cae7c78c4ef969674bd352fdf364ce0b25fbc5562eb595f83729881acb80eaef

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3d0c502498251845baac81712247aca.html
Size

7KB
MD5

d3d0c502498251845baac81712247aca
SHA1

94359e72a3bc6d5196b6bdb3a87817aac4434b50
SHA256

cae7c78c4ef969674bd352fdf364ce0b25fbc5562eb595f83729881acb80eaef
SHA512

11bedbc57b279167f82fb394289a62e0475586c671fb5697bf91829a64616b87cce6662c6a6609b2dc07401fa39aa0274521ea60e1aee376baaa5c99c8c1bcbd
SSDEEP

192:59sMyzpYjZKByoUzsUhGxiTUFBzmBSFisQOvkT:uqlKVh624

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000077a65c7246ef2549e1960f9a5510c4e520197909579bcf76b8275fbf68417c05000000000e8000000002000020000000abad9c2ac9c208d5d2885874e2e46a24e714d01c43fe8bb000b5f9d997fc91ac900000000f98d5fab894b62f8d1e3b36ec75c9a4a6f98b18d1abdda41ad4a3a2b59558bd1a71236e9b2502f92d92cd00bd623d51958106e735f59d3a1508dc294fe74dd454f9626c042e12d2d0f32a3241617c87ce0f4d2578b0c0966844226176c2d6858446086410130feeb160de28fc8bb950f5f9c6522e5531a07572711c6b759366d880f97c6d76c81408a49a56c564f3944000000082bec7fdcaee64bb4f5fb6a64d735348aeedc99bc38dcfde1c26d977963b8356014ccd3911d58eb2a878fcd9f8e36b37931ab2219326446f3486947e5bd126f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000e6aaa6c4585edf493467e04dbc8333e7c8fad164598663ee1b0bf058d67f8cef000000000e8000000002000020000000aea4878d3d69cd0d2a94f90ed784ddd9390fe0d42973367edd08ca68f8ef179b2000000020b9d2086296fe8695d31bd5016e1885443134feb7d5e36c3453cf46b7993d9d40000000560fdfb3c3c2ce748ca5fde8cd27833ec06b0eef205898e060e11db0e1ab81ef5628c286299c6055e280e8814c063b13dba3976e2c6e92b59b85e5ed5f3ba5d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416936382"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02cf5364679da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{613A6EA1-E539-11EE-8466-6E6327E9C5D7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
300	iexplore.exe
300	iexplore.exe
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 1060	300	iexplore.exe	28
PID 300 wrote to memory of 1060	300	iexplore.exe	28
PID 300 wrote to memory of 1060	300	iexplore.exe	28
PID 300 wrote to memory of 1060	300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d3d0c502498251845baac81712247aca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3365737f96fce0e09718b10b3ab27e3

SHA1
59c1e3eb9afb12fb639531d4725f523abe53223d

SHA256
bb590d4eeef190108d0f0dd3ba4c7f7a139e35ae0947808f6d09cae4ef4c3362

SHA512
2e710963071dd0c9639f33bc70392aed50f98a380a9cd007bad3209782bd1eab26cda7ca2351bea8bc0a257706011bf83586b580b40c8b4aa38ee42c158df17e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d2d9a6d39924bf035ebec33d23da39

SHA1
23c8ab8a4ea3be1c3033a1ea51a31ba117df454e

SHA256
bff659e8625d93af2864b3bdfdfc81e4d4c61dd59f5fa77d22246994f618d750

SHA512
bad94b9157c25537b2b1c898c1e82c8f4d41e8293605a9e2ffcbeb52d0236f09d719690a93b160fcdde2ab2334cd6c986c006e9817f44b7bddb972d0224c1af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1c38f771d5574ece8833241e9c5094f

SHA1
4714adef101f0adbe2cd1f18405d771318cd7ff1

SHA256
d651ee7fd2803060424f021b71bf8ffe1e42ac6b5077f88f355888171c95ca02

SHA512
813b22a17f10ea6e2e0cf3ddd68e737e55f54c52127397b07b1d5f64ce1cc5007e824f8dd2fe4d503985bd1dfb39579a33e9768cb3432a62e34102b474042fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7afb63bae32f5bc4d3488fa93dfdc1

SHA1
d75e575b506b812480cc9d31c67d649c0d6555ba

SHA256
43ac59955d3e281fde935fa0bb4348d3a9c312bbb4fbadf821b406dcf908c7b9

SHA512
a96269c9bfb83925144f55174ffb98926b8f2e506e72eb470e0525a875d5aed4069590ed42ed0a49aa50d7eb5a5451e6bd00b285d8abc6a17952b27daa483ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5a0d393501254c33e2642a23c170aa

SHA1
bca1450a180ae97bdc0a760f6b69d4f566691ee8

SHA256
ae4b5158937c73b7e32845d34a228cee3b2ae7759daed1d109832fc69fb2d8da

SHA512
d3812cd9dfd4c770ea6f00e0e1f90a7532fa2455c2002b23ebb1827829aea73f4797f5b4318f4cd0116c031322d26d0a3b4b805b96e549d05f8fe1a72573ce51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9abcf660cf06f3793d3ae8f6e633ee7f

SHA1
813e7c63dd6246336e0799c068da99c0d34446ec

SHA256
b890ed8208bc6b70e73cd34cb9a87542a7ceb96e471c8611fa7e28119a126eea

SHA512
7d7c1d0a2b7221abc2e86c7ed985ae9db041a9dcc48efd9ac882d6857807cf4c3f37742a18e387db211810cf87d03221fa34d3c33bb2c245c05efcb8c6be2daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1cf901ec779ebbf5bf923e417774f37

SHA1
691664513a233aea55dc6457805df2583600b51b

SHA256
3be85d4654dde8ce43c4aefebb0d29c9054f04adcff6d61030f923bbb5af3a09

SHA512
0ff6ae3c745d495f01b686b8e43b3cd64696fd5b98b2543312323c45b6ceb419b0d3c610ea5dd1d8d11e5cfb000782c270441bf0fd87e48ddae5564562cb89b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c9e73f86a316fc87730d971b1e0db7

SHA1
fb35319305f568966b1daf7ac8e3802201b03f61

SHA256
304900188a318e642876b52149e788b0c087d5f42e7c727abc958592d489e80f

SHA512
346e97e8b71bd2134811ef5e445dd95a4bb727983b57f11dc7cea21b7692b0d772b923e3180d67192c35470e145f7c1b0b00cdd47a64c20466902f68716fb025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ebfb35b6152d4cd8caa09ab14995fc

SHA1
0b697e20890e7f2ab68feda275def982170f491f

SHA256
fb411dfb6d984506b62b35eadd12dbedec8c30e1fcece97387100b833c42f1c8

SHA512
4885c6a3ea473f924626ff0ed854813c524d8c2f74ed98ec569f7664e92c5033cbfab12dff6e3d74e0444315ce5cf3f69e33fb8109d5812e827924b51429c9cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edebd65249f9a06933a7963b01f1ac76

SHA1
d4792b93cfc77dafefcc4a801cd2f1ccaa868935

SHA256
a095ee30cc77395d6d667ff8472eaf66f85be81cf6b560f09de9db70f79c77a3

SHA512
f5c3dae11aeaa7b8ad232b25344415cc745432cc487dc83a41fc4086a395483a978a20ab26a3dd246cba33dc1b589eee39d41f1dabb999c2784e4e31f0c9d1de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86DD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A5F.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit