e6923d0faadd12410eb63af4eb7402d01312f33fc4ec8739a2d365ed8ec8b415

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccba7200193c56be90f22502edc51615.html
Size

28KB
MD5

ccba7200193c56be90f22502edc51615
SHA1

ce1c2df7dd15ba49114889bd6bd355b6153aeb49
SHA256

e6923d0faadd12410eb63af4eb7402d01312f33fc4ec8739a2d365ed8ec8b415
SHA512

c0d1bb0d2d686df6f67c6ea7c8c6534f3ce52b8373667039196a9bc17e4f1864eb2f618b06f816e00684da8f6095f74f0175d68518a105e8e669ab474ba04bdf
SSDEEP

768:CJ7Ch5ycCH4O9ozSjl3XG5qBEzLB015j331TGPe:CxCTFrWnlnG5qKp0H0Pe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45BB3A01-E332-11EE-ACEB-F6A72C301AFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e6f71a3f77da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416713424"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000826818794e60241faf65841b31f6af66b34fbed14b30522b80d9a6fc6e8929d8000000000e8000000002000020000000534e12119ea373d59167121f6436455f2a28489ffcf8367af8405dc741c2bf0f90000000411d363a0f4a98604a601f1116e8947c57546f7d2d463076e7c0770a21344ef2750e5dd8e071e2ef63317c5d77258e9628d9f6608b8a6feb8ffc90979dedfb82f92e9199436372be002bd790497c194111ab0cafe2bbd53df6f63c995b89dfc42caad742403aafccdb14d5712c4c554b7f6dfcc39df5fa17a132a4456c127e308a9a679e82377a1376a42c215777a13f400000000782e68e3dc10f895881c004ea489c6c3329932ff1e6725293f337161434943f7581f6dfdd90da6c265eaf0331bab0b45ee3caffdb5d5ba57ff60c1817b92391	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000024c40aac77753ed84185ddb1f028a0877f7b985bfd16e11b4d56c9443d7c317d000000000e8000000002000020000000b9d3dc546fb61463fca245188630159d8f023872924fd1c6edef60c7d37ee29d200000009256573ef5002977823f07955225f8a4603a76844158e19903dbf5e2ada63b11400000005e5f0068124f7d5a80cef4f8e67eaacb0dd4f061a8efe9c9da4a0ac5bd52f5606c2981734632304da1d9a712f33e8ba52c7f0fa486cc279130175a237aa19eeb	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2620	iexplore.exe
2620	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2248	2620	iexplore.exe	28
PID 2620 wrote to memory of 2248	2620	iexplore.exe	28
PID 2620 wrote to memory of 2248	2620	iexplore.exe	28
PID 2620 wrote to memory of 2248	2620	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ccba7200193c56be90f22502edc51615.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
17dac6169456d5a526ff877abadb6ccc

SHA1
57ab7b54309fecd1d06fa30720c0b34e7471b60c

SHA256
bd15b1cff67f265ce711d288c0d7c5b41bfad2dc678cc46a6b72e97fb226f740

SHA512
46ffe3314b7695d08b84e733009cf84d5680c5a9372cb007115179ef55beedb98ce50f5f251fdef90f97acf55e6a05471c553cb834bdb74110658e3a04433dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9075992171cc87032dd6cb853504c4f2

SHA1
c6cd853a532d7eb5601334358dfb62d995f4c1c3

SHA256
da601ffdb5792b6844ad39695f38dde689c7b6e83e15951b9478a8c089837f33

SHA512
6a2861e01c39ca1c3e08fc1b07acafcdfb77e756154b4799067644d88d471641750fd609aeda294ab5e1fcabeb16ae5c5e99204c5f52fa62680f6d179f32cd6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
00ebde0b0bd5985dfe268f342331e3cf

SHA1
e46ef78d4893837cb0824a641691f5d975bb32aa

SHA256
653ed3428ece74bc3902f247ad5b53540ee87bbae3caf01073796fb5561c191f

SHA512
7e5b3e47560d8c009e5701bcedc79c6f7eca75c68ea733936f466b691b65592bf651158b4c17c38302a72b8c6503d74cd1c20b9e824b87afc52d10eae1056d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
41d54abf02a462f207fa08ad3cb2382f

SHA1
6c07a74b9ea1032a63b8fef678816711bacabeef

SHA256
0a7b71bd0d7897480c331a595cf9984e21f280d46010796906881574afc0c004

SHA512
47292754dd9bdd28f221481df72a2f2c7de0e14397759bd4c2113d07ce4fbd5cc6101050bdf31b23fc46e369389375a06975a3bf6afef3c264c50be86021e9e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
49b730fb9de7bce03522c61d1b72012b

SHA1
9a3229bb3260dcdbbb247004003e814b47ffac81

SHA256
c127717007e4e8391c95be8b8da65351d60482812390d9737f41ef314e388343

SHA512
cb934544b57ea7a4606d3673a4316f4d6a02b218520052f6f6e8b894fd80bdd94f0d30e8ad355185fc118ef243444aa8ca317b5064ebaf56d6ebba12e75a057c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b5f6f9c8b9f9c14f38486fdd31d70768

SHA1
d9738a3ea6ee7d856c66101b13531e4a3730319e

SHA256
5d2a760e828de8d7c1c5fb6f31bb545aacea3686da4f9e32e812dd60e3be159d

SHA512
a052fb566f0f7c15514794201d9ff21fe11190dc3a235294bab9eb4a99f7f6c95f49392da37f6b696f3fd5cbe3f8091c4f37e168df75b073aa9d130f7c8a3859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
12ea42b7f2754b60467445799f5433a1

SHA1
505c15b9c23ac1bbc383c8cbe840417c0ce8ece3

SHA256
ffef31896a21599f117fa6d8d4c4695c4c0144f9359fb8e2a46256832c542305

SHA512
ac8a4521aced730ed9335666ddeec6c169eabc5902079f12fc794c5c252649aa9b67fe33e0427810f3e9ad44e5920cf835dbc67d184153d3e8815baa14925f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
893d85bfc7c0656cafc1564b2cfa7e36

SHA1
daa2d8aea36c29fa6e2624b5e28adff82ad1a8b6

SHA256
21926abdd76cdee7b8306a7dd3652fafc0c2c79b813a6bd0a7d41787741e18cf

SHA512
b0d8f03ad12767fd4c08535e9963139b76f44792417ef4d48e2f91e881126e911d6e506e6ca8af6f7b92439e81b22c787074f38b9e4adb188dfca23570f78692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1e876145db2482fb11f58daad81807ef

SHA1
1fcb41bba7d7ae2d4f836133fd7b06dbc3ca064f

SHA256
58efa5b63a2d1908d62c915e9a5968464318a694fac47e946039804028818b90

SHA512
bec7b9baa29435fc8f737a1a3d7436ffa41e0f27368d962eec44141936c86371ca2ef70ba5cea3fa1a2d6a818dee2360894d34776a021996f2179195fedffacb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
08966bf6c77dcf11cb42e6ed44f32f7b

SHA1
23b702157f6c7413cd5287cb9fbfce88a2d4e31c

SHA256
b4c04e6034360c01ac2e95061c7a89aba15974718e60d7e9e08023b4f493b498

SHA512
084dd18a82dc48d773c14df075a8e6afd5f2743abf10f8f1b44b7138a0d86072079c84236ac2f898bb86ae9dcf64534f82f60c0d09d48713b0ac5af27142f0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
09c0f274e0f4125b3e4df2e20de8b6d6

SHA1
eadb786b2b0c71aa99f323dc43d82250cf8eda3f

SHA256
6b9203bb5fc02dd9a44409b8f743ee167008f2748c4822ca5b6d4ad250e974a6

SHA512
058a27dd219d55a95244dc156e4780dcafdc832c52e99f88279147308c718698088b1817818200cc65e831991cb40766b511ecb59dcf7810f085302edf4e5ce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
540f767d7730f6b9267f18f72928eebd

SHA1
1d7ddde662c51d3f5f933aae8c0d639c69fae1ef

SHA256
c7cdb6ea68952bcf9f032aa555820307ecd35ccef55e22f9e4e25bdea62442e7

SHA512
7efca31356e5e216f990b834fc8accca3b167ada262e1b7297b62a39a6bc36edc76d10882363398717d5e4f587a06836d30d70bd4d63058cb32bdcc4f72dca5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab280C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29B9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit