710cdffb4cbb1f9a46c8040af0adf69184b0497261e31389d603367cead990b5

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdbbe18322826e537ad2226e969ee2e7.html
Size

1KB
MD5

cdbbe18322826e537ad2226e969ee2e7
SHA1

8cd4973ab431bd1ac0477d9d199829c2065e098d
SHA256

710cdffb4cbb1f9a46c8040af0adf69184b0497261e31389d603367cead990b5
SHA512

2feaa2ee768427bef47ae98da6ff1fb95b3c76d2d02eefdba0cd0a7511c210b13d1c8229ed7b44e21a17e93efe79e2e193fd8320f6e53b486034add5bd15d979

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ea1d30a6f95ea75ada4973b16f54e7184d884d9c0eb07e91524c610844f0bde0000000000e80000000020000200000006950b3ce0fba31d55d2935f5e07934c4ea77e79d1534d41bc6479a24dd3a61e5200000002322a2bd9bce0d6b2df99ceedfdb3d3873f46ea0126735675b8934dcefa05d9740000000d4cffe89632de1ef05d34668fd70d958bb3f8d3b4bcb2faa3740b6e365565e60e02cbe7d1cf3a393a03606baa9913975e1e28e9d69e7a17bb13d86dad8758291	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAB66731-E379-11EE-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000de59639c9c8499a2aed576a294aa907c6b8ebbc1292050b69685e47aae728797000000000e800000000200002000000084e0878fe3486b6259bce52fe6fca4f0a2fea957ae1cae8c828d604d50d13a6590000000431ff3ce0d7d712ee62b29924a1a867a0672fcb6bdffe15eae6192f0d0da3846b5dc74451b0542f2123284f20ccfd88225ceb6c80ac6d297c738f3f05de143c67b39bc3833571397be6abaf905a39fdc4ffe330a2ce72535d50d7820d6fe34eea0402aa1cd0d923938d9c31fdfc5ad4eac2ae4b92088975e314cf5beddb0bbb62f646c07630ddf18482c70877dfd804540000000392da41003a81867e1b31501c5d093073b1274c4cba74402127e2d8621a87f555a102d735f03f6d640ce102e6184d41e1d5897d89e1a001bb6730d0c151800e0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416744223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d709be8677da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2528	2184	iexplore.exe	28
PID 2184 wrote to memory of 2528	2184	iexplore.exe	28
PID 2184 wrote to memory of 2528	2184	iexplore.exe	28
PID 2184 wrote to memory of 2528	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cdbbe18322826e537ad2226e969ee2e7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21a8fd514c6bedf8690c7f207dbb2eac

SHA1
25be86b5d666622b71916ed5b695f5448484272e

SHA256
fe1e5166a3cf75bb68d051ecdfd41d37d9e76880544349b9acab5d04943f29f2

SHA512
02fe8486d9b88d90aea61e74a1e5422f4e7fdd2b9867f58d41c3d59615a631bf7771d1d8e068d8e8d7073bcd9b8cff6ea1dc8e3bfd1170c4dbb6237142c81fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eabe27c5295395fbe0219349c4ce79b6

SHA1
ba98bb2a5c046c8cf9b183f0dc2a9cea3e561afc

SHA256
e05e2a0fc145a145f4a35a21bb0db61f7a2bd193aac06faf03cd5cca692063d9

SHA512
286aa8c76d6e7128ac996116db34d005162a80a92c20eb3cd5da4d41a66bc04cbbbfe348f184d20eb18a8c71a21e38c89ce46b00131df19dff4b4e45451c85ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52828cf205316fc9f2bbfb8c3fc2d216

SHA1
71cb7dae57127a11c85bad4b15383cad4a5e6329

SHA256
1309ebab7f7e86865783da52cee2b0ef4079da5cd30fd9e7e5fbf50df73a5a5e

SHA512
b8c21227ccedafe3f74dc8cb02c368dd09b86c48cd308a702449bfe58640a0d0a0e212c482e054ec1cf0958371ee8c099337bdc4249e272d1b5762165d597334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45e1d1abc9767be56e224fb99d954175

SHA1
b387032eca4ee20a67555b33df36fabfadab7efe

SHA256
abad6e1e64727cc79031316468c8cdac3c74876ed53629145a32cd8456aede93

SHA512
580a301e26e7725e220c99072d8ff5803c2099c28386ac5eda881ef84f6d83eeeba8cecaa9d0a7e983982298eddfcacdaf624db978a75082b374ba9d3f7c3a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0634aa54dc29a9f950af34825ccca59f

SHA1
4670949ae93c2f6aa6ff9b9fc972cb1176788fa8

SHA256
151c1b1a93aa1642e81681463e650ee6a4538a5e97cab7796617e7c1921b92b1

SHA512
30c0c65fca784a868f9303c468019444ec562f20a0dd380df9d9c8ba6df8bed0549ee6702a2f45c6764e8875e23e21cc6c12364de409831e76ddc011848247b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39620bfd84fbb5f8a7d840b8bb3bc85b

SHA1
a9c851f3a652847b2522f3c152535b4991c91022

SHA256
cfc0945320238e88018fc60516c0370ffa6ec6afd5ff4a2174aaf96f8fceaddf

SHA512
5fd41431e217f236132a279e6a7bef2e364b37fb16ef28ac1512f3800119e7c18a11045e2042cd0787afea2ccbfe3fa0c5c304874e1f8de35f586d22a5513755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2394b2ff7d70137634fb1f2b9a00a07f

SHA1
cb28899f2db2c03a6e61dcc4308fc7e07f87d1ac

SHA256
f47178ca4b58adea87e9b4bcb160d7cb1d52cb5ce0b7137af7cb7cf0e2f6fe5f

SHA512
6cf3615079b584e346417a7713f335a12885078ddecc0e7cedfa4f04e61e471d1a3023d34d06d90aa45b53cff4c4c54c5b273d405a909a415980afad1ee139f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1043487f4bd83759c5d24eff8e8d743d

SHA1
ec56c2e8084a0ca06509c21ae5b942763d93385e

SHA256
22c5881e71f9a3b31a5298f68ff65a4f98811a91c45fe408db16616200b9927b

SHA512
2b0cdaef320dc707b6a2bd777d05e7bb5b937a3b61b35a79b9d9786efdf4ce93679264eac6c1daaf2ce6560ea0bbf81384d65f6bd6b457f424e59afbd3091bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7706705cab9794cdf3f218f06f0bba5

SHA1
39a7474fc83d4ff5b53a38b875947c7491849065

SHA256
d3655ad8725b84fa159fd273ddfc50a0e3c2b2f6bd90fe8d5ae5a996472987aa

SHA512
c5b69c8e8b68c20001311a950b7f8fec1a0e7a53401debd1dd49658d09a5c6a9179972a72899d77d05f4eb2bc866a7972922c72101e56a6a0b6ce2aee9d4fe1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7dcd815108184f0fa804a3df0ba006c

SHA1
db844ff91682540749d452b9d491050b525392f3

SHA256
5e74b577c388ed117dc7811b0d12aada123fdc41eca182c585e06a5db7f3bfa4

SHA512
419f33249afdc157de006f9b88fc11c8d638d08335633376e611917c64e500e69d81511a6baff999ed59e70e11a63fa9bc0249c800e763691220ef190164c74b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e4f5745f042709cde519f70e40b79d

SHA1
39e9db2545f689081b348d0aea5712e6e2215a2f

SHA256
a3055899a0361574e031d7b222ce5562ae75fbac86eabb26bf2d046ad5279580

SHA512
dbd76b6a0473f20d166d242d38eca65e17e6f230f0e702251d5c929d252895080b9406d3cd945c4eaa4d9f93f0d5a436914c8c58113ed6a2b220808c322d40bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
520a292a347deeea215832ea00fc0383

SHA1
2fc461dc2619a59cfc0702cc82393ba2c23e6d44

SHA256
6c16632a07b23079dd1c484d2f49b0335998b4f022f3df645044ef3e8869703b

SHA512
a573d4d8dc898fe6a0a3bd1b090da3ae5e9ce7925a7f90103d7002297c6d3bbc025c90178b23d4fb0e44080c40fd32f33f74549e639e8f6f61318dc48f2330f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da105bc86f275569052730a645fb443

SHA1
e2d46f3d2bee5503b536090ad0ac9fe65588f026

SHA256
509fb1241de1dcc555f3785483ea0cfb2793a7024dcd8008e82b308df048aac2

SHA512
9ce976a83ead975ea9bcaccfb4df0743d7ec5bedcbafb784a7611fc2cbe42a018b78f4958b323c3a2a0bce1fbb6ba8c56d289d64ce2e8a9d73a4b5ec0ff8ffa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8eacc12b6d5d01dca9c0c0e7eee8e7e

SHA1
ce1cdb0718ac23556699659f5aaa3e2257586338

SHA256
895629249eecdc484749e14cd6c0c331c1124bcec2a8293e6e4c89bd62ffd0d9

SHA512
d4543808d37da7a5249aa80679b57c4e03f367e670480971e57d1673323539c8a9765d4ee2f179a1c8c8037d135a4d754ff10901e746b454fb0deaa90e7899da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e919403b1ab3761a93b561688b443af

SHA1
055000ea8e7b3d8bb608673dd8ce0cd8f1a42f0f

SHA256
37b9d7cd2544ccf1980a95b604e0296e2f920bf86429d5b552b1b7355d2cf9d2

SHA512
38ae852053c96e41a887dcb2918dec36b134054c12ac4914f385fd3a2b857a5493b515c2425b48dae7ce82ab944aea611a2a442fd7384c29cec444af24641ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA25F.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit