e08674ca12daf3bc86ede4313864b263c3b5c01fee5de89303d448a8f81b9b1b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d43425c77de43dfeed4b81ceec0be3bd.html
Size

19KB
MD5

d43425c77de43dfeed4b81ceec0be3bd
SHA1

007a435a6f87fcc083fbcfbffb372c5f0448520f
SHA256

e08674ca12daf3bc86ede4313864b263c3b5c01fee5de89303d448a8f81b9b1b
SHA512

f83c4cbf0054f5ff3d70c902c70cc24d0e5421f5ee3cc17a870e9be16d9f8717dac054e569a78679ab10a88b1da0a9f2902c8a75109759fdda042fc6c723ddea
SSDEEP

384:R0iu19Pqb9zhHvrChzG+yeFJ3T5Dv9ri36V5vqSvHhEvdzz:R0icib9zhP6zG+yaJ31Vi36V5iaqzz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7A461C1-E554-11EE-995F-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416948173"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1376	2292	iexplore.exe	28
PID 2292 wrote to memory of 1376	2292	iexplore.exe	28
PID 2292 wrote to memory of 1376	2292	iexplore.exe	28
PID 2292 wrote to memory of 1376	2292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d43425c77de43dfeed4b81ceec0be3bd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2a1b999339ed68664df99ad53abf8bd

SHA1
cfd68152eed71d2e0825c47f574045a188d8c50b

SHA256
8b44a480564f2ebf89d4097446f5cd476701f7afd87e49597f2cdd3aa58c472e

SHA512
4b59fdc2a37349677b0a61bbee038e4daf0551286e7327c1f80bd99bd02a5d7cf1223c454d2bae4445b318022f49fd6643c3e3dac9269ccc4d246a7542e9a14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f408bbb205f5a8e8d19d1993db4c3a28

SHA1
c3498f58789b34de4c07d616c762c49e42559785

SHA256
5969f5670934c77f587e8b5770a30e61593901c25863cac00b7a8783ea9f7c1e

SHA512
91f46cb800f1fec0fbb7286d039d3d14ccf77c1559bdbabbbdbab976c8cda904c69e847b25cd67407571d7b8b465ae4e741b1ab008775229dcbbf131a0f22b2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9641a1ae795d4e1d4cac52d68dd135a6

SHA1
9827a69107ac94ca1ab71c3294016917c8281f5a

SHA256
fc8f6d3b06b92b1bdc617e8db58905a47cc69fa0267d9e77b30f9538404df463

SHA512
5be7a3199301e28a3e1dd1a0e2c3bdc052270eb0e369de73d7d8dc22d227164f79c7b20df883e640f2f7c8a8f3db9bed67bef010af31acc0fbe00c489dc704d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb56ea355a9983d3d12bdde7fb7b7c29

SHA1
78318fe9c6121e74a8c1d43257eedca38931b10a

SHA256
879585e98ace027d68310f6c5e3846f494291814878fd15bc18dab3d0b5df6b5

SHA512
49b7cab733577388810f031452cdb9039e7aee0f08d7ca5d668e8e22d4228cfc74fc2a91c3889c2c4e74349c987395ebaafb31a9da35dc7f1daf798e1161e827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
854269ee94d8a8b73419e9c5700a6f7e

SHA1
468d804e3176e546764e6edc2ea8a529b0ecd1b6

SHA256
f13eb4bcaf6e3c8a9b89719fc6b0b254398fbcaecbbdf2f49ed4c4d0c82261a9

SHA512
4922d37c82c42d7eced43d4d9daec9993a5b9866180c4dd0aedb99eb343cd709aff1917a97d641fbd16825009294799bd97d39546b9656d9e0da826838d7a53e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c6b96ff49092ecabe3e09517c5c8e5a

SHA1
bce29093000e9819495efb06d8bc76679f887c13

SHA256
c7f1178b297c94f05736866fbe749fa7020fd9afd028353d8c277627f4fd4a8d

SHA512
fa8c2fc52782c632d4a7df3944fbaa91365be2e1af43718f29aac91d099771054fb493fdf07d23b41fbed6cda8c3739a4f0c4577f9b175b7eb11a6959df7b162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccbb10ef3969424387b47f5bfd25564c

SHA1
adccd99d5faef35b5ed18282e6a6bec6038d75d1

SHA256
af75673596dce7bd51096b21a11497a46424cea777df2354d51db5704145e943

SHA512
3c7b6288f3bfd2c5cd22513104279e4784abedfe4cc36d9a878b6b775ec1f6ac8c78b8313b8713adb895d22d35feb5e891f61aaa6eb3f83aa7f28ecc85a84014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
657732129c10edbf21369fe152891e88

SHA1
e5958b57633774ba95d774bb4706284cb631665f

SHA256
d1303889c02c6f3e27e8b551b0e35e1b4022b122ea2da081f31d6c94ea9320dd

SHA512
8032412e668e4156088abe0b15aba34ca22b88dee55cd42c396f1a13b55de8bc04a00bd79a6d26da871917f8d174343c0da9f3d49067e8372ad026eedd2a0fd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80110db1a6395b945edce7c1e99df5bf

SHA1
32c4eed086b5b14523b8ba25704a0ae9781cf1c0

SHA256
e462b62c842a7664405401d23d554e93b7f35b1ede2fe1eff5e20ae58b9f50a0

SHA512
d48a74a2697d2eb11bbf55bcb667492759364519594fe1b5ef4d04c59bcec1e7929f62f6aa34bae6c7c108d4b6c3cfa20cef0bceaa1516c8f7c58907d2ad185e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a7be763bfa22fae3f5dd707d9328c06

SHA1
8b525aad55ae55871ed0e5e9dc9ffc223598a587

SHA256
86e9bf96cdd819d7b6fb0f394cac4709d04039696abdeccc374eea183a66099c

SHA512
2bc21e7a1ccf5c0673ad03916e5531ddc14a1440ec6f5205573d0d541693fa076b2003a04af9b55035d3a597a5ec8d5d29274244a22f7bb731ab7ed7716ebeab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8b041925d076bd44a25702cdacc71a8

SHA1
6338b7f0152e888068dfbe10f6d153a455812203

SHA256
9f2067d5f3d98c92b7b94dac47db8a586fe6f933cf8012d9ee1a548bf628d280

SHA512
ca28be5b95414b8fe2fa568d11ff01fde3e9dfa2dad402ba85477f39749c08a8edc1e21d69e53a20ed78d0140bb837cb4359c5be93f3cd0f9b0740abd281bfe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1870.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19B1.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit