b9835b33c61d617b522325624dea774f65a15b791755f1a8683ce20f50baed73

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd42437e980ab12f90c96e7125c453f6.html
Size

2KB
MD5

cd42437e980ab12f90c96e7125c453f6
SHA1

c4f8a4d8c0fb07e640caa2608f4ca74549b43358
SHA256

b9835b33c61d617b522325624dea774f65a15b791755f1a8683ce20f50baed73
SHA512

f7e66d19d00adc25abcca3eb31cccd9674ca616fb11f5c1fabf059b3a759fda1738b4b912ff585a73b779b644e08431dcecf0acf93d7320d51f6c33f29cb8ed8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000061d62787b7e6b48089f2f332754f1a152aecc20169c1efe81c7d41fa6fbfcb28000000000e80000000020000200000009b0bd7990f63e322936b9adac4b46dc520c96c3571a80347999e1b6052f54709200000002d6d8c07d6f47d4b098503a96c403f3d88fc9f7348145f1f49c1a6e1959a541c40000000c3c70840b8b1f2ab0180a1badd87b3788ddd4b334ff8c65f89179c8717808bbbbb96a333305e32c2c84f47aa9f1ea6c4df3237c3d044bdfa23610d81c7cb7af4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416729766"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0975b266577da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000e61a30cb8e124aa304544364664d2e01db3b3657c1d465a01043d14eadeaa79000000000e80000000020000200000005e41f9f7e867916dd9f422d2617aecd5ce45d5df01a055f60368c67c4b1d03ed90000000e31884dd9a53c3eb4bdcb63a1e5b7e8fbdf6f4894b4ddc949bc3240e6e99e3d0cf6c086896c2e7c1383b31c2ed8fded2a6ee5ef2cf07935da77fae9f7ab9fcc6a37516882138f1a80fe5915bbb66d0e7ab5c24acf30ad95dd11fb18513b19ca032bb0cc174ee4c6f7058e2bbc502318eb22c929b16d4656ef8d832eb1f932903e64589d1807714ad6721da51b0a8d39c40000000795806cd46a8edc22e09e249f5cc6e583ab82c303e8d817016a8583b2ba47cb28069106feef411d357e90ae8cdc3284cf15f451c054a9b06032f376c02969d9f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51BF5181-E358-11EE-A3F8-62949D229D16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2888	1740	iexplore.exe	28
PID 1740 wrote to memory of 2888	1740	iexplore.exe	28
PID 1740 wrote to memory of 2888	1740	iexplore.exe	28
PID 1740 wrote to memory of 2888	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cd42437e980ab12f90c96e7125c453f6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba9021b0eae4972f7e624e80efe6729d

SHA1
583d3ef93fd5601fff66e105dae388cc12620deb

SHA256
5b5f3cbfb3fd89464e47d35f23f904dcff3cfd4f3daf79e07e48d1121c126e7a

SHA512
262d40ed2c3716cf17480af03097349d9a8ebf18a87c1ea6f719e01c6a222e2c2ca05fd8646aea062a2e0c08dfd252275f10fac8ee3ff13aece2d7888f0f8288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19eed81ba47a00afddcbf493503ba90e

SHA1
e411371e9f8a99f0d4fa6c74c7c30c057803b2b9

SHA256
a9a04a18a0c97b5d3ab61d9117f6aad48a58b71581c25276d0cbbd75cab30d40

SHA512
38447e904d0b9395f6ab61dfed358699450037ccecd963b998ad401158bfcb92d395c95a939ee8c8fd6ae68adffa6188f9b17ea8d5f8ec062c9ec291a30823af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
414694148fc7e9c461c9b656c866f2a5

SHA1
c0c0a8c64928d8dc3e8500f51e2da43cbf3a249b

SHA256
022a55b052b8aa7c9852d3ba6f056e9ed65add6a638dd96e9417e47db5d4c7d9

SHA512
cdba3ccdd59ebc046eec4d8b162e8c456747eb29b71e76c316ebea95bdd3a73a90f54256a17b3a89f44f0ab6fcfd50c810a2f660c6d7afe6dde11c8569ad208d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6a7730be1ea1f814dcf604dc435368e

SHA1
906390743a2cec1732ca53be662a93921061d78e

SHA256
9c9ee5ae4bb3fc8b7519d0772cb84e3fb40607f0797e4a87256ff225adfabbc4

SHA512
cac84962c30f6e1dfd8ab0f0e26fb53e8f1c73e5c0ce9ac1d99467d4ece716208052429b7c37f7d80aae274a4b6b1ebc459ac103083c9e06e46d7bdd935d7ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e4c2f70e041f9ddac3d8838aa1d755a

SHA1
65714bc88f134c3c2b4666b0ee4db17ae0150702

SHA256
90a05d0f81ed8137fedffcf4141dcaa4d08fff1d0d9ad7b93375f11500329730

SHA512
f44b11dcec59348a8b3e3c86628519c254594dcb0aaf19299f3702dcc75cba694a58cc1228b8c653e9bec8d21cf2ec10c3c6e3d07c49d36436963330288336d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdfe2996af39d33a01759fc8bb4f449b

SHA1
866805e876b8198ac649ca0d6cfaf5bbb8b0e84e

SHA256
d0fc7f14f51ea2795a6da34a22832ad558d6e9ca813ad0233c9c98bbcf8edaef

SHA512
dde950e15c795c4493d02852e1e4f27766355bae382fdb5d96e363607a3088bda08befdb2b9b28131784d122d29cc8cd3a74e7ed20d02c858d339b739c614386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ad585affb1ab946d4e30b0f4098d8a2

SHA1
3d2d3bf6f35d2592599db175582dea293d2e82db

SHA256
0c8d9d036c8f2f639c3434a506d65dd5c2271d77792eecdbaf61a2aa930349b4

SHA512
779a9fb175ceb6ef44fa6e1e4fd7078e11d0d5810be80c514331484949cef0a27ace52bed85d41aea0440e033d1dd0b6f37e114baf1d92174ca1efa50445d064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
815eaa8446bf4c6a7cfada090bebad75

SHA1
fde2925648d53264a6693f58e76c2c38edfba208

SHA256
17f91794a988880dfacd65f103384ce79ac706052f5d874802ad8664dc08a40c

SHA512
4e8bf4727ea948893f8273586e4ec8d89735062e189d6de616ad9994ec8f319b7e94d95f2ca7407ea121cd314a690f1cbf559d882b3df04eb563744a5fe9720c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71aa33d2925c3e315c867b5ca89e31c9

SHA1
3e73ff57d54501ab6d382fa85955faa841badee4

SHA256
bcb8005e5874d8107322f839063f2decd6ec7211216eba70f9569fe1d5bf99c2

SHA512
632694094ad07667c86d09412ff2beedb7081e44658b7ab0a712b54945197266d7f6e20c48adc4606ea7afe6896573404d6d549ff0bd6e0e05f101fffb743dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afcab139837ca2181f67b6aacf463c98

SHA1
ae1dba79eedfc89245152b4c60abe91331d3f83e

SHA256
9b668a9b211356219f833f5cbf1aeeb3d2df95dd926043a7074b58047a5cb903

SHA512
de6251d3fdcf9eed35a7e0221145f0ab01ddeb9290fdb9cddfcc8a8ea1400e6e4f6ac7a9ef93ff6bb9b0da0017df6445d8cd98d4f447c8c7be1821e8baadd5ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d73c0ad6c33e9248876d2b5eb4753b63

SHA1
44e409c02c48bd0c173af8e1c9036d262d9e80a4

SHA256
3b95f262e5b2f3013d53508eccb5c25742a30ac8ee97771fb4af884eb3e6dc8a

SHA512
4e66a962dac27464327bcb8e1e2057360823d9a5597294215936b2e886fd61d4a29066ff6948f2089288f03d3e82a75cdebd78738a442a7d18de04ea7883ae09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bcf80cb4d88eee8f404d9364be9468a

SHA1
1c520318275c7b5234edcaec1bb88780108c7969

SHA256
fee0599328148b8df429851ec2f6953b54d26474ae2517f145ee67b637bf0368

SHA512
da2277c65ff0e3cd0a790c0beb05009b73260dd871e826b110c2798745751859ca6035c6418b2d275be51c6ca9e90650f2473731c6117c3a72320821c30241b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1804.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A00.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit