b3c59d6601b512779b29f11f7e464f2cca081e9f0251eb5584532de97d7eae73

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d37df64506d561a59ea65e55a42c8029.html
Size

2KB
MD5

d37df64506d561a59ea65e55a42c8029
SHA1

476a22ac55777b95c82e5fc923842290b88abd1c
SHA256

b3c59d6601b512779b29f11f7e464f2cca081e9f0251eb5584532de97d7eae73
SHA512

3c3995116391b208e50f1637410b0e48d547ca3d46e655357a22e0d4bf460e401b90b2dda2870f61c18e8bcee44486a3f27c58fe3593eb95fdff1e5c4fdb4290

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000c033fe1165227fab041861436a5ed9d81bdc967dd80b074d2e8bf4be8f043af2000000000e800000000200002000000042407be4f2f85749b5c171c0bd5d944c46539a76c83bf72c2d017902507c391a90000000e3df54a147d29f70e95bcfa3027d70c6f998cdbd1d05cc3980f4a772370f428a3b144d24afae1d4532b8de938820326aebd9235f756dcbaedee622e10d3a0f71d321a3239da92c5dc4af1f22b69b5acc11cebac4de52eedf12e897661e58619bcc7727f43a4c5a93a0bf69d176856fac8eacc113857cf39f04eb04581926fcebe62bc8a02abc8e72c60bcdb0c412ca6240000000ffae6f5aefc42699bc9ea0e76bf08f2f2801159beb263185d7638fea989210e194f1b43a3900f4e3bafc22353167de50006d16d56182bb06ea5ed28ebd54b82e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000974628a78649c0b22c5d3361dcb85bb37301420c3a4225f8d028920705b557c9000000000e800000000200002000000068a7f46e8ef6b3942a4408871705e9998bdccfae19ec51b2b0a85dbe86903ace200000007c361ec788bd78d7670e20204d0550343bf15cdd873881a3c8635e04f2fa478d40000000063c2a1ccead1294b387b2ac78745baf27b8e1c7179fe2ccf91b4ca83d78e63976f0b67aedba007098ca1c715c6f17e42381db295aac1db37b10db8129a3d8b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416926263"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD93EFD1-E521-11EE-BB20-6EAD7206CC74} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10606ea22e79da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2632	2708	iexplore.exe	28
PID 2708 wrote to memory of 2632	2708	iexplore.exe	28
PID 2708 wrote to memory of 2632	2708	iexplore.exe	28
PID 2708 wrote to memory of 2632	2708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d37df64506d561a59ea65e55a42c8029.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccc8f05af3bf2ee4f12d2747cc4792fe

SHA1
ae291becf3f5caaf5ca774712b6525106db2b53b

SHA256
6d50784dd8b0c5b0dc2f856725e7f034f5a0339e1783d577440fc62c990aa2aa

SHA512
af86bfa278430fb84f7aa754abe7cecca5513bceefc21414aa5baa3da40a18cb2cd8cacfeb633b33d566085937e735f9c8fdb7770d1c17ed6fd525926f6ebf8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a15c4c3b91e11c2e5d59c2c87102d71a

SHA1
34480106f3e567e9e8d5e9c2ba8e14be704f41c9

SHA256
4c888c7b570ba68b0e1c753fde4e6dc81b5996a995f18591844df05cfbe6c103

SHA512
8737f3e41d2ef1d419222ebeccf26ffa78a659232a4c20dc971a0a2e8409b03cfa85f4b773befa61a22f6b15c9dbbf1ba97d8b851279f55fbf90c24f792944e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d420b1fd8bf48ac23ce0985c04608c0e

SHA1
6f45486cd9ce044bf08ebd8603b471561fca0908

SHA256
f51ad8ac35851405864b6f0acbfef74c0b8c5d86ccce447c27a76a4fbc6eb402

SHA512
1c4ed757bd496de8c97e0f3513d977998881308fa09d29103080decd3451331c075df09f8c24f46480c174738b8b20fa1873d31b80c541586358fa9979282caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b558e604e9ee4c3eadd2243288c4676

SHA1
5e97346d91f48b8283969cb8a19701a530b06f5d

SHA256
d8875c1173a71b3c920c0b2c49572e443db58401b24a69c6decc4294170a807d

SHA512
686dd76adc8d124ebde489d7de278cdb7c48bd1ccc944b12fe622d80bda6764b6fc7cfe6867c0536cc7c91fb21941f09207efa3765e432715f1899bd14aea5f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5bdabd90661e5983a107ad152dd4b20

SHA1
ee3f9948bbc7e336180907f39dcc307cb580afd3

SHA256
4fcef02ccb9775a307a9abb1d10a96d25e9b48cf49975df4795d0f27003f1c38

SHA512
ee21c341b279244965c30ab7d461c3953f8e5e3149ff1d4be251f1657462eed2be7436e759a7b61be131aba2b7b49e489bee12d571f4b101d0530b8f76d42177

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EC4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64C6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit