c20b352ca348823edb6b44a06e0825da57e09c502444588c8405baa6a26ea0bb

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d36e9d69ea37231dbd50f6e323c3fb8f.html
Size

44KB
MD5

d36e9d69ea37231dbd50f6e323c3fb8f
SHA1

b27a97a4607af180f63c85f0f68ab7d163a76138
SHA256

c20b352ca348823edb6b44a06e0825da57e09c502444588c8405baa6a26ea0bb
SHA512

6dda583fe54967fd2008215b4a0ff8a4b8bb4cd5b33c8a12b0c10d7b86a41703ef064acfb77eecfa6f9c54cc8eb065557f3dc8b676c58de23497251beffb4c59
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2olvelgjZLZIcbDk:mZJt/velgjK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000076dc8017d7add4489b46e2229f2e3cfb000000000200000000001066000000010000200000005884848da60b0f45871d7e4a765065f9fcc5e43b7cffebbe3dfe93739815a1e9000000000e8000000002000020000000530fa78e7af8f6f43fb12f6f6299c9206a5891c12b7210ad3c840b6f16933f1f20000000aad5a302f5c78d6b6f6f74807c2490e09756762d2379924ef13f5cf7af7bbd9940000000a75a6944fc5a821a28ac34485a74e49cefa5c7ebc6e84bc2921c86ae6ff0055494fc5a2ede5e6a175d432d925c6811e864f59bb26437ccf2844e4d95e34580c0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104fcb692a79da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416924357"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6309D0C1-E51D-11EE-8A74-66F723737CE2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000076dc8017d7add4489b46e2229f2e3cfb000000000200000000001066000000010000200000002033d2670e7ec848190d69273c68e38c743ecd947cbafbc048aeba8735ca6564000000000e8000000002000020000000c8f76ca2bfd0d4b0b2d9b828b6222d7447a9d37cf65ac178856a92809fe8368590000000e5bf52358d6550fe525b1c86dd737d2456c7b8a7d46c3846d5c24ca44e5fa44ba1eea40691cf1d724dadd66c9ddd1a2a2401da1f830fe5ca1216bb99afd3bd3e80e82341595ab5fcd8d7431861cfe573a4eb75352be7df00a31dd14e9b4124de2483b8550f8c8fcd79e517d76bc737c1bf86dc6698038364e3542427b259c12daa9aa40caa4b9435585a0c505338e7a040000000615553b0ac2d3cb342b70014a570850f65f2b64253d8aa0fd034e58951027e67dc6e730475cb300d32ae92fac263b46be4f12b625ed9ff7a804c44dbfb9164ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2988	1964	iexplore.exe	28
PID 1964 wrote to memory of 2988	1964	iexplore.exe	28
PID 1964 wrote to memory of 2988	1964	iexplore.exe	28
PID 1964 wrote to memory of 2988	1964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d36e9d69ea37231dbd50f6e323c3fb8f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2723d485434bced845b62882063537c0

SHA1
1ba8927cfd66dbbbd37b975779d09cb5685b4b90

SHA256
31c1f852a14bb2a6caa90fa5589a3c2a6783771aa52240c3aa3c48cc4e85f79e

SHA512
0940db4354b4566d1dc54cfd8a9a702da8ec1e641ed4850a455d1cad5da974c69068b5113f79363b05c382383e04001f8ca8f8f313a286432db7f41364ea785f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7892f078c4b767f380940ba1e84fc153

SHA1
2224a828e97fcaa5f7a94ad63f41eba90c3407c7

SHA256
75add9da2c037492b2bae6f0ac87e0d4019cecc039582edb36e77958e550228d

SHA512
07d73fb5619a5a7db635c81e92f59f7a5859ff5fb30117d66c857117d46a1db1be07adc8a97857d75863dd51f6ca3852bb92e2c72f65b2685bd78cf17e6531f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45b72c8db76ea11d571af0e5b9a1c16e

SHA1
0bff4f4bf48910de220a9956ddd14301390aeecf

SHA256
067b19ac391f29a2994949e147cee1438b24925ec8ab189b03e469fbd6f6ac10

SHA512
db9ae2d38c06a68e3854dab1a19869c6a8597982dc864518aa0407be8a9742f909e943443956a7f70300e49dc8915089d8c7ee1017c866eeba0c7821476afb34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e78a8fd67583cf8cb07c52593b3c5526

SHA1
d395005ec9db5460bcb59d3c0c87adb93b169fd8

SHA256
e8def198f3054e0d6043052f20264de4ecac09e04d28eadd68bde22d2dafff20

SHA512
02c540adf8ad6c8633c7a8ec72af9c387873034d37d4c225c9f12809391a351f8c0d8a6b4d361562a37e18d4bd61bf7f2e4a7bdc1c1d766fd1d040ff892125c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d73ec06d84f67bf8d1e830fa4afbdd5

SHA1
a625847d2955ff7dec1d51809636370b5aea5cb5

SHA256
cdd0953126c3bc2906065f50d5fdc7e4cdf561aec178b5c6df82d421abd89561

SHA512
b978608c934d644e9b0295abd546bb45116f0eaa6a56c65b7af6207e1ca51eb12b5a649aa249713467231d3139f7394e871c3e1d29bdbdebd44dd75deb4cf081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e46db80648f32eed420b5fc2fbf5c260

SHA1
c8a9291463fdc5929651e14850f13be8f4689f51

SHA256
08e55a4e46239222813c49bf2b81c9b9c27c1d4e919597d9555767edcf35356a

SHA512
0f1bc9eed3fa68e4ef18a18c7e0237a65e92b56853120b1ff22c4b67dc54ac4110e3011a2de9a26aa2758a45223d73233327c32952fffa68c90c43952f560b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9ff9836b449ad7c4198b7508ca006c8

SHA1
39a507193a6bb579bc0bae1b74e51071e25be421

SHA256
9e7eb6cdf3af4698a7a7c489d2e3dcc0896d1d33de7d0bbb76cc42d6d2e8142d

SHA512
a9946ba7f038532c52807eccae388de49572fa86e87accece43d002f46c490ede8d060369f87352b6ed0805b59695270e6adcc9e957fa3e9cf400070d3b3d0b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5d777922e89eb59cafbb9a65d31f9d9d

SHA1
59aa12e60d8df7a04f5305a8bd7d9447dfada87a

SHA256
6b7a794bbf0f19d243796bba405b2ea361e6ce745da062455b45b90d15d8a32e

SHA512
501291dc4c4f330082964e370d30e554cf6e2fd71a74386e358a1a9d3b90b307f7ccaac0b718b557c30ff70a778156bf93f8fb8884c60e808df04ee37b39d257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d961172f4d3d0325947a5fb6f054dc1c

SHA1
431c29c4a6c91dd998fbc8eebe2d33b606903bf9

SHA256
ec0b4b9d8f7e800aea31fdb1445ce7695225e2f901c789a5d5f7144a523929a9

SHA512
c17b5a128666960d881523814d6be14b11dec642ecb56c70e4b8d6fe554413d382579e3b77a5973935ba8a7fdd80588c1cc3d1696da83e07a4b82bc12c3a5f34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar572.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit