c78b1d79a0da9d51edcef721229fc643ca627e562a127dbd82ff91e9c31d09c2

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6280f8ea3fb28f4e9e9bdefccc1a2bd.html
Size

88KB
MD5

d6280f8ea3fb28f4e9e9bdefccc1a2bd
SHA1

ccf12507c7b209ce4c5c8e6e0320892ae31a7144
SHA256

c78b1d79a0da9d51edcef721229fc643ca627e562a127dbd82ff91e9c31d09c2
SHA512

2c4733414d33d7be7388d88b2e6abe2276b1901a5c2bf4e8ab33d974fdb9288414df5f5d5bb36623adbdc2d6467ddde53b4e964430cbca664e87bfe9becc4adf
SSDEEP

1536:eIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SW1aY:y1aVoaimIzIn/8v

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c11688973e67529bf2b1945a6be104e8814a8f1a9f1e89d221eb0b64164c9c20000000000e80000000020000200000009d21738dfa46f3e188f8d79ab69922cd07b7d07d489c25a3ed74931ee9926ef690000000a5dd2ea8fcfe1a6f217f02dbed41115ec93724c7399d36020a9d285641cbf5d906dd57d2f50924038aea104ec817ccc1ab4240dda62594b84724bdc6b6abb6e112294664eb9e8a74d8efbb06ccd638cfbd3a83ec9735eab99cd53cb0247393d3c2691b9961dc0fe4c37cb77a5bd1035951d462e5bdc8a824ee9e69980169a1f8c64e41d45fa2fc4b7d1d2f01ef67f20f40000000c782bff7c3f0e4de99a1b28444d4339246658f587f34969a2c101206d7075b7b9a15f498815cfcbdc653f2624a13457ab44669939c281e2f6c0ff2283e6d73ca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417014344"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3E4D511-E5EE-11EE-A01B-4AADDC6219DF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102ae2b9fb79da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000cdda4b65c64ec19eebd6d8350076461b1411dc4ffc62477bfb8972c561f2a16c000000000e8000000002000020000000639170b6336a19fcb8c7accb10956929f82f771db528cd3dd5e3cfb9d23345c120000000f49427f70ff26cb023f294ac3c8a17a4b3aa22fd57d881c8f24585cacbd49d8f40000000430b67c1aa1d7683bc8b393d81e09ad86cfcbd452b1089008d3cfaa0781431ff1293515ba31a7239b0a37a34e38619af84804ec2df09dc9a3303e14a7754c699	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2980	2264	iexplore.exe	28
PID 2264 wrote to memory of 2980	2264	iexplore.exe	28
PID 2264 wrote to memory of 2980	2264	iexplore.exe	28
PID 2264 wrote to memory of 2980	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6280f8ea3fb28f4e9e9bdefccc1a2bd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7e9112134773930538535016844202c

SHA1
885dec93f5f86e69214e51c4ab87ce9f98ea2175

SHA256
4f4656e672f997e5aa363d82cd9f2a29db5c015dbc77f1c1293ebd12daeb67a1

SHA512
249cd3b49689cad80eeecb904e4428af9a63f7dcb7569ad9b2b2ab6f6e868a08641d626993d29b30a76a20267d41732462fce15dfc9d5fa70bfd178bfc8e1eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce7fefefc764612cc213048b3d5bdb8c

SHA1
d2f167453f94f261468221e55fe58d507b20f360

SHA256
d697e808d6c945f54042de507e1d43b0a830f7219051d5762e18285ab74298b3

SHA512
458bebb67632e29fc08bcdcccd4cf41f7a646502f704ac7074a696c578b1ec0bb0db4558f40818ec255e50ef947a5b1c49b61ffde6c162e4901af3bdf828571b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86d9e7b78860edd42d0896ae75c56ac3

SHA1
a70f5d1788e10b5681935a902a6ec8dd9cf8259f

SHA256
52dfa191bc1e98a4cf414bcdae4acb154622ef6084b03b064e5a690b46f44dec

SHA512
f39e4a1d94ec4c112b0ee90cd8e4eb43bc3e48f6e48a6c25aa6dc8673a4253790120528cb21327d1ae82bb1d5d0dc02de97fb5429d733701e6a1a1f08f504c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af67f210346be1bc92abb1bff69f915d

SHA1
3f4909d7132d81ad0cfc31776208439477245092

SHA256
8d6dda550f620ff651f81ca6a0c1febf2931be8ac20ad626c18fe66f591f1e2a

SHA512
2d64e21ae26d4af4ea1fa1630abd60f884e0c2439e473c89541adfd355946d9438d5358958b7ce4b2db3b58a229fa4988e2fc8e3fb4135b8af8e60cc37eaa5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4149adb5291fc3467cadea4002d5905d

SHA1
48fddad3f68218b0bd43c2c77df7500279c4ab5f

SHA256
a5056f5040b4cd5c27169169c25030fae9ee7fceba057f77f9b1a2b8b991861a

SHA512
41bbcf7128301e66d8d42bca397b8aa6b40db9c527d2dbf1eed3de75c9a714e554be013754fae247baa230d275c9077f87eca5b2582fff9538984c4785d92b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50947855f523d5f8a4b8055f79ecd61

SHA1
e34d27260bcb7818aaa0015ba8f4ccb672dc0f87

SHA256
4aa3529d47d236de0f6cdcf3f34e10af14fa78c2cf2328683f3a215ab3a6cc04

SHA512
c2e1290f5799eca013976d66ec865c64b57c7078fecc9cceccbd41541090032a88edc8d2d0e0cdd5432bb12148564aa7b95bd73a7bd692250acea22b3a5134ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8d67e2e8651b0129e3eb97a8ba97334

SHA1
8d53cb3cdf8d56b6471ff39b02d274a36d2c7fa3

SHA256
352f932e388cd38c958eaca1d647286c42e906696b621f0bc9c2c6057fd00742

SHA512
5c082fa3a9f0d97cf3d13589d8eded074d9bca244b474ae80bd9017e1bc1b112085481dba87e0e81d34ff9a993ec771b8929d33944662eed7f3168ca8460c5e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a73087d9e6039877f0f1fd8c7bd1f81

SHA1
c828c6b9d6711f9a9d792777edbfde0d0420e029

SHA256
42818fb03b91f8d0dc0321863a45dfbd9b640f09705b5954940a1d02d15bd2c1

SHA512
facd4f8759619d728994b073c6c619c3ed34481e672f72ffb9c5864319ab8800d22dcf7f1ae2f236cb1bf83176aa3894a4e9cccb24571a772f084b2e3c0b2268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab1e15a7c41a8fcdc35d71aab7b05eca

SHA1
dc3a6ee7ef299521bc7daf2968f3d868a943421f

SHA256
57f89dedd3ec416d05dbdbffa3acd8b5df789fef96e485c1592e42afc93b1dac

SHA512
0443455524c4aabaac7a8e3c028c06493c786a9f35ff68ebb0314312c290f489ffa8283a42ed81a45c29aa0e30ef5d0c687d3644b00f5aca3211495d4c523af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CCE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CCF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EA9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit