ceb7fe551a241719bc6f6baaab1c06e56c28939baae257b3d9c6b8b4c44f7f9a

Analysis

max time kernel
136s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d47aada7dbf3261e706595a2a3a0eb4d.html
Size

31KB
MD5

d47aada7dbf3261e706595a2a3a0eb4d
SHA1

d1828c396d795bc7424d0e84cd68e737ee407eab
SHA256

ceb7fe551a241719bc6f6baaab1c06e56c28939baae257b3d9c6b8b4c44f7f9a
SHA512

e88aee547d3c277ef6850766b0676c3aaf7d8de59cb5ac9c90e6c69bc566475e71e560581b4db2feda98d2613b8285b76963cd1dbf6a3f76300698e23260779c
SSDEEP

384:YdBGItkiAo06+Vpi3ITdEnEVKjWA+7ud8hl2DpcL61IWLJAcB5D51IV3aFm7mBAh:YdBTPz06jIB4I6WBEedEERnFT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0767ac77479da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416956371"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED3F4191-E567-11EE-8466-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000000ca4438bc43ba0558af962479e5e1a5f0c74c6a715702387d56f80e80a56772c000000000e8000000002000020000000d6c27dd11331717bfa89c89ff03d7af82c6aab29b92fc25fa528400e39a4beb2900000008962241b2dc26ed462f3692bbc7fd6b4f3be955a346c8032071966d3f721be5eaac5dee19631508903bc9fe3449270cb7e1abadae051c06c01b1a67afc821513344672ae188de6143965139f7c14daabb16ed82ac022bd9011df3391f68b29778af20331374d72b45bf11d3ecc4a6e775252a8f336f9599ad291b50e0fdbb573a9fe256805b82354abad920c4c031083400000002dd7f1bc3863579c0c62d40d924c4012fc25b4a17294c4081c4d7365128220066c6bb74c93dce76f006ee0945155898b6c8bf99899c0f77e5ecebf1e1c5127f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000047b8c1a0ea98bd16540c667a3ae717f384e231108769a0a0b876d6a1e128d744000000000e800000000200002000000064ba6054389c9f0fd212cc02bc0f5ced5774a75cd3de76f07ff0039496c85fc820000000dc1e7fc471ad3f05fbc58992926202346f5d5e5929b7f6f85508e560d78cb78e40000000288a02e90e4a76f8f4d1de2be26f4bf9e36f1498a350ce2e02039a12c8e6ca5b3e751761ecef36e88b3dcbc2da54d1a95915424dfdc6f4d61724a877d34b2060	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2828	1516	iexplore.exe	28
PID 1516 wrote to memory of 2828	1516	iexplore.exe	28
PID 1516 wrote to memory of 2828	1516	iexplore.exe	28
PID 1516 wrote to memory of 2828	1516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d47aada7dbf3261e706595a2a3a0eb4d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8ad68c13bb74a17dc3a1d7d5ca20a46

SHA1
fec0a35ef6ba8e82489fe7bf1552e1739b680365

SHA256
e56f3f24380162babfe13c429b6f7460649d609b168af9fbabc5ce95fa846da2

SHA512
eb2e1136d91f187fb046e78a5a792e9009656c810371409d62cce1cdeebdb79dac11fa9bc2681ade90048922eebed46fa02e6d2bb67fe56adf507118a8f16590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
906d31fec4b34986ec098b400c61cdd2

SHA1
faa1310b8ccb1d34b620a6f4b10be8a09e9c8dea

SHA256
ba04282435a49511c2a7b6d23ff55720e8a6e7df6a40c3dfac6d6fd8a4c914b4

SHA512
d65c4a548b812811295d111878f35a3ee942d33e5f0eeaa7a66a35be03e00889da442ad5efde6ebf33397a2a918591ee2412971e22c0fae8c59467bfa342e08b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7d25f8fe04470df1cacf59e977b072a

SHA1
b77b3f6af441c0f51dd2349b7e0a2324fd309531

SHA256
25bd428d5460ba05e91736fce91afcdd8a093481d3a4659a6108c056da4c3184

SHA512
5d580bd2fb4faac7a530d5bfd052f0517c6e9ad1261c70fb284a767d3c06afc76239e4ad6eebbe83a90695e104019ab92e0d0c853b1737f2385f0fad67ed9d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b755960cef4fcb854116ab2ae95d0011

SHA1
caee26308997bdb28732d9223a2b386e86e91387

SHA256
d47be1b7cd747340ffbbc7d7b8049c43576e6620c9d5d01abd62c00fead862a3

SHA512
fee70bffab670872812e171733a95dc57e84c33a85c470ce50f9b2a92596be6197a2dc43cef6054d18a90c81e4c9f1cf69d6809d83b3a46c89103518426daa7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9fb5ec39884d9312052623587d56371

SHA1
fe3809940a5c095da77150c32948625191931912

SHA256
d5c6d35b953682f09562c3a8ca20da2715358b8b406bdcfb029b942afcb87438

SHA512
353280656f3a29129a134edf593ad30ccb85b98ee3bba3e2fb093a80b2e02ae765bce53d130541dd4551b90751e9a6d0cdb997d870581450371766e91a68ef8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19e8d6b5344a7458a9ba95066f8a3584

SHA1
64cd5403f3253c6c67a8ea5907e7b6c0c6cd21d3

SHA256
597643170614a840fee427056c607132d616e533f7e7d0cbdf80a5061361177f

SHA512
fd654695ba20b895b34c0d027f25e00a264e19b429a3a36ccd547cf6402e12e044db67c0ad726d8b350735e4255b4a37f0891d8563f7acec1ab7297056e32127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c64398068aa3f27408d49f38e03c214

SHA1
1d3918704fce411492a85eea782364014217337b

SHA256
e91b058c19d0f3a342c179921795d2746f6f723dcbe9bd0b9e9a19eff8ab7547

SHA512
8de923740c675404b1ada045a4dbd9d16dbe53b1be1d6aaa2828040dbfebac4ded339cf338f899c1ae40ef943ce9518343a926727720d8f76380346aeb86aaa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afddc2d24db3be890e4b418e5203baa8

SHA1
dd0d5f90609f1e5b71135398a01e66ae72c47f12

SHA256
03deb79ad331987a150e207c0ab3873a8709834bfd2324efe5e0a4fa21a3feb5

SHA512
176b8e21b261754833bc90d7febfed4ffc4d14d1f08c3328fd9be1fa11987f6614e504d4d72201b0fe6cf67bea4390a0691adabf12c6d68f9bc0687e8e7cd99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5619b3fe15deccdf3eaa638a35fb20b9

SHA1
91e9c283d27aa1041037cecf361550248a0c7dc5

SHA256
89dac10e8daedb0f69b6edc00f9466bf8768733218e29f84d2ac96039445d482

SHA512
964742c8b0e09b8a96e5fccbcf49c5ae9ba5df8959eac3d8f2b56688f0bb32bf11c3bea58269d77f56f184d63100886e33607e5a17e776e1a6ac6932c0b2352f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5abcf04a2d986de481d6cee84dc0f037

SHA1
3895e50dc9a15346ca07bc8d66972ac531f66720

SHA256
ceec64b6657d1b1f65ae3937521aa6a5d71ce4a2d1e710daf70c73fc505882bd

SHA512
ec51e3dfee2e422d12e68c8aa3c8c6f6a278277e001b7f8abc295906b9f7d4a43a49c9a4d64b4643583e77b1cdc666ce47b903bd0e740998af3f9ecd4e6e6249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4c7fed45f788f1a71b5af510343552b

SHA1
5d5b69930425fee8105951b4325de73d09cb3c6d

SHA256
2bb9a31d7ee232313470da1f55b9cf5fe1a0090e66c09a3e8228d7a110cf3691

SHA512
cced15beec96ae13967185e2e4bd50ecf30affc42e6e9aee6bc07b25694df145fbce418fec9acf228033261ea585cf2c59b9ccc61824ede4b623b12834271cdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92b9eac125b1397ca9ab92b1b842f22a

SHA1
090f70e97ab4f2de513495f3305a6e004f2240b9

SHA256
d770b36292b77b5c94dc66bcebddb4108e697f2b64b6e9eec36141ee175dab28

SHA512
bf48bc1c84886e0131d5501256d0b078b5fb091c18719deede5f8d2786f731eb226c94cc883e945214b805c1997e9608b0403a6d78b189cf20d881f6662ff0c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PU2MMJX7\cb=gapi[2].js

Filesize
63KB

MD5
a1db70a72c58f2bb28c346805d3f56de

SHA1
a0ed56dc2e376bdb5f56497fed7712cf9e99f199

SHA256
0d49588062ef694d6fc6bed009f6ccb71fa48ef1097ed72bcd2401c32e54a117

SHA512
e004b078f45dc420a3f00e462b9cef178205b9542196d6996de61e438ad51dd82b7e1b30fb97725ecb9c426925157181f521e7dd437302b25129223ccee8707e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PU2MMJX7\rpc_shindig_random[1].js

Filesize
14KB

MD5
2dc32078d76673468f1bdd9d1c2dd676

SHA1
9a7689ab544a8c1293a2ee933599db3a93363ea8

SHA256
c55692e11f1fe9662e3d8c2d4c832982f3986ec48d944de471345829fe66ef80

SHA512
9253714d8ad6f995c26ad97fe82177fb5dd8baaccf1df414ac97ef45236a7cb62bcef548db637b51314fea5d9ec4f2c2c3d4ac0d6701bc86107128c61ff1d6fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S96XYZ9E\1005847222-postmessagerelay[1].js

Filesize
11KB

MD5
fc4f777baf3abc58239cbc8efe48c659

SHA1
32a32fb5bf485fa53a8256d24db6460e8eb1ccef

SHA256
fd632e2d64132d33c6becc1c4f1d35b828eddac1bf48c4cdfb326b53b161885f

SHA512
d223db5d31692f3f5289d6a8999aff916ffe12e16b5f4baf69716f31423de520c1056966152c906d34f8ba0f27cafa529dbaf0e0e503fff03d30bf656ce4b6d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C61.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit