58ebba4ccb4232f926678fca62bce91f

SHA1
8f7ea969d7ee66babbca5fba534729b8207ad1c2

SHA256
cf2491206c1e3923eb5d7c36b4280133b3bc8078a7bb439d1ed472cb22afcc42

SHA512
9fbe400ceb8d4569871601072106aacbbd85db302fdf16ddc164551f807b3eeb3a51b085515501a37b5e455aa51041d1bd2151d5c7cd97eaab3f6456792bd56b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4a7ffa4d5da4b0cb84027ea064d941df

SHA1
1fbc666065e74e7c8867adadbe6b6dc46a8792ff

SHA256
0124ed053793575b2f3cc0aeeea92ba49f0544a4be9d7b3909b497d2d9845f4c

SHA512
dd4a9eb7637d889c7c23e7a5e1b61b8dd1ac847083bc92ceabe354f9b9c910fc732dd8ff20d8cf9ed30d4801ac6c093eb19a31fb53de86954ac89770fadbcbde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
84f12a6f42c7dc7b90932c5796fade73

SHA1
b00398fd388bc3d769b12b64d8a3ae9baf342485

SHA256
dc580f8b202c52e0fb083bd5481b587939f0eac90bd144f163d9a00085297542

SHA512
a368c19961af023ad2834dea3b929845269259c356f4075ef69bb453fe4ca62979729f35923bdaf6bf4b5e4cc075e1deda1e13398ef7a1cff4a92a9ede22ec3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eee014a18e3f07dd8f925a484c1dc09c

SHA1
70eb9484844d3fe5b413db519599705f63b3a521

SHA256
d7916c1509acd9d60b48a66e3fd6e1b8a38268ee970936511e45b2545d901bc3

SHA512
6437012718a41a69d8d90902ac68ea9ba3bc8b17041dceeb2fddc02553c28799b590f4189c8b4ad2dd6a49b2347fe4354ea9bcc7de34ffb899e70ce05bf7c610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9fb016dd13f4f64c92d11c73ddf3461f

SHA1
4e46ac50b4f758192a18f381e192b3851b6d7c7b

SHA256
1b8f19ef64a5f4faf2c7b826c0c7086f355332ce5c51250e4ab173eebd21ca6d

SHA512
82040a1290edb4232d115366907ecbfdff733061cb661a02c13bd748b94996aa368843e62493caa9dcce9b752e51353b4f95b397015f58b01e2dec600b3f92d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e7e01ac2d3df166a681a25ac279db34d

SHA1
0eb5e47387f687472b3878e3fe829235e7495e26

SHA256
6cad7a55d40fb3cdef3ac0db6aa8b7ecd6d878522f858f3b7988754e7b38762b

SHA512
4a6436439118f56de4d40ab8027056e3420f03558b3e50c425b4c13f293499b794732529f8a3193464d26ffa328eb11a8493bb0682352999792ec70a47bad8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e76bac0ebc6dcfff761d753c999fa0b5

SHA1
32e3c6d59a30c62839b95526109f3e2685c61d0d

SHA256
d837f30d3cd6f900b303cd8289028e678b984760334b2db50f41e5ed3449c7ad

SHA512
6300818adffb60fbccc1ac2f0c57484ca870d7a9fe2c472447ca1f76833b5f741a516e3205db6ccf4b782d5fb46b0df13014f7fddf9dd4f122ee645dc74c16f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f41df473468114daffd244b529dd69c0

SHA1
b1a48b793b471c3bca39d78ac6d82eb38c8d49ea

SHA256
344dbfc35deb4ceb2a3d489a77efef0e61b4b9a5a4085d476a95a8078c596eb9

SHA512
04abe898f7cf7403e024aca3e85d8b1af583c074c402deaf3ab1330e749d806852a9595c1ccf5ce7f867b4a97ab111ca909b9207f6f9110ed8d4ca8e2b94474c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1f275821ca1d165581254a7c8ccb8211

SHA1
db9bb35adbb315f5859956a85aef559f4587b288

SHA256
f97382d1fefcfc281595787eecf96dcdb5dfee34337d4f7646f2b064f21ca203

SHA512
6e2b26a054a499be8d4f0746e9f07c886467644df0a7eec6c34a897516daf09b0416ab4bd04c41315859aa8363c98fe54f9924d8956b0a4afa76c2df112803e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C01.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E2C.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit