e5395f01106616ac1cbe7292086d867c0d0d624115105b079b37ed677d2d22c8

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccba2c4d55a70d54b65a20cdccf9c438.html
Size

22KB
MD5

ccba2c4d55a70d54b65a20cdccf9c438
SHA1

36028e8e1f6483fd7cbb9dad957fb21670dda0f6
SHA256

e5395f01106616ac1cbe7292086d867c0d0d624115105b079b37ed677d2d22c8
SHA512

505ba9f48ce51c1c4fbc63a5bd1ca68c84b2ed332ec445190a7df4036ea1c91ee4cbf82a48f7890513b730a8c697dd3813fd41f8aace84631d91000e9a854c09
SSDEEP

384:xlR+iOT3lhLguq1XbZn/irIF/FxhlGN92ykEYztl6v7xxAJgePZ:wTDguAkolm2ynYzH6TCPZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000557b4ceb4472a872d3115dee4bf5c762dc4a5e090d9c0e34c4dc788eccd900a9000000000e800000000200002000000047703fb5bef322e3d2bf4bb2d51571d371980cfd9ce38f9c1c3b3a645a658b8790000000518ee568e10315de36f324a1acafd1d198da8322d5510f2b4a26e3bcc932c0afc21f81d1c6aa9e69bf75c26fed315a365f17b934d9d3b9e66f6f00daad6043454268ef9f162d4e7fc02e83abf92dde81890527f062ceeabc4bd8e0f3a34246817678e643c7d47a6a6e298894eae4555541f906114225797ab75ab96615f99e3f251f064bb22d429ef2cdcbf1cf8a396f40000000eaf34179771554aef720b2a03f87c0522d9f73f8441cd2ff75505f897eaafada6fa4c39df08095e136a9ba5db99e5341a95728a08d680f496996008fe073b563	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B243841-E332-11EE-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b434003f77da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416713379"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bb153053826cfd429d8503a59e6c28ebef53c1fe353316e1456081b1b48eff93000000000e80000000020000200000009544b735d5e6b1ecdf06a83c97a764aad32faa99000162e38da5ac675e8eae0120000000d23c851d99fa88fce0cde065d53a8f802abc06452e6aceadda4db8534cef768d400000006bfda6902c0c56cd6b0edb04868fbc96c04d3d6be22279238a24be0978b5b72f1afdb3b545ae904172a2076454c08aa2cd9e7a6966b1b51b25080cf39ee6ee20	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3036	2320	iexplore.exe	28
PID 2320 wrote to memory of 3036	2320	iexplore.exe	28
PID 2320 wrote to memory of 3036	2320	iexplore.exe	28
PID 2320 wrote to memory of 3036	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ccba2c4d55a70d54b65a20cdccf9c438.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37174e9d7f3d573e65ecb8349c4d3f95

SHA1
a62075bcd2157d2327baac16a6beb27f9dda0a1c

SHA256
ba86e5e4696073bdf504e27103a360431b3cbe8a85e84e1dba9cecb3bba1fd77

SHA512
f6d721a2de92a02d63582a37e83a87e8c02383436432200689ac3263a863f082d4b3510c08d19c29b2d8b78b3cd8de627236a57fa4d0bbc2ddcbbb3ab2530808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52d1bbfaba06d5be503b8b554760aaad

SHA1
8c5d248a94334bdf73af1d5079393c00a8fe4f9e

SHA256
cd5aa0a03136760b0b67029cbd2ef6772e35c40d3d66ad2e549daf460a931a58

SHA512
636877062e8142f96a55550e78bac21ed1757a108812e8d43c1d5d5142be12880df96350016aead1f69a94d603c4b4f087fc3e86a68aa8b31d562841522dc471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2b9ba730216e94dcba6eb6919c8ce42

SHA1
9553fde0ceaef3212644f11808e4d4ac0c74e69c

SHA256
8b5b68999438afbfc4336c7942945ce9b4c7f998e57949b1a064145180b942fd

SHA512
91dbd2094acd61035d0ad3808424ce9a4fb3045d9382568c39eda27250cda88ed393a4a02784d7f85f7f73ada9465433339fc5612aebaac344c94a5acecf832b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78aefc4e16142708803341445f5ba48f

SHA1
d584be5a6bf46f7539d91cb7a8072474b3ea6eca

SHA256
3f5eeb73705d7aa02dc76b2eb526ef31b47a2cdd1607f9629f18613061efa297

SHA512
6fc61ac5bbeb50b09a028ddc6e00b9eeb25b2dd966c27335cb8e7d28d4db40818d2643c178d2bdfd81d6befb867b383f36c765c2f23dcad759b3ecbc76f0a7e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83da484b8b853fb91d6365a70c14ea53

SHA1
d305a6258d2da1787f943f845d65cff55dd3659f

SHA256
e6222e711e34f4252ec35edd20bb8cfb0596a9effd7f523f5c1ac1bfe20a9e14

SHA512
4500098cdb135a3a0191882240c1f89500dbd88f5cc64a08650c17cabd2763b0b322fa11d91fe4eb7a3d88b9e31d82241e16e8f30eaeae041fbcc7b17432c8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9980c32ea86b94ce0b23c0827beee29

SHA1
aa3c4f3ce5880fe72b5aa182fbb191eb8f54f464

SHA256
35c77277aa45a9f40f8d22c1d8633eea7cc257e9e79e644b05639f8b583ae0b6

SHA512
109f97ad21c1f573d35a0fbc535b02d17c3874d9d5b860addf2af3c0c90fb86414059ec592374383f4d1181c691fc3bc797dc1d6cef1226dc94fdc0392ddeafa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d682d4ce3bb460e08b7525a33b54d090

SHA1
7569f9256052ecb3aaa6f516e90625921ef5f001

SHA256
4b717369c796cb7c27c971834ccd73263262ed11a3ec78831c45f5137088903f

SHA512
8db704ba0ed8ada1cd77551d93c3d199e825e9ad4588e496c5687034e06a99b06d7815ffbcbeb30971a1baa35e059d8e2907020c900a38781392d1f84f542802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
311f783381fe94b3b5a67c7aff4f2a4f

SHA1
027fc6fd5f0072ae6381b2b6e154b139697aa6a3

SHA256
b85037f654d82562476658ec5ab7666b6951db2181e218962b18b0ce67ac532f

SHA512
458e5945d30ffb15b3b5f12c077ce5264774252919ac9aa243e1bd51055079e37f24b00fedc1195d19f21554e0309119c2d44ed0a1ad9114abf90884f6a4f7fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41148fb3587c3a1333b7da184e2fc53e

SHA1
8ff0c09dd894f4f6cd4e478b8942f56e991ef251

SHA256
f093ef84535486d193fde3deff1fa82105be1155caa7f80832535842e0892533

SHA512
8641ae189da0e9de0bb3fb3f715dbfd9de9dd7efac54ab2dd513c6b9756d7766012b0598444e770abb1c7f089ab1b0ab29b6bcc2ea622fd911cd90ccf8bda457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a5c967d19c73d55d910777c910b712c

SHA1
092cf29aad1447238287cc3f0572d2c4cfefeaaa

SHA256
cae864fcc2d03e63f488ada44b1bf61d0d23b1b756ff4ab7a507a21b7a8a3ff4

SHA512
ef5477b191c542995f02df3fff084bcc703eb811983563f526b577cb5e98587a25ba8b99a7e4906d5c01412837780386ee395d8d63d596efc952a425bcd7f02a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c57ac9e70fc5c29b25e8d8838db66b5d

SHA1
682acc87e0ab98f1061fdea13fdaeaf58deae0ca

SHA256
55ff6e1a024f1d54cfda5afda32a991c561581d10ccce515d8e3383e01ce6f8e

SHA512
f59da890c3d16237751781a2f19fe47e24c163a6375faa023b2332eb6d79ed45d0a873cfa0675011d16381e02d690f0ca98c99c8a393fcd984d9640e45e85d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50f1a673a85e1a8f147abb707195fdae

SHA1
071b6dec0a5baaba3c323ff51810581389a3086a

SHA256
78e4bd814d28687b650a26edc069e17ef32f1fc502711eaadd2dc5491ec71629

SHA512
3bcc32a5074fe38b08eae7f0b672c88080cc32df063cb2c199a81399c9cbeb43e2c5dddc137a48db40ca8b3e8f4b3eae07a9651b57957739f28eb70232701f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
255581981a22af8e2891a7b270fb7fab

SHA1
a1298f25835e806911f885b17dfc042e578a64bf

SHA256
2beb499da4b1ceba89696dc2a1267940f418113a69dd1635467748a873a898ef

SHA512
6c0fdf9fa50ea0389c74798f81aae4fd890d3c5c84d48cf1f8cbc1c1c02ccfd5ad523898a93710aa8a8487a5b39387cfc1990aea48aa01158dd89c71d6ce1ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80fda96e64d84aaac42eff25bf1880af

SHA1
df37a20a1f12a5ca50a163893beb5fc7a364d5b4

SHA256
7f352bfcb1d0e4eee0501f7654c3cda6f556ab4c099a511f852ed356b6ba41bc

SHA512
b2b3c57407377cc1c682e35837bb328e945b7b647721ad66041e1d0e7ddabc7e23acad30c94d1a3bea203b04b8a8347da4cc74049b7c809d53d906899c882364

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1E4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3DF.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit