e82565f2ea962ce2d1e99db50c17bfc01b889a0361d79ad678cbd981114fa187

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc3187d72baf51e03a18a35b01059557.html
Size

39KB
MD5

cc3187d72baf51e03a18a35b01059557
SHA1

20389befacf4f26bd37ec864fe94136c7b7c77d8
SHA256

e82565f2ea962ce2d1e99db50c17bfc01b889a0361d79ad678cbd981114fa187
SHA512

c5fcca6413960cc8c8b1893670fad91e906c878f2806bed63a7cb353571dbdc29fc7c13aaf0a911e9730b53bb50abaab6cca3713ce52148dd3d5f8ba5f963f58
SSDEEP

768:/AechPSarbeuVxpC5I9nC43I2MLR0NSap18Tt3isn7zemIdCRD/J3B77qH9nBLvZ:40IxCbJ/XZRD/BB77qH9nBLvtt+a/ttN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7062af0a0c77da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33753811-E2FF-11EE-9907-E698D2733004} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416691494"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004bd9d8fae5d333302497de48cada733c2e89fc958d18365017ac20f113232712000000000e80000000020000200000008f73c2345285ecc7848709d7bf7a23e9b497b8872e1353302926a3ccea42809890000000e8c9f03207e28d657b46589c7d1a2db07332f78d05ad6c6aaafc7b12e29bb21dcbe88cf92b822692d808c66230a1f58cc3d61488a08b4762cb59c3d4d8a63e2eaa55799a4925cc1646538185eee3a4bbf809d421fd08e3c6bc96879e5135f0c17c551212f696a8f5e490eaff3137a9c1d0f3239205563a50a53614022f00d291bf6d962ca84b2f78d4ff84a05037618b400000007fa99b5596242b0ec4f2588ebd84cdd4290d5e47eb0c94bb1f747bac8fd5f978998c81dded234eac0b294f7d7de7d558baea077cd6342b74996a267256bf938d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e91842a36ab336b3ab54ca431efaa9f20097218fbe10ab48e5367993b327f860000000000e80000000020000200000007f7665fa1f47f036c56f2a16b6f8663646d8c29835c108941a3fa5eafaf326e320000000de274dff7d7c2e350be0aa5fbd0addaf4257c7976ff6b945fb8588b753eebae54000000017379d83f68eef51a60caa7be6c9fce584669bf2221d11d5a5b9c9ff84b57b70a247ce0ba446058287a1d847ca18ee597b7a644e621bd2f703907fdc3615dca8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cc3187d72baf51e03a18a35b01059557.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d4cebbbb3ef34e9265c84a9d8f06ea6

SHA1
cc1d011fa7a47a828a705ae5992e2ba764b8d1d8

SHA256
446156201ca88f8051832d4b31d8e8a0d9105bd167bb473ddb822e4742451dbb

SHA512
5244134c06444bfe1d6bdc5c32f276f544806d3ec68eb233d6597210856d7ec49b19a280638bb4c0ad2014d3b978b2eb192871c7789c27ea5715fae02a62a8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e27eed4de494ad965dce224f145399

SHA1
20df841e2d3233f2b8b8e14d10b04f83f76ec5a5

SHA256
d5a9ee50343e9ef894453a5495b55e0b477ff292dcedb8de22c2485b18145e2b

SHA512
a89dcb7e56910dcb89366c2f9e6cf19c5be8b783fca30a45b03bbe856bb5365d0b61bbb0dda6ac667d93ec048a2757532307491037b67f387d4ea17590231a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5f5640a88be0320b4c6802fb231f8d9

SHA1
116808bb56f5583a5535aecda0433c741ecc68ec

SHA256
5995ecbe78870102f041e558fc9b0a89625a1b0258fce473d97e8633c5bc93ac

SHA512
b8b4d57f0f00f6292ee2ad153f9be0d24502c60facf3742c9d78cae51fbb83963a4043d2798ed4135910265115a9ba14be62b07ed73ccc9fb13ed59acbf24ff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d975057d388d2f06edb6873f59015fda

SHA1
9144999f2eec1c41eefde2a4336f5f4a61d2cce1

SHA256
dc1fa14bc5b10b2f502a20c88b2c3fe08efb69006e11783f0b8d56235dfd44e9

SHA512
74905698fe3187606e959b2106c99e56fb5f134982f890ba212c15c31a9da7e54c3fd1f2a2dd46614c0d0048a6d6c3c216fce7c318b2389ea374befbfce06052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a3804801dbe254bb3a9455e7a5b85e5

SHA1
413f44da34969ba4e3aff2fb8a68a880788cc16f

SHA256
33f5edffff19b46c3bbe50c54e340340aa72b0868a3d58d64dc36db6d237b9ef

SHA512
2f3d28984d55adc6083b8ed3a78dd58cb06f8a109a699a27f07f9c1382edb5687514e6e4753e423a4b1e5cde18f0013c3f78ecd9e4832289f31618561a1978c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33de27c1194e8ae351edb2e9dbaa5212

SHA1
329f3d7859d2eefab0c15f206dff1ae794520e86

SHA256
ef190ee10839fc049741db7b99da0c41d9e08df760d0f3d438cfd0997a341706

SHA512
a4e45e3499554efd62135ea567b110549d78bd0f7323a245706a342643ad996894c589eacdb5f116a50398cd74fa1ffa56e8b370733b725f9905d886af62e4be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d693c0039a15de6cc27513bdbf2f20af

SHA1
467d764d6a1eac279247e1039c6b2b209fcc09f8

SHA256
5b5030aa36c4a35df297ae19f72d02ab3875a404824ad0807d5b1c11f72b132c

SHA512
1e10459ec79ce6f7fc99d93ad4a3229b63d4ea5dd745d6f30cd21c7f0d4a78e81d959b7d9780a6e17fc5c90cf031018b1182c6c752f0cfcce5abe8f6ad10d0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437e8247d5dfa3c54c54e571e6d31868

SHA1
de3767e0ff9ac798341005f313c1ab91fc5c5ece

SHA256
6272c48adf214d6b0bbabd1def98d44318686fcc1f647fc12ac83af66a110a3f

SHA512
5ce35840dc54b19a7017f25131de670acc571a3412b9c5e77c8e072bdeb86109c2b9094fab230c0f78c7d2beec61392ff095c52f9c7fb7f80f0c87ad90b9c1a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c2afdfa8c48251da1ce32ac36f603a

SHA1
1c649f33eddf58e224881379f06c8aaed97fc566

SHA256
469228f52864d124e332cf7501b8af28840eb72b2dd16443ee25341cbde6097e

SHA512
9ed12ba9946360fb316a7000004439ac888ba843a854529e49d0a19bf32744bf90397c222ad1abedb160c9dfeaf15704c787c04f4e33e89499ca19f2dd68d273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec9007ba35cece10b422c2333bd9de3

SHA1
38b0d3af1a2dd9491a7982fd45f8622b0c487647

SHA256
a056c939cc7ca92a78fe2a1fb9e03eb9ca1667a6a41e126bce0668dbc6effdc4

SHA512
2d3f15ac15e11b00aac7c182ba0af235f1422ee1d96e4616092e5185fef3c46c552a744d1e7dcb3c067d7f8cb069e792eba597fca0d1e80a0168d7d71a844dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78632446c1ef716ea18072bae6aa8529

SHA1
3785920989298244a975f2cfb83bdea8115869b2

SHA256
150fa95dcba74417a44acb13fe36683b4334d31d12b2d64800eefd0af8b93230

SHA512
3ae032134cc58fc00677359e5973e4cdf56337a5d85e3154755bc77bb0964fcbbf16afaf740a6d222fb9376379bac1a26e7fd330bba1ceb4335a107a13c407e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
148790a0ad105e8312c4eb4e6cd25532

SHA1
4a91cc6dec1bf7c29f361ea5fa9337c6ac894ed8

SHA256
5961ba6fb8e08db2dc791045e42ef04c0110868c0f8884d4580bd820bf1fb40f

SHA512
73cae26d223c06c64f932773d66cb9dc7dea241f92bf907c3181862d27a11f54dee47905b1aff7604765d88807b2066b923c9ec227345a0d2e985c1e81eac498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c1fa0c2e33bf1323c9c957bf9a1173

SHA1
99e4521ff0b7af6c73c70aa2ffe88dc39cc5fa57

SHA256
fcf9f7a9aab18743e3dc2cd7260c206ff153299c92b3574143d7c7f9113fb5d0

SHA512
0c5f03d41f08b6083cbb488e26451857ceb732569b6a892ce92b5b66be7cc135d87142dfbb0716e8bb36eb4039b15d908dabf6b531b158bbab419973378d860a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d5e7100433e8c36d082f12d53d06868

SHA1
ba959eb136b6da3bcb0541d8cc1c773598e936d5

SHA256
70f35b1f583f8a9284bd7f793ee95b551c04a12ffe0ff1f21f891048165bf2ec

SHA512
1cd3409f73ff9b2faed2c174f298b1bb9afcf2b511fccb98b99bad4887928132d0bbccd9558dd913a197a34a340f28fc076fa4e001612090ec7c8dfe0a82beed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58abeba948d242a86a6e43f3658f2540

SHA1
36370bb9a60df9721dd1797d508bdfb5ba134d93

SHA256
0efb7206c20ffe5303464d2c0cd7eae109a4513c34668649f072a0340ebe2b5e

SHA512
235f3d3073d211c76be26888c5075f07b9d318b1b67ebef089e833131939a5aed68c3eaee5349c43ad3e0f9a33fcd9b5ee0c2821e68a1dc23909bc3e4ff867eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be6a4791da5a54639248c7ef774d41c

SHA1
62499919956dbd08c5c1515018bf7e87005d4722

SHA256
d780173e9e753abc5ff194463eabe8b74c9cdf8be56e81dc629f09eaca798fcc

SHA512
154dbf00e32afe04634986972465f170adaf0b5988a615a683731cd38a5b7e1b6692494324a6386830893e5ebe7e05de351ecfa7424e176dc74db3a3b415e05d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar20E0.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit