e07d3057754261811153234032ad4ae012e05687e851b5aae83e8f666608fba5

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5d0387548b5f8be573e05c4a89c0a46.html
Size

11KB
MD5

d5d0387548b5f8be573e05c4a89c0a46
SHA1

88fc3025f8da6de03f03d59050863d983806ac72
SHA256

e07d3057754261811153234032ad4ae012e05687e851b5aae83e8f666608fba5
SHA512

e5eb780864ef16da0a33e48334d8c54ae35a7dff11d9e79bf40384adb459a4c3bd15dcfd89de2d4cf1aeae86982ae94c94f803768359b30bb819c1a3ea69c1a8
SSDEEP

96:uzVs+ux7p5LLY1k9o84d12ef7CSTU3GT/kG5pJ47XTu8BdF1lxw7XLjlVHcEZ7r+:csz7p5AYS/SSJuXTBPyXLjPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417003674"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{104F69D1-E5D6-11EE-93E2-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000009ded994e4485e710d1f1295533521bf3132a97b0b448ef8209e6fa87f5d43f3000000000e8000000002000020000000ef6649b028b8a5138f13a878da0d903359bf980a4d30422b4df7915379ccb44e900000005debe20ef538980c1a0f4121e085da7c7006bcd5f59dae219cee9c6720290f9fc30c358a4eeacb0fb299a4b51a761ecc703c548231496d6fed0a9ba1f77df0ec12195bf5c80a6357f96d3bb4df9fd1fbda0b9be5fabdb2e686f002e1bd6193038194b21cf2dbb10cbb16ef9bd5d82d182b94642556e1005d7a117591d3298dec2e4f2296c46c4cea456f294c19b48b8f400000004f078b54848f7294fa9d04fd1bb6a01205fcbf499a600eed0481c024a02f72950b8d645f3d25f4a8bf4f24581e8398291f5ee3ab04b364b3d6c696c98f1e4504	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00bd51e5e279da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000197bbb08e53794f3ae0b4b540339831b1351f125f157ed21e22604e88c1e3009000000000e8000000002000020000000584653338456763dca40f8c430bee619cfc1edbee1292985fdec8225815983bc200000003317b7fbfac800bf4e989d9420abe32fa7c847ff62538320964353d145d9b50340000000c615832a2c7ae7b7a3fb11fad6abc2f3c225672f0c554620bda031304f87a07cf31061163a605632efdcb95709b83f21892f80498a8808fe99e882df8f957b9d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1200	2664	iexplore.exe	28
PID 2664 wrote to memory of 1200	2664	iexplore.exe	28
PID 2664 wrote to memory of 1200	2664	iexplore.exe	28
PID 2664 wrote to memory of 1200	2664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5d0387548b5f8be573e05c4a89c0a46.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
25KB

MD5
00218943db779e08fc12ed8304665099

SHA1
217cba08cdf615d52d433d912d8bb8972d99fea5

SHA256
98df99151da03b4f1cebf8667c29f8394688ef7619b82ff1b2fd80bdbfdd4ea1

SHA512
1b170da854f8cf78ab1b2e9eb1a7b28a7edc328258a0e449e887a7efb0c2c251bab02ae3da2f16372a2d52ac8ba6102c7c96ad2f064d72c61c3634edf749eab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
490bb96048fd2ac6388fed3242fd22c7

SHA1
407cbf1cc2fd48f03b6a3e9fc0185afc6711b681

SHA256
265e7c86d6d262341a9ffb2402818de3c6db9570b89e41519295cc5cabe3d904

SHA512
735834d165e74518143e8e4dc2df27c6e6631f899b0bc921639c4bf5b87a29a29996d3bdcc7fd5ddd8d49d046975547884390fb838473d0db40a3cb92b2b08b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7495529f7f189601d7be43f247b929d

SHA1
63a377dd41ba90d48f332a06ea5401dbcd438e64

SHA256
01bb4179eb1e26a50cad0a4db8e5f8faf9fdda8bb0c5c488f67987e69f39c17e

SHA512
121d4711e5150520362a4d6a2a0b19dbb734416cd0d00e453b664d9a13bb7035e62ff3c1dcaa93621898dfa0733b2c50292fbaab2d7433f0d3fe737dc2cfccd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
977a0ab880896c5c9cd38d6532cf8465

SHA1
76a3270edea62182969c6ba9843a6faff4af8ffc

SHA256
39fbfdea281361984baf7ec6debf50002fb2af8e946c57a0e413ac89acb9e20c

SHA512
297e9b16e6204a7e0d8822063590f577812147234dd9e0d19d3032214c7e0bec5ce010a03774cdbb51fcdaf3636bbe51a681ac9f9299bdf6d0a55803bb0b0a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70285c751b242d7e001d3d769b21559e

SHA1
82465bbba5d79f4e3b635a1290629027268452a3

SHA256
f2e5864c1dad894da1eef4a3b2ceece0209430900f9115fc365fa0a7cfe320e3

SHA512
3194fae324411b08c5af38b5f4ffd4a7db6bfda06d45d9f0334c8ff150760bf27e0bcbc8799e54f0c852aab81c27e6e9e97d06d94353be0dab0f34456c7ca051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b4ef0d647239267731e72fa81f8981a

SHA1
f811a9397765b00b75aa525b2719274def11810f

SHA256
89f33bf16b849e47474820df872c4f98a4aa4342a52316d30518dbe297e646da

SHA512
025ec936008fee1bace0205dd9e1853cec0a2963f04d70cd285025e0fa0bed39ccbf07c4f8f4e91265febabb4aef0044ae8eaff9374262bb40bb39aacc875ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab56924d43f8fca1c55b5ca0a44e0a15

SHA1
e8876c5142c6adcc5aeb854cf798ff4adb5c4a5c

SHA256
21458409c5d08642f6300dbebd62d29a77e28160af8dd3920908f432da1fbb7b

SHA512
ebd3fd880f19acdf7df94cc008df41ecbb4bcd8ffb8af80d2843e02e9da2b03ddc0a6236191c98de0c4f0e626c656fd4fc428a1642c20f823cdf52a944438c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e06354cf9311471067c6a898cfe42a4e

SHA1
371b5707274a6d2b3c35b95d41becd632b8c354a

SHA256
d0309a34521c52bd7b013e5c6c3a25f01fcbf278a58578661bc7df6e50be1c43

SHA512
2e5d6280bf1c96f2d6bcd3d8953b49b86a29f5aa9480d526b0ed370f54243dccf23e56017e14049acab5552ab47131c6ed13b587a9e3e35ee0739204d2c31898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bdbfb1259a6a2118f6962d79f6f170f

SHA1
b1ed6a04b9dcce0c38e6a59a8632954487bd52b9

SHA256
6b0cea877fc991d5112074ca1e7a30efd1c99ec65b612d80f0ba1f9ba36c7842

SHA512
1f6fef613604c9a363428dc73f8e0d6898ebe1abf64aeaa501692267120646cbce06f0e44e1055a04e548f5aa82d9984b1ed5b1e953793ecad6ed5196411a205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc7816e0dee4bc80860cc3d152a12469

SHA1
5dedd14861a086417c00c8d655ad2fc71869da87

SHA256
fe8cee6646e2fc40bc8b90de6b0c7434e1887d7907936425754be6362298f091

SHA512
121d188ace6b9a13928e4f5845d51fbacf8e05b137ef4306d073abb68a046034589bcdc8b4f9e3ffd1b7ccd51bd4227956db17e2fa97c401bc723617d29454fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab542B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5710.tmp

Filesize
51KB

MD5
b169406f6bb5f9ec941e760bd4aa8b05

SHA1
eec1d2f85c52e6f54b7cae38c99787b533d37999

SHA256
e4cc1605ca0dc7258bda571b23a3584e14eaf1a1ffe69e3883e7611c9809743d

SHA512
fd3372ef66fa33919a305dad8fe40ac414b3aa7252161df9d17428be3d191d298cbe497ed751fc65bcb7db006d62ae8a3fecb7a04fbf6c0218c774d13a53066f

Download Submit