6fdd6b64787ed3f77e1bad03f62ecc4661d349d657987336e22ac1c21aa73286

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d67fd4bf9e81c3ca5ae41176c2f313d0.html
Size

25KB
MD5

d67fd4bf9e81c3ca5ae41176c2f313d0
SHA1

45c04aa5741fa0978abe13536e10b973117ce68c
SHA256

6fdd6b64787ed3f77e1bad03f62ecc4661d349d657987336e22ac1c21aa73286
SHA512

a6faf45105fac7ae0489c0cf621addc99264828129c067db3c0316a188a79372abbcbf034ec65ba16e8e7e650c1842a67374ddd332a1e4656c2f376d4e8b4525
SSDEEP

384:xy1R1QREDBeCliOkOz1jBDphE2Ca6XYa6bls7K88X+RiYuovCPRrMO77OM0TCtxB:xy1R1DeCUOH1jBDphE2h6XYaABV77Or4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f9e591a4b946f5a1286e90fd7f3de0b92bb662d607e10ab90134b64ddbed8a9e000000000e8000000002000020000000693e902495eb32f2e5aa03f79c17f9a7a282c5fbf163acb37c8d74aa6847293c900000002a4fde0b7ef427b903add1c5d5acf6ecf73bf91b6636f5ba8186a78d024a33ecf7cd3be1b1c49682ca2ba9937b654c73328d9f3d54117dc6f789de377fcd51a02a03c4706b44387b94d49c5f8ae32405792c0665b5489a1b7fd41b3211d9a400a96938d4062e7c82daceac24425436befc482e38066346d9eebe61ff41f57065fbac86a92dfd7618e1f344b9f0e5fc80400000005e41a24da64b67d6836293f5433dadbe671610d84a8060bf172b261b03eb74d620e8e1d6c034d24653d96754573e43d029e85e6b68ccbafda8494348bd24c944	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417025013"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e12793147ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003af29a4450f413a10f42b583279b26f0f4bdf64b12d1f72f0e3123a511908519000000000e80000000020000200000000c9063182dd510090235e90e724d5eed3cfcb2a9cbc208f2da7e7f2f6f470a8120000000398f64df025c922919f6e450d177274f4cecea6d0f9ef0e48633d1a8a5774ca240000000d8ba0583f66db18a007b93536940653b0497d90b364e42f14674c9a57d65836b882db690c44d6964c530a21b029226771114bf1a50cf7ebae26eddd7da321bf9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEAD3D01-E607-11EE-9C17-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2272	2096	iexplore.exe	28
PID 2096 wrote to memory of 2272	2096	iexplore.exe	28
PID 2096 wrote to memory of 2272	2096	iexplore.exe	28
PID 2096 wrote to memory of 2272	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d67fd4bf9e81c3ca5ae41176c2f313d0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
503097971818fb38aa36583f6f33c943

SHA1
1147e50d36102fe1cc38dfc7a68c5a17e1f7d1e1

SHA256
9d3571a0beb6924189a0becaf53c679ae14cd9fd888918359fc85e278e24a331

SHA512
90d0437617ee141c6586b1743dd294d494c7ae803dd30340ee55d791b3e48b4cab291a808fee8982794276bf9df091b64e345830914c6e568bb7d5398956d3fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8aecae9ae10d080cf29a8ee1a001ce15

SHA1
9fdcb16076688476db2241ddbe1035a2e434b260

SHA256
45f905f365a90ee2d394589afb9301e812e02b656be32c705a30e86ffcad9f5b

SHA512
8080e2a61bf062adecf652482d691b383767c36b7581ab5c945406178dcb9bd68b644e6860dfa4efee21ab6c64cef050e38dc9b8adb0f44007a67aae583d0790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0bc62b16181e8aa7f687cad1d73fb0f

SHA1
9c3340a452427e3f267e158d97a4fd1f8447b49b

SHA256
172655fc7e7998b3ac5ef4e2ce63614474911f2d052a7462ae7e0489efae12a9

SHA512
5bf898032d43731a66028c127bccd585408e0f942bae466598887683fe0aadad910908a05345d8548c57d40991aae9a5a174bfe1d7d8becb7e0ddd18b9341a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0915403b4e6c77fd99820308a598b2ed

SHA1
2a274013ae1e295a05a85aaf2d458766184d4760

SHA256
1d4804d7201e957d734e00396913af2b84ec1358aecef5047f8f5cfcdda54192

SHA512
b293454a8772a561f96a4d676d0a020cb914fbfcf38b2f71b558567389d15d6e922c95bccc12d57c41351b6e49e128047d73db4a60f5ee08a41c570ec943ca40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d351cd61c35f613d7007ed3181e01e0e

SHA1
59ab32eb9224726ffad9f74ad5996fc6c413d2a5

SHA256
ba6c79bfd4d3f6a0f6e27f6b56bdb1fd2774221de152d020e73f0268f7b15d32

SHA512
5d6359b1b267d8a20cbca79eae66dae53177795651f2d2ec991daeafccce8bfc006bbead03b1821c73470c657870ec14478a37b7e795ad979c172c989b7bcd66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c457ac0fa9e98e714b519958e15e285

SHA1
2d802730bc0507db24fcc6d087bf2c58e31a52c3

SHA256
02ef58316cb2ef0cb10065a5453b4fd0b3e9ba4f285cd732ac81556aecd9902b

SHA512
854b8ae7c039c4550120c34f66de95a6c85ce2e97cf9cfb4d901eea6d826df7bc99a81826aa5430bacbde6a1f89aa5a6489e0ba5adcc4515f7fe51904660c1e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79a701d1e691ab546ac6ad1a2f8994ac

SHA1
b12cbcb81bdf1d46c482b6f256d6a07fd901d3da

SHA256
238c80863ead0752e89acba898f7fa1d559b42df70324a606cdb6d3e4a7a669c

SHA512
ba1ff043bdf5a76e34eedf98d6137bd491d4d748d817968f483a847c4dedd801d76b4faa34c3d85a801231c28c3759f8111ef522451410c8eefb6d5ccc26ae05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc8064105533ccc63a2add142d48baf0

SHA1
1105de66e50610458097dc0f21088d9f1c65050d

SHA256
9ca6ac3f75b1511b225f3c981764650ace51f48deb493be8363eff11752fc2b0

SHA512
838c9016a128c79a9c3b422a20506ddee490a402040e19e32606b90f17321230cfaf4ef4ef2c134cbf46c3b22c38e1170f1aa41c69c3ff7f669a33d7b8108ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DC7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FC2.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit