8b41ff57b16b1b43108e34f3a45c2ec45c3aea3d7ef394bdfc34a2b066c22842

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d663d9729d7057abb6fc2b1147f0c56a.html
Size

23KB
MD5

d663d9729d7057abb6fc2b1147f0c56a
SHA1

5e4cf897c31b8a2689604c513926d1644891b4e7
SHA256

8b41ff57b16b1b43108e34f3a45c2ec45c3aea3d7ef394bdfc34a2b066c22842
SHA512

65f6f6adb750820b4acbcc55eee950d4651a2eaa834451caeec51808c68a39ca830ef256796987be1f08628f61e2bda5be4f9125f7203c88250c48bb78609b3c
SSDEEP

192:NGGo+Nnb5nknQjLntQ/nnQie/nynQOkrntBKnQTbnOnQ8anQtcMpnFnQ7Xn9nQTs:8GocFQ/kz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51E4D5E1-E600-11EE-BC57-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b60ec2f0aef86e46c2d4874b3014b353764f7fdcebb8b193cdd6f219bfdbb6e4000000000e8000000002000020000000f8628a0fcc93026bb68e3b72fc4147eddda6e2d58467d71280ab02f0464d50bb20000000a74a5ce1c666256c0d2f40aaf126f9060de8d242df953d831f714282e87613df400000003ae3037d7c289707d2367ac42c9876884e5112e9e420d3a3d19d102749ad01423e7e2be683941043567aa99a48d45f167f8cba6d1084f46b968c870369eb53f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e03b270d7ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000776fa28bf64f7e277895bfd5582a4fc9b795537b2a743b36276b15e137aa874c000000000e8000000002000020000000ab84bafcc619b8b751c395c657014897d31163cfbfd6561dbc90d031e032433990000000e16dc34f259ffcf72c92251fad03222c0e47c9627ef739a46517d789f45690bcd4c76da9bcf1a6dcc711206ee77ee159b3609716392f9f2e32ff6ca116aa6771e05ed71349b142ac76e41be0d215642d9bb589c821bc107473cb9fd8b05499c5ae71141cf1a4dfadacb8410124a9d93cd0f2056cc399eb425ceb734bbaf988145f4d0993a90738459e8010eb561e1b74400000002ae8b7ee79680e927395c9d073d5731648a3486ade110dc967c058c46b38a7254246a0643a657792785030fafe3122deaa2e02a13d9c7eba772281f13722b8ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417021824"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1188	2104	iexplore.exe	28
PID 2104 wrote to memory of 1188	2104	iexplore.exe	28
PID 2104 wrote to memory of 1188	2104	iexplore.exe	28
PID 2104 wrote to memory of 1188	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d663d9729d7057abb6fc2b1147f0c56a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0377c3ef4bf6cc6e1a40204945f93ce2

SHA1
ea02df4a980d854d32dd93e4766b3d372a843c47

SHA256
ebb7e403c21972d61df1afd2fd8f11b66ba31fb3818dbe738980a7aa5a25702c

SHA512
765f39af549b78263e6ab10bee9f6bfb3c0282c11b68742448164c01d4c65120a52b4549a02a1ddd939687e98708213ec63c4f34282c221508b6f85400e188e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
561d6d19ddc6c8a054f866214ae99b93

SHA1
b0fb6efe206f159b111d1bae540061136cd10c7f

SHA256
4fada62eb5ac8d45b6303901d7240896a2c1e8ad32791d509cd85623e1aeac81

SHA512
0af4dcb0041e0845ac40c43b5e8cd8f45d21c197a1d96918f3c6438b8616e516e4ab6f4ca319e384eea2178f6e7feafa9116226d5c3379a8e64b526f599f3480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb5b30343094c72b7fb961b456334bb8

SHA1
000d68a2041d5ba661288e04d30876e00ed0a5b5

SHA256
95be58c7659c21b8bfc3a6e8bb9d4c3bb7d1cb69e4dce3f6b634f24fc10b2c92

SHA512
a4059d3381c0e47d6a724697af993a0a05acb874305f800496c22b5cc7c5af6717d945faffce7346e317bd153451c8232d7b942b77364fd124e90fd104ece3e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa21811ba3084caee21981f92e1a1b4a

SHA1
804e36cbc3feef39ca30a52b388a28815ce28b8f

SHA256
70cc83f0e94e1ed9ddfe16cd45f250f1127d4c1d37958e9cb94f9345f4fc0d0c

SHA512
7fa1e1ccf6b13335c3c7652f9408cb7817abd592c17f34163a9fe212fde1c2eb96677fb5d8696dbf3100a60a92f10fa5674a4b151f731b216fa7178aa8494429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c8c493a936973b9f868c54977cda158

SHA1
57ad8e66389b042d6887390b47d920be0edc5b3c

SHA256
b276870eca47cfe026f8166d7dd8fbca620af728d29547086397cf33dc54f86e

SHA512
c13d31e072e63a2bddd099cbbc4f58b5e8e8bf5d1fce263f9d62edce96c4bb8ef158681eadeef893417aa48c6bf2fe51a303dc7af2f0732a22089caa5d3f0229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f3e039165303d40e22c2d672928593

SHA1
043cd6ef3bc514429de588dbf86fa305ce224aca

SHA256
145cdfc34450d5c6582f330d414307e7b13d001ad529012a64f2fed6f19d98a5

SHA512
7d8755b63f254121d1bdaf372824589054b18e26ffa136cb2be7e7e0befb028305810e6f3e2c87f93e6e2a158dd3d93d2fcf19165d272688c350223cad58dc05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26d9335c1251e69743b5c8ac46fb0779

SHA1
b2cb0e6e45ffeb6897d2271801fd4d497662256b

SHA256
a09460773b9a1d699135e593e3e605a9c5fdcbcac2e1852c3d685cdbff17fdf4

SHA512
509a775da799ff390e2724d1d305328463ce64813eba0fac9217be3954f274c44978f5f459542ddcd62920cae2f60494f8611e0cf4b76320d8fd2eb50f1137e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e329e3be2c278328638851d99e5e0d6

SHA1
ad2483f6e9ff72aec48be1a0c90436760dbca835

SHA256
fd5d442b94cc988d8f89660aee3505f80296932cf78309ca9f91f51902d8c90f

SHA512
44bcd08dd5318bb34eb717beeb5aad05f6aca3d4ce6a7fabfd77f82e67246aa348d4da2ec4ec24e2bbcc7ca4f5cf9cefd55d56abc6efb488f584064c72007919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7d66f72de8d60d80060d904698ebdfd

SHA1
aa9698ef26ffd1f3307b0dcfa82811f5f2180841

SHA256
a616204a44129063335062a8f43640fdf2dbce9d2c7085727586b138afea3dd1

SHA512
1f4075e33363c0e3cb0ee7eb8852aee8c3ab653c22078fcdf606e3bcc27fcc30a76482d944b0c58756cf97073cba4bd2b3633108183f4e042953689bc2f125d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c644a542d8cbce3ff13418527b0f9beb

SHA1
54a6454f0076564524dcb31509ece85cd0be07d1

SHA256
1c263b677251dd7b8d608904882b40ee4d10469fdf68a45b40fdcb2fb0332ee3

SHA512
ae1a47b3b4419e0cfac2c44ed02539878960be672519e4dedcc7cf92bed9a53d72e051b19ffabd4870f1d6cfea12c124d706ee9a549a4cc7b911a6aa77be65b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69ab5989ff6307c800104ae25a13cc20

SHA1
2017bc9789b74f7fc8664297d7ca7fc9a23472cb

SHA256
8fe3b8320891731b061556c2f7ea2a57cd0a51c9a62de0ee314dbd2e83fed393

SHA512
5623b76554f076e753892971bec6ac25de79b9834c51064a740e69d68c41a1a59b8fdd9c95a2770b15eba554bf5a7dffb835885723b6007409d9143db154ada2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0bba0e46358c6d610295a0da780635

SHA1
6f859db892c7648ce438da5105789de97e4460a7

SHA256
f82a69635bffa2bddc777c88edc3076054903b56847bdc662ef7cfd746d0c117

SHA512
6a4f84574acea6c9fedd0e66d77776f6ff00016b77c948a22ad5b6bba01792c329da50b46a4a132d195f71d2d4d70b97621e87050383b59eb4c09df88fd6265c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09c3d87f58df35ed1d113fb25b9c1761

SHA1
12d5f1d4c864ab74daf845dcb80b3e8c825be08f

SHA256
06be7d2247d2dbf626035ee8a8e72f48a8b640e0d6217d4c21120f367659091b

SHA512
c22433690b133dad4d8d83e5ead0953f54c91e7ed65aa432b49a24bb53881984318f38aab2b662407f77087c4a510278c783ab35815297a91f7dad4f159f1d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D8E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3ECF.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit