c34f9d4f75b2f5c5b3fa23848baddbdec4b4eacf4b422a8bdb6959b25084f454

Analysis

max time kernel
121s
max time network
155s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6c7cf5e620c943c079de6ef736d5a02.html
Size

987B
MD5

d6c7cf5e620c943c079de6ef736d5a02
SHA1

3a89a2ed90925dc5f08363f0496d39ae18f7e587
SHA256

c34f9d4f75b2f5c5b3fa23848baddbdec4b4eacf4b422a8bdb6959b25084f454
SHA512

0cd1cbe34eb5e3b7c60d43ff46e6bfdc974e82e98c871f509d0006f80cec980da1d3606c2342f020f0f6873b453257802a26328e362a4ddf30715e59b285cb2b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417033716"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0857681-E61B-11EE-B6A0-6A70828DA9F2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000430e5afea66c5f4abfe10ad6357e75786dbdb1ecc66e79ea6e8facd68eb8df29000000000e8000000002000020000000d8e521f24c4952dab335f1b8f90d0fea6ec9e5499e8aacdd3f4c9a5451c7770c20000000ff338e3ce9e4b308bef6f4c48a402b3761d76e5b69dc8dbd10d6b316a625aee2400000001749064ca74f729e441192d16358a34521d2a2eb843b7b034f1fcc9ecb998279283e4079a08f0527b2321a513f9e2f8c4ac39d4c8099609219003b203337f644	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ff57c5287ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000b8aed624a7f1c0bc3bac79145111c2d574548d7c135a68077251057c37288444000000000e800000000200002000000067b58bbde146b3870a37fe76c86cc3bba2e839d26038c5da192c1233e478ab38900000006235e1a9b2948d3ac06437944374007649c45d0ef8933f1cd265eb048c979763572634a5698abcee5353f59ed1d6b9723334fdfda260ba6939896ad23fda377c4471cf4a973467b5fd0701763740cc97605c39c904189475d7d147e82501b871075dced7c6931c9a3e3b22333400ac715dd6779a304313cb235bf98ff000e12d555ad65bb0a94f97488abb1fcc7d18ef40000000ec924f8882497dacb6b74893b02e6a9de9e360e7b443128e44b2bde9c7d3607a45bd1149e1d3db346317182f01996789596693f8afc0a3cfe6f766494982c9ab	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2084	2980	iexplore.exe	28
PID 2980 wrote to memory of 2084	2980	iexplore.exe	28
PID 2980 wrote to memory of 2084	2980	iexplore.exe	28
PID 2980 wrote to memory of 2084	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6c7cf5e620c943c079de6ef736d5a02.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86c2473b418ec16c49f3cefd88d830e4

SHA1
1114f44510ddbba61962bfc7fac0e82afb79dc83

SHA256
0a85ec798d2997a017a68fd84a9d3cfdab45e8fe077740eeb8b6bbe1a5bd3b02

SHA512
e64641cd54b13b6bbbdc1600b8388da23df25b2491c055c62a969f8a9741b498408b39afba886eefb110a6dc77234f1eaf3d4fb37a96f3f4f8161f5a2abaa1d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd918a2d435bbf7b1bc634ce76b7c460

SHA1
3e810b55a5c7ee6020d28ed6cb42213d7c43151d

SHA256
e06075ba61457b51dcbed54bb3571f2b25b1e9c810a958864658c24f13680085

SHA512
1d800f9ee90fe655c6567dad7ca79e162db725897d1dc78f7cad526677b94214dbb409461992780b22bd6b9aa891448fff280b4a7c8512cc14de0b6af92bc378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9bc178b11c251e5fdcdcb6dc9b553ff

SHA1
49634a978bf3aecf015e81c3cbcd609a0dfdda71

SHA256
07588fb30914a863a73e9e4d94b15fa72449918243b172dc7fd4bd11285a5954

SHA512
b9b7ed46f36721c06eb39123632d940e399c9d3c17cea60a0eeda6b9c164efe0c30a82649fdf25f265debd2ca679be7a66128494c720223d8b9a64b5a41a8bc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef17e417c187a4eb5c933244b3b01385

SHA1
4b2ad1029cfbf19c0e78e8df473647bbda56223d

SHA256
6c9fda05ebbca0688f5374927098184aa3556f4a5d39dce758533f17b132ebd7

SHA512
2e807dc1c034445fdf8a2fa33af7e7e5f8a8191dabf164574fda7fe2029f8dfd69c146a78547db8fd0972d2af34c6d4b14159e5f21e8b6c27e3dbc2e0d62ac24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13edc37de00532a460c1516e89d49718

SHA1
90e1a5771d642e146fbfe38e5ce483948b3da122

SHA256
96c1d4a0f7d7a2f14f99e45e30fa549998efef566f30ae34fd8e44bcdb287c23

SHA512
8f938243b9683bc3a239f05bb212d9fd72a4e8563ed7b4ab93278afcaee25b3e7a51457630c5ffc60346b71e4d925424762f4a139a5e7d811ac89275c157c0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
228db8a361010e9e22fa4d67161158b6

SHA1
f6eb9923b2b479d9e1ae0293f0581a52d4bae022

SHA256
fb5df65f9cd1dcec098dbb4070c571031f9837b83b30eb7e8ea3dcfa65230881

SHA512
f079cbef6e61c80e0bded8d0921158bcb701484c8562c433e05e59733d34a36245f2995a9147cb9c2d021fb1d88b24811b564aa9f1fda002c5ccc10a94787620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff5c0304464a8f43b8506656f2da984

SHA1
56687850281469b14ac75b2961f23df7f06b0aad

SHA256
23a1e3dc8683bf83363ee637618b4138e3974553991e1e75efe02e683ac62eac

SHA512
a44bbdcdab52e7e400f53aea126e283843c6c19b0f66b981b1c5cb4918c3fa4c21b2a3dfe9dc82c5844e8295c1f25d46933519341bc77856761719f2857a6a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
498c4defeed4e9835726b50b02bb9e2d

SHA1
29d757e9300b1a8824e074e686a651349bc9f74e

SHA256
027d630a7e75a42ec0adf9757eb792824ca6c1c7401174f42ed00f9aa9d47234

SHA512
53b134189d2fabc5de2c174ef398e0c2f1c88366e19d8ba4b2f211a065e154fd8e7c83c64c3730e3fc18f4779183b1e364099f358e50e2c00e5d762fc75179a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfe3c5ee31a23824995a20d2491bf024

SHA1
4ab28781d2047bfd269841ea0ce4a23023b83039

SHA256
7a9513d0834673d9fa02c6442a80d37a03ea2efa9bd5b62ee7c39a34c8b178bd

SHA512
81aecd3355c004b28d983f5b0a531392b86447c4c2a73a2e59abeb785daae5c7469499dc3d709d3bcb7131b2ee0e17f7662b6d79184b73911dd8bbb726260e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c823eb2d16adf2097309b2c06167dba

SHA1
e559800ac17510371d664541db48e3414d9cd8f4

SHA256
d3d1fd2e1238b071fad46d8e1868ec47d5a96453f2fc7e955e9a5db5807b0bb0

SHA512
02a50739152f613b40c58c8bb8d6e90cb57aa5ac1015a3f0ee2b0131e6d961c302068d3246f029f7656fda67ac2b470f6a6e3476cc82ea26443e1a0e068413b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68d5e0eb3a04558f4418544ff61c4819

SHA1
3c03ae7819bb42b728e686802254dceb318ef6bb

SHA256
f1f7903a44c1ec7086fbf4e08bb18e26b48e654b5e8f4e2562816e98d1768b00

SHA512
af85711bf43ed62c292f0ee103462416b6f3146573ba696522826d7d4cc76d11ffa2fbf4fe4638cd61667f797b1962f15a93c948d2ee10944cfe62e84adb3fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d86bd252a2a4dddafae3c15bd8c3cc1a

SHA1
6a0d0350d94a27115dfe4b5748f47508ab044fb8

SHA256
75adc9649974406ec32fdf7cb0edc7786fdec14743b5c42c58f9bded7533ab3e

SHA512
450ff9491d76605fd252b0659f96962b7f6ee8991e28f2f3e81fde3b796361584470eb79ed413ca1760f280a42a6ebde255353fe8f8f52c91d1d274aef29496b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6EFC.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6FF8.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit