66a03ef99d93991fc2cf0ddf17c9f418826e04535e6390a6fb0389af5537d597

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5e19d01facf251f8bc091058e90cc57.html
Size

5KB
MD5

d5e19d01facf251f8bc091058e90cc57
SHA1

8d368e9599c3e1811eaaa25b6c2113dd3857b0fd
SHA256

66a03ef99d93991fc2cf0ddf17c9f418826e04535e6390a6fb0389af5537d597
SHA512

8555f1a7bdabec8c172eae3b95156f50cd9b907e77480c3bc188a7ed509eaf695f569c91ec33eec5a33429c877c9e787a0d5f2f1c3539a3898a510b85e13de8f
SSDEEP

96:Z+Xr5k9WDZU4xwwZihTYFbNf3XXr5k9ZBDZU4HKkWVTATxXr5k9ZBDZU4cS/+xXt:k7ohTYLftScVTATrSSSFFWcit

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f5df5b42cc1ae9dca7458442cdcc43fa67898151756812c40fabdca98557df66000000000e8000000002000020000000ccb3b3003882782c661c6eb8f67783276e5ca4c8706cdd01a5096a23ac859dbc200000000664aefe892b0cfab83daab4a7fd185f894bb41dce8ae15204555d3281cc44b04000000033d6e1f53124eb11f65a4e05b1569a2452fbefbcd6fda54e6c98f48cf94bf8b9de0c5350d97cbc4d4ba1b55237e37506495a93e94c00f06f86e82c52fece795a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cc2393267c9a90961bd49b9a06ef915d310e25c21bcb0de3ffddc6a314e6b034000000000e8000000002000020000000a0e0cca519c30a49468001c419525d31b1ed320ff89c7585edceb60b03ddc4cd900000002ecb8bdc52f976f0842234cd7518bc388696bfde2bdff2dc9b7c8e935e73a80e996a2efd70675684ec02076733f0564f9c1c677b3d6aa8ca705f9bf7e179b5852585fc415248fe8d9e2046ff7ed768f5f25fe2199e7f853193f1c0ed4d57ee5757692227333c23021ead71ca9a6a05a5fb30efa0148af15b6b49584fee79a999efb9fda33ffaf9767e09c07ceba80efe40000000d44a14c3668a847008fd5d5993c84e2ab9605fd09d4f9837bd8ee8a8eb58703e1dc2ecd59238da5e1671688da508d5cd4798538e1fe496ad482bcc2da0bf5b1b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417005991"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{754189E1-E5DB-11EE-9ED8-52FE85537310} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b9fa4ae879da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1376	iexplore.exe
1376	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2540	1376	iexplore.exe	28
PID 1376 wrote to memory of 2540	1376	iexplore.exe	28
PID 1376 wrote to memory of 2540	1376	iexplore.exe	28
PID 1376 wrote to memory of 2540	1376	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5e19d01facf251f8bc091058e90cc57.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1376 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
36f6da8595db972fd94c2b1faf1093a6

SHA1
c496e3a7a7d3562bca9c0d73dc7065b4b3c1fbce

SHA256
7a0aa877aaed451630695c4c9f43fcca81ce473b105abd60ba6caab669f5bab8

SHA512
f9e9c6c8f6788bc5da924aacc8ce896ae570d7ffc6450b31bc53c8a9b970df20aa8970a537bb3d20248771cbb6b1f1ab6912c433280bca15028b9baccef49f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7d37f3db1a3b12c3e30d0f0aa0071185

SHA1
40c8cbb97293f2b8a3578ecf12410689178ea0fa

SHA256
991f6f3209fbbd69fee08a1217aec478b3762844357484f72fa3ed29c5a6f8a5

SHA512
c36c10391d6213970bd00d365f058ff92ebdc810894980e85633829b21fb49e9d087325786ca4c676c4f5dcf5737f17e4030e510fa06aa9fc76b97b42adf855c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e5363c5d448a68c4a6a9b741159f4460

SHA1
b0c13c2836dcabc5add74a14a0efa7fc9ea6c985

SHA256
a764f227ba4bacc63a56b41ab9cf6516121e1e35c60dd30b3802e66d6e7cefed

SHA512
45c736a86c81731283872d6e9cb8a885e6d62bdde9b844f27349781efe8c5663ab8ee02523cc01ff19d33c19f3c8026130e9db38301975120c5899e1e531590e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
93ff1c8aea565b3fb597bfe7095edec2

SHA1
0688098a6536134e22e1e260d8bd998623d7dd15

SHA256
fb2341f1c6fcc2a4b7d9fdf2a737cbe94278f5d896c38c757d0ab38c739eafbc

SHA512
a2ec73d25f67c1fd760a0f399964ae2b28c94e566fca4ee5b79e26318dab7d9976f5bbcbaf79b55101ac9c4ba6d3507bc3b228dea63ad55e4c4b2bd70ff8042e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5cefa2af65b5a269164b83cf97cd55ef

SHA1
0277a608a21b70c11755ff9f82d18cca94cc78a5

SHA256
6ead0c91b448403db98b15c677ea38f492003b7cb2ca70a3b739b5fb34d04c36

SHA512
21e9cf32d0be6a2ac078f95b59cb8394b12104a058f8b32f1d9d68c88ce57b39cadc888e24ab207acd14931a1e56841de2d8a8143075877d8125de6accb076f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c055c718d8d23a8ec1f0205513f0ce3a

SHA1
c54c1db76d3d4f55ed839be0bae18b0840d83d36

SHA256
32548b492a220c98f274b9ae55f254f9b6d991925e77d15e102f26f9498af2e9

SHA512
506f9944da2fedb6c104b86c4a203a046ba04c9fa55500b47008db3f98c2f25283b5ead1f8d43f0aacf3cd9f6c553876aa5b78127e81a718670f6b54753ed4ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
98b802edac9416118f3921f3b518876e

SHA1
e4fbe4625516e53c90a014748c2157416d2282ec

SHA256
a8ad03e26d984d908998cd5f446c4a4ac2b863411a402ab775f01334299081c8

SHA512
1477c700122fc370db889459f7d59b3ec299eebb986fc6b79b73bb8b1b1e8898f81a1b7fa58e3d902ac5a4b762647a2d5a0e15e52a901e10f2be08358b32be29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce23393a8c7a2754858cc389156ec642

SHA1
cf898cdf1e4cba3d96f23849c50eba959e316b32

SHA256
713d03ef6002b77eeb52d1b570d052a9a43526e726db3ae393cc6f1d2d6818c8

SHA512
7788ca908b173fd12a1afd29bdd018bd339cfc84cd0ea6d5b9ede258b5a73c2c1e123af4a832abfffa6558d816f3d0f9c0195cf9a2598e71628986bda9314346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c67799a9a7c19fc8d508ca246e5f8b1

SHA1
14267dd800a57e24ff9b4805ed9c1e280e87017d

SHA256
1d41b0fe1198bb191ad8d97d3a47de26f5820bcfe915c3b3ffbbd14224bfbbe4

SHA512
8d70a87167113471954e466470d85863118add8d9001d481255d3581da87807fde0cb943dd6e0f43e22ff0555b791141b206fe0ec74a1c8a8c2bf761f183397f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
05dd7111ef0f0a6b18880ad01e17581b

SHA1
20fede631c81458a77096182d666512455f95e7e

SHA256
a6e160deeacbc3c0dd7f086470dc9bf3674d6b4bde402d29a2a869c731dcabf5

SHA512
16da95119d529d10b435127b533cb84c2ff664ec9079fca9dd5212e91a4b52eecf49fc80ee2ddbad590209266f23c882f0f4ba7b98adc823718ec9314a5a6b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1d19323f5005df4dd20a6913e213bce1

SHA1
14de7c320354b4abfc545b32dbb5b29b86bb87e6

SHA256
f006b8574dcc1ae747c6df75725b0bde945a6f480acb25d310560619f3cfd934

SHA512
1a204cb0e69364d3a310da5566b2cb4ec53b23d5b30b7b2041a5167217c33cb3bf17ac15d0c2594a6f24a593ee5204198de1ead72f41aaa5f9db5c55f2a56871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
855e87a563efd164fecd7ec9f61a57af

SHA1
af9d73f3e70b09f05f6629d1f4811837993cfd18

SHA256
dae6eec76cd196606d2428fb2d409356c2b482f34e0c2ea6faf01b976b6116dd

SHA512
b414aca5dcb6caa8f6096fbd198f91b56e0579399d2ccdc357df6d5032690de231c1b75ef91db3332e4964eb9fcaf9328ae6d327f730dc8b98bf5136e588f09d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a127c833090b48b120466aea6fc4af9d

SHA1
daa6cf29c40a91b9b87b974231719fb0dbe074c7

SHA256
2054851b4851b584bfacd5f240015440ece23ed9af64f4cc422dbb472766b388

SHA512
5b39a94f2e1a3a514bf7815b36ca75e3879a0104a7bd311607e5ad74bb433491c7bd77978bf1e1ba438df065391a5b8b320d1b565e49eb8f5038b3fe76ce4613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e7a5f5416fdef5f962742e9022029d17

SHA1
48b3c7f09d9025506f700cd89e6cd9f76cdf2cb1

SHA256
15dce9f84c1ef64888980e5dafcb146b19bc7125154b1b53108868447ea0ed7d

SHA512
1f4b544bafb4d7be47068e8c5820477bf99cb73aa0b8d52334e4b1e7506bbdfe757066f49104c6b94dd4522ac1710a462e4a977a8f34342d639c53bcc8211e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a00c4c935323f4c215871dcdea227b70

SHA1
1cb47574452565a5c7278776628a91d30ecb7922

SHA256
5a4ed095b4ee129de8fd81a74ae02f5068ce24735dfd276487f7d7955ced0978

SHA512
0fd40941468f8598f6007afe1cb7dede98cb77e27f33fd5c5d20078c2e4f7c2e0d1b77af0dec48c02bb7ddf468c4d8f53262b336c29ff15aafd663b7171e54dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e38c33c894651b6f9be13e277caf5115

SHA1
3db9441139717bdc01a022bb18171c8866c86610

SHA256
1bc532b4f87b7b65e3c6bc32e9df4842afff3eea6d479f6bd377406e2d799f2f

SHA512
dfff31254100db3d37486b6014183e84ba24993f8c998b1ecb18a433a1cbe94f316f622f46e63f3719599b30da2ecf32f404c84de35e43e93a734abe986db3fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
686642a33f433ffb3e46f706f7816173

SHA1
61c6d000299d2fe3fd5609cc69dcea52c1fdc338

SHA256
4f4ef5fd8a5d46cec1de13ced4a6e575f949fd7179063082dc1ba008b59e37e0

SHA512
b6a85e05e17a90d3e758f2e289594cf31633d3f6aaa9b532111b5ab266a5860b1351bfac0b9c7d821b331c12401e929cdffb91fe87dd00b2633be51542d5ed8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CD2.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit