338999b194eb052add0358e2139a658a6bcaee55135feb014bdc0b29af69541a

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd131503e056992287bb054c19441893.html
Size

6KB
MD5

cd131503e056992287bb054c19441893
SHA1

04bfcb514b84ea2f3a8b1b1ad9698c4194128ef8
SHA256

338999b194eb052add0358e2139a658a6bcaee55135feb014bdc0b29af69541a
SHA512

2a3e475e418fa3c92e9319e1fa4a8a0290db534fb9099ed2fdf349b250caecbdae589c8dbf28d37a72f30eaf9a7154283e04d6e9b01f13d9bdd5b1d1dac6ba38
SSDEEP

96:Mp4DVjrsU3lWhQ/IeQoP8iGVEp8xn7rhKH8g66H7wTeCBk:q+vecIezP8iiw8xn7rouB/Bk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CC78501-E34B-11EE-B2C4-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007f4e8e48d445a729dba9ded2d857578ed586e13515b38f0c311e8f1be1c323d7000000000e800000000200002000000072c9887a1e42d60fcb2c47327b9c770bfee03865747a36a7af5be46616fdcee590000000c1f505b59489cab0f70d7688c91b58e33968940b4cd7215723aa86ea2ccb25e0b476a5fac0beda97993412198138d385b5ed6786573f05ea4337b42acabfc3269edae3fc7840f6156b7646627806fb2f65c52aaf879e527f92e59c11423cc02f32e3b13e49407aed0e98bf34a45d03b5cfe19e5b1397c34ebbd0bb5196c123074f3b040807ee5d2642bf27a97fce49944000000064cc7515fd88376be86745b548db20ff59d9024577af2bcfafaa058398fcc5da08327a5920b3f966a9192ff8c5b55eacabb24e361c855d296bde755cf3fdd360	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416724201"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709489345877da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000708e40e195a93bdb08121b6a9007d8b30163ac8f8ab63cf9b6f1a0a0934b933b000000000e800000000200002000000022dcfc341e90696e45f1fab5f5918f7785d364ba05fd599173af61c7f6cfc9b1200000006bd2ae5cf282a74c5d1f5a8b21cdd2899477693760f0227bc32c7da8fb7b2b5c400000009b7cc719b4ce658be0b456489ba9dad0680db6af1775ce200780f3c7b9864a886ebf006979ad5013f953bf01734e4d5a53e457a3749e21fd0c4c1a00156b94c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2836	2208	iexplore.exe	28
PID 2208 wrote to memory of 2836	2208	iexplore.exe	28
PID 2208 wrote to memory of 2836	2208	iexplore.exe	28
PID 2208 wrote to memory of 2836	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cd131503e056992287bb054c19441893.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_749F323800EEA448718955FAC254DD4F

Filesize
471B

MD5
6f272f5f3a524fc1b106426f4742d4ea

SHA1
15d6ff1b4a183266034421d9cb30d1f133af9e4c

SHA256
dddc2b36549cf280d754939144b6fb8f6a99215d0e589551815ff256a07f6bb8

SHA512
02b777fe0288de413de2de96c993e1053268adb6121b2000d145567a9b38e1bc3eeaf8bb025c7cc3727f7938218de3cfc3563da8188d5d07510090428041ada7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63407107cec3dbae6208829bdfe15792

SHA1
2b116e77a4a2aca0846c48c94935326db44e0e7f

SHA256
5a127a071a9ce7d6e020d49135ca22efdb0734a8923163283f15b034bae5aab1

SHA512
be7d553f2dfe187ef756e613df24f9b2fe83d47ca0df74772f9869ee4920df459c637d110b5624a90a1e3b7fb05d9020aee35308a05ef58e9fab49eeb5e83392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5688eca2e243ef63caab75b40a3bbfe9

SHA1
d0407174444a6dbd149270d427e1998b95ab4647

SHA256
9d3ee8b443f113846cfb05d94cd1a3163f792ef7a75095f55686a6dd1409aa47

SHA512
e086e4cf4dd9aab5bea38719c11ddb11ec1dd94d6a62e92f0706329c23e1eff5930e811fb79367b2369230c8f6651a5b56e2cf04073df89fed6120b732db6f61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
258510041adc6cabaf75faac98e6f916

SHA1
f2b92a346d4d45e5d6ffce437dfbf71fd5f13d4d

SHA256
b889159043a01e7402be6f32f77f031a84e61610688db1598b7ae2bdd7ac4a32

SHA512
f978c4de7b1a6d5ccd08e2527b4ba1bcdf77ed04a01083a5e1bb682f582ea7cc8ae107eedc797a297f48cb7911a2ef353a1ccb87c6ba1a7a590616f2202135bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b98a253c7d364b149a5d25a39da3d7

SHA1
d054b65bca2b05ebfa96cf4847dc7d6e8758e854

SHA256
89426d735467accca6d577938e098d6ac7d95a26cfbf684b2cd0afdeee0d988a

SHA512
ee64ef6dba827969c111a9a99c0465b97784712b77d7e20e54afd06410f3a0c004549f65e0bba9bd5e0075c74afcfc2316a6fdb059ab63841dc6a4618f52e8cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f12226829e4e8a83db4518fa40f1d83

SHA1
75d3dbb07196d94428a14fa770292e4857880ba5

SHA256
b2e90102cf9988b568bae6d17921bc3c0e2875d3ceef1f0e1f66d4df46153909

SHA512
bccef1a1fbfd652d743a8fe0b24df67482f87fd32420b972fae4826d9e5f0b725489286d6c69220ce34ad26dc1a78de5e1c402521c7d31823a97c05e31026b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fe434b9796d06672f52489b047c5aac

SHA1
8dd3f5c1c12915ce4214ef2a9700f0f8eb1dacda

SHA256
64d9e0d2e9520a5977392f4c4ce97faf00f4fbb6c091d4eb64a6c104af844d18

SHA512
502bb0448a321a29b470cd90871fac2f2d14b08ad3e0e6bf7fecfe00954cbd361e9cee3504699625a3fb843fbe5e6014ca98379bf5b9121059594283bd448321

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab55FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5610.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar579C.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit