99b94d86019a3f35247dc1d1007b22be910e5c1699d6b10423b2531b8b7f5ffc

Analysis

max time kernel
140s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3768d9b1170027219797c92a4ffb67d.html
Size

20KB
MD5

d3768d9b1170027219797c92a4ffb67d
SHA1

2866199160eee9724dc5e88480e1af929a718262
SHA256

99b94d86019a3f35247dc1d1007b22be910e5c1699d6b10423b2531b8b7f5ffc
SHA512

1843d48fa0139b1b42a417dbd3775d5c987d1cbe6ce7baedb7895242daf30b94e3343199ba3e614206da4c26fd39a865b5263ffb90d4a573ba540b79b2ed340c
SSDEEP

384:cWvlIcGtcl4JWuqGTHU/55uO6kPtSn6Z8i7bo/gR96guLZ:L+Wqm8i7bmgn6xLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB03B7D1-E51F-11EE-A54A-FA8378BF1C4A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416925364"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3032	2216	iexplore.exe	28
PID 2216 wrote to memory of 3032	2216	iexplore.exe	28
PID 2216 wrote to memory of 3032	2216	iexplore.exe	28
PID 2216 wrote to memory of 3032	2216	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d3768d9b1170027219797c92a4ffb67d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
919799303a3b2c64860de36cface4702

SHA1
85ca596ae1833bf0cd859d998084926d3900d4cc

SHA256
ade4a7999d8b9c91a05f6ac876b6335f55981db167f57787415eaf8bb4ac7c23

SHA512
582fbfb03079727d254c2debc8f237825d7b1c49d6e0683422af2d3b99712c9b4a9a47eae8c421b450dd0902108afbed07c704cca9c89cffb854dcec510b6951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20d4bbaf043760e53b99de1aa637e9aa

SHA1
782ef9c9d5c69f0e1f7d787725077d4adb0c07c6

SHA256
d43807bc210b63f3b19e07ee961db0719e5397f2e69373300ea203211f26eb41

SHA512
bc84e850a1f2d18c70c7d28a08b2635d4a639b60d1af04efa6db550226ee4e3871c44267248740dddd2498652eb5f2571813908f9760cfea520f3cd8df182ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10aa7242792dae4f940781c220c62c35

SHA1
29c120d5a3961edb6aa59a7250345145b7352483

SHA256
cbf6e8fb203fdbb0061246b4e008f9149bce2f59ad349a6e6244ffd6c8b6bbbd

SHA512
e5739996fc0409543e63dfe40492aabf5c0d619c9fc6ccad7320761aac77abeb5eb8ad9ebaeda64d957f18ab3b4bd5f6bee6b3f75a539ac0b79a4d8224746360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
167fc96f42b5093b88a9451a839f42f0

SHA1
9b701708780d9007fb87a99219496f93f471f91c

SHA256
98c3d2f1f166182bbdb8bdbf1a0e2e43bdbf293e5174d70b175d04da489eb22d

SHA512
4dac2a5acc3ef5087be8971254a1b284b9df3212d22cf589a39a39734dd6d452d27f1568a93f2667eb8730d9299b56a14c60c70ec2d4972ae3d5985ce9393dee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e57d1a8778ed28e2ea1c91d39fcd257d

SHA1
859a56cff507f7f96667cac1096a15f552fbb8fc

SHA256
f18429aed31c56441d711b8e6e1f2acbe774a8bc804e90c949eee5e5e0ea0eec

SHA512
c9bce7bfa5ea244d8b52d9519194ba516b4b833001ba60a7bdfb8fa86751a9d21e4ca13daead5609208928a5b3974105726523963dd3fc17bf973a339d446ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f523586649f003054328fcdb3384962

SHA1
f6968300ab4eed23c5b7e0ef28eb00e8fdf2ba16

SHA256
3effc75aa0b8a48c35ab9292ac4a85474068864a7ba5b43b3ce5861119fc3e4d

SHA512
55fd9806ee6533ca3fbb04dae0452be5a50e982cc18aaec270db1f1583bd6e9a99c51a1d3727259c2bb8eb2bf66b23fca80cf0fa01853c0710e1f4d7243f4256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d6541b3c8ac9f70fceecac19860eb3d

SHA1
5a2ce01f6666be354fc1112cdce2bfd0cf57fffe

SHA256
d2744fafe3f37d4268301a4595a7fb90da8ff4d53a45e1c61f2f6afb98e72dd9

SHA512
56eca37c00c254e1774bdfc1493f96c9cead40c54619ac0a074779161216ea3de98b302b607de190f8f602e2807ba66320b25ccad890583e0f792064b92afe54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4d7903757489873e6d663b2ff140dd9

SHA1
8f1938ce327933f5af655339ad82d65f1b2f2b41

SHA256
5b8b43fd816cf506405a1beed88fd75e5acce7648f75689c87460f4f5b3854cb

SHA512
5097b73c8faccdeacc6277b87233c357c899fa67309cb04d83caed397cf51b9875f283ad75dbdd42e8f149dbd409f9b7580df6e5337536e3a92524b6c6d67fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d003fcd85f8c8b76f79b2c15c9a0f9b

SHA1
5a539ef766c8f2aa6dde31eb3375621b716b451b

SHA256
74b398f28c8ace351eb0c2a797d282cc0ff8a44c77f8657c69be1166cd0b505b

SHA512
2ee9d441969196d8690ac1b9121292b4b0e182e13711b06c4786631f54b7afd2f513e4252752a6004e24f621e4aa3368d5be8a867f710dfb389d49929c2fd912

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab56E7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5808.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit