ce679bf512a0e54883d7f231f1df99bace003a3eb4667bb04dad7fa79c420d94

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d44276fbe82508a92ebfefa9688582cf.html
Size

67KB
MD5

d44276fbe82508a92ebfefa9688582cf
SHA1

010f6ff7169f1fac3a57f98abb8f63f997084b32
SHA256

ce679bf512a0e54883d7f231f1df99bace003a3eb4667bb04dad7fa79c420d94
SHA512

c7a0b18651a52910cf07e62968973194b8e822e23c7a7505a3802353c7e0e91476b7bbeb6ef93862777801321cea90bced0d1d4e40f63bf32e752c14f9f41f80
SSDEEP

1536:b0iOYcI8BW/+v3+0U+v5ikHMiOgOhEMOB:b0iOYcFBWwMOB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A76244B1-E558-11EE-8DE7-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416949813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009084d0a4433843b5cf91ed39dabef5ea80425d3cf3dc080a71220f9f447ba032000000000e8000000002000020000000a2d4d196b5acbb03030aa12965f1a41acb7143ec02cd22432e6860406b6984f820000000ed7da6e203c68c23f71d5b635a97b5e4ecf9a4241cfe0e2d4aa1326b8bf273bc400000006c5486ca021b43b29b419b55e11673197cc09a6e5980021eac5b8b4032bf58ff9104e41cd17d7f577d05a90700b7c4e496be2dbb9a42dae2d708699d780e9b41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000004ef4e61e8d706c22c63723a7da32446297a83a4f6d915bfbe684b893fd6d96b6000000000e8000000002000020000000bc953ceda242c1db78793f873f8d52d13e9ef177363ad0f40b51c1bd0937c79f90000000585425d0c2244b58cdef111b5bf1da9499b50bce8328e00a7dbcdacd30be6411a4bf04377932f463c3adc7ef58cc0525abe48dda67cc23561735a4733c2bcc2d5925076e30fa37034100c93ffb1a638f67abbdb3b7d4514c7ea67646dfc34e0e8a3476c0c9c8073a058bbf4ebfa6fc652e823462ea5f71c357b96121e9f57dd9b2c9a8d5d1c63d6b0f7f8a57cc6a0a12400000007a2f12a6397ae643079935386c7e38ef2f2154de608da81567eed6b6418a72697419877d15463f3be92404d67d47078b953b7fd73ab551c04093bc1de59ee11c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02c8d7e6579da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2476	2184	iexplore.exe	28
PID 2184 wrote to memory of 2476	2184	iexplore.exe	28
PID 2184 wrote to memory of 2476	2184	iexplore.exe	28
PID 2184 wrote to memory of 2476	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d44276fbe82508a92ebfefa9688582cf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce190fbcd7678850c3b4a0cbfd53a35a

SHA1
144ccfd709282b9ef9ebe60eca7442c7a2b243bf

SHA256
b55fd7eb7e42f22bc62ac33f968124a27d14fae0c1b9651dc0a6a6b8ae3b6135

SHA512
098f4a71bc08809c9d37d5a01576c1f07c4469769c04e1ff98aa5752466d4d24bb465d9a7473409f1f1d3eba4400c36e3938867b282aab7ad3dd1bd0206deb72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c3b51b1848435d2168e11616dab130e

SHA1
5c8c2101e827f93fb08ef20dc17750c585a79f19

SHA256
4ab3dc853464c124ae3458eeb4f90acd56b44fdebd1909208b0f986c413f00cd

SHA512
ad1fa936334a8ee8bdb6c84d99c9ba244a8e43982b9430c6c0b574914bc13b9fcc45c61a1e7bf1902a5ea8c5ccb0843b8ad3cd37e3bacbe792871fec6823046e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7e4ac44daa081c5c68ccd47c10ffa2a9

SHA1
6c0c6a03530bdf92ace9a872ca45860a6e02ca59

SHA256
1bc41f0002a7c723bbe4aae2f8f3e61416fd35a9c0690f77f771cf55e42219fa

SHA512
342561b9fee0a25551a75a217be467bd5ebf651a8dc4002cbf25cca7456c550289c465d47254c6d366527001ae8230efb811ef937087db27d28fa2e938b0634f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0b15607f2595e8df1af95616332ecf55

SHA1
db69340570fdee72983fc1cde546925d0589f1a6

SHA256
454c7b532c8dc8ba4243298e0240eb374ea2fbaf72f19aaa8f53194501ce7024

SHA512
1d4e6773b41c5221b109e5365e2d7329d5b43e8fe6c19835b6b2de3af01d4328ffe08d30477de243ac6c20ee22baec1a718964c428c93a930c08219142942e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
50709cd16d4457ce0551cbab268f0d98

SHA1
aba95198383d2e6a83c32596cdd77fb8b2a82c93

SHA256
2e688431abdc1a36c43593d74c1387c1c3dde39c21b24290fd8f0f4bdfc7944f

SHA512
d82820dd9a65bb0be02a41cc4f78ad1f18702156270a0cad6bf9f393295dc8ec4de4384424902c82fd9a56e4e1a110773a2626e3239db038c2367c79284567ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
369179651c77892019c66bc15ec45f12

SHA1
dd2aded2799f72f4041c62808cd1473e6edfa1ba

SHA256
c0dccf74899f90691c2ce11cfda176c8b88eb4f41a13ca2c42a53240b8001f16

SHA512
4b6cf3adab005503df57de8640458646a166f1b4acec374ff9048642a98296038510889033c4078731d8875ed07a073d5adae94553bfca479ef6876ab231debb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d5b7767e2a277d6cbfa0a625d5e3fc48

SHA1
75453395970fe066f934958972ded22dfc4d30b7

SHA256
8529bb73d79302bf23bb740e30e7f54e08f3356a23d5b80a6f82723fb2b34e2a

SHA512
5104237cee638d45bfd27bd84abb73e27fd307f8280253ceb21a812eb1d499c1f44f227d2a9a2e9d0ca2b125d4e82a4a95e849ba777508fc06a89e9c5f5f054b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dddf447b9d4b8c1976ad7cca87df3541

SHA1
f8ed873cae996070ededac84445389d240228f9a

SHA256
e14a94480efd70c0132278d9c43d49d6c433de94eea7385dfb99844e41a686f0

SHA512
947e173e565cb98abca94eae8e6676217f362c8fb5dced312d785b7f0979ae260f57fa0d071c45d1078de3a74c9c22a254cf735a354c534144d17a6916fad606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4addce91fa97c261d6143ef62edcbd22

SHA1
64f0a3aa1456a2662cc099f8d44a01ae2c314249

SHA256
39b9c35d0f5c9d1aef2a65cb3b34bf01c4943ed3f973bf46cd3d3f82d6d16f22

SHA512
3f6abcc23d4ac8cfd2fa59e3f1448744b08624e748be50a8638d0180d6fb733924137c1da00c43c059823edd9440058b5a0ae841e0eaca51468eb2fae18b93b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a145a55aa98db2a1a75f39f2611a39a8

SHA1
12c0ace83e98c02cc7101052af876fbceeaa9d08

SHA256
fbe36a10f3f29e1e20c5c55086896ed41c3436d7445338aa595e23abdc599e7a

SHA512
6c203d436bbea758a6e8ad527c8d487ed00a36ec39d27f41fd9f16d5972d838787285e1499eafa82a23708820e177c41f3f6f4ff9498a03ed8c5dcf70c5bdedb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
56117d6e11b1f8d5f29035b67fff8d26

SHA1
be397a4de08c69a6bf2ee29e20599c9c94d5ce6e

SHA256
d8cec3f04204e146ab133c1dad7519181cca11c268d8ed08b5fc33d98b50111c

SHA512
c97cc28f250a7f113b838faf347bec603a62dce61e8c1618c69f7ff903ac222e9fa54391079a7cfa149c11bbaf8d254534e54c390c2da265dcafd68dc8c374f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar66D6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit