1216528aea84ec59284133b11d6f2e19667cb67705da448f69395281d634019f

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4007c0699b4e3ce554081dfe5df17a8.html
Size

73KB
MD5

d4007c0699b4e3ce554081dfe5df17a8
SHA1

37db5ab6026474c3d965dac1a23c682a943a377e
SHA256

1216528aea84ec59284133b11d6f2e19667cb67705da448f69395281d634019f
SHA512

851f8f0d4cac5504225602880246d82b3ac97eb42c4e0f6dd166f87e5e24ca97081e51e6dfcb2297306a00d60b93be293e3ad194bd3b2228094a5b1cbc1e5036
SSDEEP

1536:/OT2ll2TFnKRaxkXyUAC0gwWJilUPU4U3UMUvUdMUewivV/cHQGtBkQPNL4ckmP/:SU4nKR6+y/GJU6j0PSzLwivV/oQGjkQL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ac661f5379da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416941926"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002bc2a0f8ff08adc87a4e09b9c3594175e927733e0a4f889841aa0edfb222172d000000000e800000000200002000000031c3b5454a431faeb03bbc393f7b98d66defb6b269a963bac57ed1098ea6a70690000000e0a64cc07e3dd4dc41d8c35fc9e2c9581d6be6c089797a9a3ac97bc26edd314d952fafb712bdd302b702498715c926c0bb4e4d84e4883b7c6f2ab13a8ffc631628580b00180a423bdab00bc42aab4cc63d51c54dc552a5c6fa3e466ea94c34bce597efd426630773f426484110294d7de8bdf0e38edabc129df75b057f583c7a848e400febb8323db801245e9f033439400000004dfd528858263a679ca2a5ffbf7eff69188ac46cc9f8eeff1141e7b06ae7616762107cf2e5baf5e9df06c287ec9134343e8f503970db55b98d64116c05f4be0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c53456287f7f83440a8ed0179cf6b812f210a8d4263dfbed31a3d9eff4d1c0a6000000000e80000000020000200000003c0d3a409f97f359997a7d88780dab1b0c26bcda2a4bcf8a8decd6e2604511f520000000bb9bb85d579e7585a924ffbd933438e74e86b971d595627fec4ba553a5ff917f400000009730467e0ccdd34cfd1408ac679f9d4183f97ed6cd8de687bcacc7988974e684299e4b3d15d10f29963290a15b8914c9d0db47ae76e9eb4e25818594489c4b22	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41AFD591-E546-11EE-8D50-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1776	iexplore.exe
1776	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2356	1776	iexplore.exe	30
PID 1776 wrote to memory of 2356	1776	iexplore.exe	30
PID 1776 wrote to memory of 2356	1776	iexplore.exe	30
PID 1776 wrote to memory of 2356	1776	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d4007c0699b4e3ce554081dfe5df17a8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22f0edece53c3fbd580bfd222fe5a3bf

SHA1
ea283a5996d0a6538a758f272497c2de664b5637

SHA256
1a60393575c62de24ae99d42bb88b4b7c33ab1f8f72abd3e6c22e22e15188a20

SHA512
5309ce82395601cf73ddf38ef6b2644345a48b595b613dffc93f25c7cd534d5a3439b34547fb49341ac7059979c86e6eb912b1ac01041339df3b39b19da96107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb32d27aedc849b14715a5b23ea7366d

SHA1
60aa1caaeb3669a47878b68e6f5caac3670c36ba

SHA256
a6e07bc22e8540c447b6b246198ce1be21f86b7aec0acfb6ec9e780aff208e88

SHA512
dbe79ddb0440d34162dbf63a44a41035682f007d03f6c6c275fa0bf107f135759ac7490f86761b833e901e8f4243c8404bea212698b4479a835f908d12914044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdedb317d61696349f3bd656d9d537b2

SHA1
e606e367585679437a2fd00530493370933ae3d6

SHA256
783d182b54fabdc6f83e16a140e9eefb02c8355b4c28f98c63f0ba9b8286f097

SHA512
1a2bf2226f16391bd4d50fc8e9b8e63a0dfaa8c8e384d1a3c4411a263eb23ee6e8b64ec3de419a6e04d70da4ef641de590a996d577723972984ba190a229efce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e4fe368a7273672d94a4762d61136f

SHA1
623f2adbd4f2c38d2fe4a5a9ec84356ef6716a21

SHA256
8e09f7c56f7eb182efdafe890fb2760bcebd9e904b1cd0075b8491fbaa87877b

SHA512
954c0b7645af7411ac91b44a654254ae475f28cdab496540a0068f6f276d4587722294d1a255305db9da1ad097b742b5f7afdd2743110b8a22968e20d9bf1f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30b2c5e27132f79c7d27093c03850543

SHA1
b5bd875fb9574c69bfc4fc77ae240e20e38cb856

SHA256
b585da54cc76f4e0742450f51c46f4c0b28402cf289eece2e61d05d8e123e6e4

SHA512
f50cd7ad734ed874aff3cefb58e533cf455ea7bfc1850e41e7d47851cf0525d4f2432bd8c3dd4408669d84791072f22ccc9a1366221e13fc16b3bedd0e438e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8373d892c912d15f5b212cdf6e36743

SHA1
48eb78d856bd37327368455c64c0a4992994b9d4

SHA256
31d7c8b7f12871f600e3918514639e4349873217766770a48bdc4b3c60b944a8

SHA512
8bd38c9af94537f7dc359038faf6312f888aa99a82c77b128c5a48074280c4fd2f3eb6408b29aa7bc9af4184fbfa7f08816d667e9e69dd3562e96e170264325d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cae2b268f6d5882cd06aea5e6696ff38

SHA1
45b0f2e3dcacdeb1fc766f611d04d78a142cf5f2

SHA256
e9db147d5c52e7a2cc3492b1daf12b0652c2ea31297669648d522ec0a0e8d9c0

SHA512
00f6f0d81bcb5961c9e01bb4a07cec8ea17ae0cb125712343ad775a85ee8a9652bb8c026e1c8015ed4d74d68bfaa9d6f085d05b0bbd29aa6292203dc6458ebf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a7381d411f5f2efddcc6ff98beea96

SHA1
fe77a4a993d2cec414c1023b92d1c096d20cc68f

SHA256
7a641fbed091198ce953dfcb3ae684f5e092554885dc95f9983fc9c09f3ad57f

SHA512
da75dc21ad954389c60f181e1665c69026cd3af56ceb7cb3d7acca74f64c6a488907bb64b01efec9b537fc3ecc5e481995fbb6f85467178e01385bbd857d6cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02902990cd3196330d1f35735fbedacc

SHA1
11cc133f8a93cc58d6b00a06622614f74c9c2bc6

SHA256
4cc0c2eaa541989eebe3590073c85445a3a458c9cac1d9716e66976623816e73

SHA512
94fdd6e6ec4512266d2dc8e641253326f0ff8eab14100e96a2d80c24fae0c90b93d90511bf054622e98555941b9fa0a7d19c895b0636a18ccfea6a55a6ae8679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9362e5530e9b0f7fcb88b96a2ba6c969

SHA1
c411540b94ec4b542e3e580da6f5168ac5aa0fa6

SHA256
cc8eac1b59a56f57be598aa172ccf454d53ef0cd935c02a0d84d53c981aa3f96

SHA512
044b121d14b748a0f7c1cf3aba0c2e852f5bc5ea7e9242254743a618c5f601a4165facbcc388f6cfd7089fdb7fbb3b4ba47d41ccec8f8c8a357cfe53a836d0fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\cb=gapi[1].js

Filesize
132KB

MD5
c23494121f5468488a8e79a6268f4648

SHA1
1fc2646c75df1b8528667487997ab1f5b308133b

SHA256
100700c4795780ff97f999795e8477954da09fcb92a1131cd17216203914c425

SHA512
956f396bef9df5a542ae410256686e2259e1ae67402615f937c2f2c004ff2f3de5f5767200661c0ce204fed9b32b1a8707c26a566da1d3aa120d428901c39769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\plusone[2].js

Filesize
54KB

MD5
12943d28948f357f94df8d2f3bbc449c

SHA1
d41e632976bed475d456b47f9c19b592e7b9ed26

SHA256
02bcf38d5ae60a63e975df2f7dde9b3eee206ca30c45fd7f54157a4ac63ece47

SHA512
38186a9ea421faf19047bfc9a999a0f60d050af7cd876e00ae14ea714719a8a65a6ed4905b55356686f9a52d1b3446246ec24d7fa1b45ae4f6a5656e7f20ff26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\tiin_42[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E37.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7E49.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar817A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit