6cbc257d37155e56b185b6d9610f93eb8cecc43668bb4483b70c8a3ccb4ad970

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d375d0d849fa8793e90680f7785bc614.html
Size

1KB
MD5

d375d0d849fa8793e90680f7785bc614
SHA1

617a7b818b6a1165dd48495fa4951e956b46d356
SHA256

6cbc257d37155e56b185b6d9610f93eb8cecc43668bb4483b70c8a3ccb4ad970
SHA512

2016964b7334f68429f1f77d09066c9722deb2033c36179ba62a2366240f3980cbdd52f79b046fd2739829ccaf8d43816e775759b0507c87d227726f28bf5ea5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416925287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D84CE71-E51F-11EE-9555-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f70000000002000000000010660000000100002000000081131c6eeec4086aa0bff3af3a8e80a394ef127470801038185d181af1a064b6000000000e800000000200002000000066efa0116b8d6da83d8cd956f90a1ae0bca4f8c7e3ab0a93bacd263fbf288bcb2000000049b9b2395698d4c6486c83c499699a7f40184888dfe52661eb6718c65b980db040000000f60a0963d607faf9db2f991276be655644de77cb50e53ca32a72e257ff09b408096c388b3c0c2da84f0f8175ca65640833ff856b1b4c378f78b5340ad4e88af8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e031c8622c79da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000ec688b3397fcf95c1d517f7563d01c6301487b1a3eeecfded0cae98497bc41a4000000000e80000000020000200000009c942edfa7bd552b2b1a3683a8743eae3e6556c48ab3e33f8ac19299ea60d8ab90000000aea59f158560fd23d81fd3348aeaa80f01449a0426098d15a7455352a420c2eb49d2bc1b809c70a55a4cbe6f1af3f17dc656035321ad1988bb6638b0e80b8d9d8a0a19d2856999380cf4479753c2be6a52b6bc72070930636fce5728e4228a7f65d634cbde4543d93df6cac4c1c42180bf5ab773c0e7f8a48a7d629211ae9dc008a9575a2c039bb2f72bbc36846e5699400000000c47e97a597bc4eb15a9b0b1cb787dcea731fe33fe24bc22794fc8d0b43dd653d9c51ee106604464ddf24f6d803d5c8504718bb6b971b9c06f67f2ab44b979fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2516	2960	iexplore.exe	28
PID 2960 wrote to memory of 2516	2960	iexplore.exe	28
PID 2960 wrote to memory of 2516	2960	iexplore.exe	28
PID 2960 wrote to memory of 2516	2960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d375d0d849fa8793e90680f7785bc614.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef2fa33519adbbd2a234487a31844644

SHA1
ddca571e4541fb29af345e009ca397d870fefb51

SHA256
e856891639a7f98020da8c4fd13bc19c3db6afdc8e715b6d565347a66157a38e

SHA512
e1d458d440a25fb935ef5c1ff5bbf5a78dfa734acc3a97b6cbc4c044ba2acc9b65ebeca296327537ef65b689ea625fdb549ee65a36a2e8e2958238bc0569465c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b505acf398dc484a159641869faecb18

SHA1
8dad073fc602636e5b99074332fafa90d69bbcfd

SHA256
c4421278c9883f02b3e42cccfcba31f0098a6ea7885650c91a2b3b344be63e1c

SHA512
a0bccac5bc41c1fddf1641c7f9524cde082b5aef97871d2bfbd50817ac1bd0dab9b0c1bd8cf6ef2869366affc0af7a1d692ac83c9eaf52d659312811c1dd1d76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
841ee911042822027add3c047bc99b1a

SHA1
f45044fefd7830e15cd99f485b46380d3e4b9025

SHA256
be64ac532e7870610a5480af65da75d0dbdccd53cc40faeb7c939b16a30f6490

SHA512
2b55bb749624d47f290da5b1af7ff33298ea73880b71b9a45711bb58670e3d39d161b8f38894b025b6ee185378dede4b710f9a3de748dee3e6a809bd3cd5c79d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcde97cf90859705afddc0b9f2326890

SHA1
e84c53fe4e497814b3b8b0b5b4301e2d9f76d801

SHA256
0278a357ef10f65ce7f963e370dc1f37356946fe0cf7566c24b4ed507acb0738

SHA512
7d7cee5b00fb9625c9dc29c7bde27896d1fd401bc0dd57fdb1cd3387d4d440606bb3a3685b5d467461bd7cf642e16c9e46982d9a6417b3112163d86bea37c0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05c3386dd7e6b96626202ecbaceb6843

SHA1
11a14cc93f5cdc4e5a12eac7ac305d7b50fdaca4

SHA256
da655202a2525b1b483a04f0821f49d4184459e7e0e74eebe02da05723e0d874

SHA512
9e8749bc5b22df0a9228d0bfc9a8f1c18a8f9023277fb256771bc7be04c8a431962bb575fc6d0776900b0e8e9eaeab33df129ec8238d097afb212dda4768bcd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
162281369c69f1420b50bdff60d24591

SHA1
f5d79e0938c64d8260a7f99d06f45750e01110bd

SHA256
b67f854a43ee5cc4a1e771f1b60d9d1a387908c0ff0653a4b8b57e2de54d00dc

SHA512
91420729b0d6a2e2acadf2ff8806f33e234131b7beb33c864f65f0ea3ac79882fab10cacd63de7cd4f950c669eafb74cde6726bd9bcc7f2e61a4db80c7ec8a98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb91bdae864a6a9b8596dff68d4a2c5

SHA1
56b65fcd13c255850806f4c5544f63775eda48c6

SHA256
618f7c8da06c4e54cdbdf2198ea994d7f63ea50b40535ea399c6211d22ec1d75

SHA512
71ce6502a29e5501d31d3b97e5e5b07cb0ea4ffeda98b5b1ee9591a4dc3751e8c8f05ba4a61fa9e8629b45b57ba8da44b21acef79482d758558534e47af8c01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96396f324c2519a640b320a20f2c59bb

SHA1
fbbbe933b936cccfc6370b58b43b3b21fe7112cf

SHA256
5f55b0a55de675869e54a7e9c62e7950c553bad327ffd86d54622ca74b838fe1

SHA512
65e04470e06aeef9f3f2dd16d8a48fcaab952d3ce3647cd572ffa9214e4fcd9235b2d6c503b51a8a68346012edcbb37b4ee80b073a39853e0165a66997571d8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d573d629963f7151c1ab604742dcfb

SHA1
a825c7d40501709460dbabcd7ae41bfde0409bb5

SHA256
8390452b8cc40960553ff750ce50491e4947438a7f4ed1a9c009eb4d61b10667

SHA512
70dfaa6b0b5212a23de0737f309d99fdf5d2e3e7af26b2c1c9ec1e4cf34801e93f6ff607f7ee683fd7e0f8960f0b5cfceb7192c16ebb3aea29224c1643e45ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
477d268738831825f7d9038e28d70d9f

SHA1
5cd10ff34f65dfdf19ca0dad8f21aea96b8570c5

SHA256
640b0cf1871c9f436ed3b497df431ca94d00c2b33866ef71bff341242ce533b1

SHA512
ea2dc0e67cbadad9dbb425a84638c0fdb4dc1becbbfabd24b891d7ec503677a4e1f4bc8052cd7ff20fbf2cd69464ddc20720e74b96b11d82384c39faa0d57a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1e9e60e8d64770ea0a4b91e446d0e03

SHA1
7df28d7177ab1b5a693f767a55e6ba96aa62eb13

SHA256
1ed9173424a9e15cd087a1f86b43e19184506eaa236ea9bb9a615687b9ec72bf

SHA512
b0394b6765ff3202f74a9d055461d753c9679cac6a8d90e8d4845add280bd107cf7ae6f122963ea63f5abb28fbb48e64cdd76b6262a3e8d496b1bdb4320eb385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
138ead9b9690309f8748de2abe29fa38

SHA1
ba3884f149dfc4582f9542d53bd7f2abff641028

SHA256
5d4f07235e29e0416c6a07342feefe6b6a905fff13e7faba4193740baf7bce7d

SHA512
0780019c1bf49688508ef8d84f472334891db558b0d0f5b35adb849f01b3febd2a48551cfb7a45d6ab7e19c48f9c9ae7dc21e9e5d2540e9558ff54fde6596ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0179db69f039ad925032cffcdcb61a65

SHA1
c60ad393ef8dc737a2ea3ac327b1f0260a7ff38d

SHA256
bea7183f23ce0e6fcaebf01a463738cc854d31b3af177f1f055ef3e34410ccdd

SHA512
a45c1a64557c24d8684e1f945994ead00b8311f6c0a7a7bcb5112e0177e77127eec40f538d7b37dcadf0a7714ce3f7d5e664d14ff00ae4f3917784840bf7825f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8083647c9f667912afffa53cb57f38b4

SHA1
b6f05d5bcb0c6001757dc4ea6d259d88a9f8ceed

SHA256
6e44d861599f2f2a5d8e48cf8710a35131470514ccc457d6bb2b10372fe8c012

SHA512
75869a7873b03f29cfc8c3df6a641cc6e13f5ca795e5c57b37d7fb3da73a3b89d82c6d08b5d3cb558e62c853e87c624c77002b14035c30e31340e14d8cde284b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AA6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit