cb23d34a6e7455391fb308c8eebc1e4b0e181f59ed1efa23d0e6bde9bd9ba033

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6ea1f8438a7900a876635e1f2cfc079.html
Size

6KB
MD5

d6ea1f8438a7900a876635e1f2cfc079
SHA1

b1021ed2fb1f32ba95a189a07abff9fe84155d87
SHA256

cb23d34a6e7455391fb308c8eebc1e4b0e181f59ed1efa23d0e6bde9bd9ba033
SHA512

0ef7fe743171e7f178f4f9fa18c11b31ff960225a788c501e8248965f7262d09134421ddc691a73d474e446529e3f1b12e38a0615642d0c2428c972e8815c9b5
SSDEEP

96:IvJFkDQCtS+TzPWNtQddPxeUeTGze6zJ0DDkPsmXXSovqfvOb6TbgrSJWhke+:IxFrF++NIxeUeT4RzaDwUmyoSXvWf+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000255eef1f4111ef80bb10f66a14a6fe8fa0177c5f69d50d9724ec4eab8eecc264000000000e8000000002000020000000da41313645e4e30a7aac2bfc23ca83c5920f931947527b3b4f3b95e22d62ee50200000007e179631751b4a1f0235851c98b90c9a08b2aaff15eba3e97fb1f4fabd5ffe6d40000000b41d9efacde2cb631895e625f43da1dea10514009073c7fb8627f7f203a16c0575e53a436729d0c25e150edfe5049935b2415db8b3b5d24dc6fcd73562108ab4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417037799"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008f5b09eeb3e69cb9ac2a9756d656cec089419ccd888a4cfc3047530b789a8293000000000e80000000020000200000001ea306bfb3a7892a32ea8a95a9661ac0de6e3e0797ab4bb14396aeb99b022e0c900000006316da4a11d2d3c5b0b9db5da64ce7845b4aa5049ff6817e27508b52abf34e06a22a6336b7dfe15687f26a157e42fd497f93368b56e1f587aa095d63b1448e2739d77519b5d0d336dcc6ff23a4b52133977e72317a3d38ae2942cede66406572a3a8a62df64e4ad5058a9178ae86624d45affd0354db95186e3f0869397da7fd44d106aa5c7d94aba51b7a86a429e87a400000004bfcc97ede4c5dc3f231eff43de9ac11af25743b3004babab045f72aa78f287e04a8bad79590484824274265eb65655712d5e7af74965bf9773df8734812fc54	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{828B4DD1-E625-11EE-BEEC-D20227E6D795} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c71b58327ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2484	2288	iexplore.exe	28
PID 2288 wrote to memory of 2484	2288	iexplore.exe	28
PID 2288 wrote to memory of 2484	2288	iexplore.exe	28
PID 2288 wrote to memory of 2484	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6ea1f8438a7900a876635e1f2cfc079.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4628ee9b3664a779e939bf6e6d0df3c

SHA1
9ec398c937b3437329c7270650158ec81309d574

SHA256
43e2e1adb5df59ff319cd4a974a9ef53c5f0eb6538db6214d6d9ea363bcf5e06

SHA512
ec43deceece6df87d1e86911f348a07e780f9b30e1a90ec318c8aafe09bb30b53824929a06bc5a5a311abe9075672edc1002dff3bc734e7940b0655cab9008f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68da9f0b8e0cb5c56d87bee4d8b19358

SHA1
3a026de24459db96a49d1c8af7fd9e84740d8cdd

SHA256
e40e46053d3d0e276f481b094bac6f9556f4ec86d7f28ff3997ce22cd28b34d2

SHA512
0c3099b15b549308612c756d2043e78a10dbb2c5d7a4d2899a034c448e1f9cdb3928a67a7a505ff1282569148fc8ebc8cc7f5d17d3ebc27794ac46fb8589f0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51749b9e28b9e08b6ca6f249066f1aa1

SHA1
6cd9e4fa2f352d228298902a445ea57fbec6d054

SHA256
7d9a5766d58b95b7ff752f2df348ccfa34ea65822f3700c2eb4808ab5e0301b2

SHA512
21071dd0a7f11973aa1ee985392efc8da6c68a56f0cb763c013f3367fe3db90e580407658ea6e298c0f1e9a6cddee153e463beb4ee10a82113c34abf3de78e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34a32fccfb9948333fbf002c7e40520c

SHA1
0cfee01e723790632b802bb2d6601ed50b18c242

SHA256
4408ece62ac2ba0f83772816e4df8587bd182cecf115ddf829a24a362040baf8

SHA512
d4366dff0f32f41be7643c964e35b9a832315ccdf8606207c51f35ed0a3c08d4fcc781d5a01e9d474e15a889cecd492ec436a0bb679018e4ff15c2a9181df60e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4d340d8239e153130fa69aedd635de2

SHA1
b9b63ca8e54387058c6257c2fb35698389ae7d3f

SHA256
053b6dbcd7d86a47175b6e8c6107b91df3a527aca83d9165e93043ac93a8a094

SHA512
aef866df24a26b1ba62ffaf07726bed39033823df7a34207b130577b7ccb3544137506df778cff5cd174636df9940c7da3e1ebe6d565846079036e8607afd389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3362f5fe27a717adcc3474ba8b0cb30

SHA1
a9b991c893c14793e7f85eb431459f2de1f34202

SHA256
dec032f8c08bc2b642f4c11f8be26ad54c79d5955ca022d65fab5c6befa0f64a

SHA512
709e4ddc495e1073df9736ad1d9abef7290b4f7dd5f9fbad27cdb138259a579be7257822aaa61b766e40f28c09fed890c609cbe39bfe37553f6dda1d41fc6235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ba1ec2c2981b56efa709d63066044cd

SHA1
879065b47d5d6fc614188cc1ce8176a7f09f6e34

SHA256
de8ffc18c48018eea0b22649c2c2ec6ab7bb27934f2ba3489fa03537a295885a

SHA512
2cfa926b70f65dec8985bf1bb569cf4dd0c2b9e70485d7dd0bcd37a569c5d423fb4a42c1cc420839dfa3ac6224bc46b5470749072a2f0d38d6f6b4da49d994e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6430c9a5d7dc123083fbb68394ab6097

SHA1
28f6d12cb12fa74b3a40abe215f376b04a89952e

SHA256
76f106ffbcf5d48906aa436e8d3c2d4503c98dced2f019d94ffca5a4f3909989

SHA512
884cead7b50e7225b7cc78df03d2d9b5c3563b7ccbbdc8e80221b5971f3334c4f7fa7dd259389db2d71a99887daa188de44e7eaf7c3720e0ba8d3e6dc64c1ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40ac00e89bb773311bf54147248f7c3b

SHA1
ccfc21da7340d630a1d8f972acf58da8e3a0aa11

SHA256
e6231fd82e86905c567d00366d2c57f732ff9f5537d75187f1b856d173a6b416

SHA512
8bb36f6d7341d0d6203808521b79b1d4d8f5961dd08299e83dd3ba95a3e3a3694bc09dac497686ee698e33a041b83e9ef5ba3c0d41e115eb64c7bbfe54b32d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abefebfe75923881f20f23e01d3292a9

SHA1
7aa2000a24284521f6d52642e29f61e108c4628c

SHA256
8cca5cfaea5d5797ade02fb1d50f87b07b1bce1c5485a0e1a9a2ffff4372f46a

SHA512
bbe73f11e96e55f923696f750d65f4e015e4f085f4590d6338ed0070343642c892ab2670f4c8b2ffe6f9344cba6f16619145ac8e5c70e435e8ba0fd3dff9be0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ec3486716eaf3865e17abcd66756f3

SHA1
4a2da71c9849fef79127509c5f1fc02350bae0a5

SHA256
3a476d0e7a51cc920914af7d76167f47d31d67299966ecfe6f31d17f3b9f2c4e

SHA512
8de83bb997ce0acb5461d482c01158d6d6444902d555751a96fe6b4ec60fb47581d0b52688fbba411a720ab78bef2b83f3488b42085ada1528421f1143d40bfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48f25645f36da296c8f3022353637b14

SHA1
43a64e6aaf94e388508f6d06d05090305072ed49

SHA256
52a58938ef63fa596fcc9fc0eef617b18c157812a07cb969ebbfbc8c082c9c7d

SHA512
d30fba14bbd022f9cad23616657d19e8de9941d13c604a721623076c02a8f571873eb68a77408e35ae26c9f9fc762cb8564efa775bba488be4fa70dbd3315b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d4101aed6eb83cbf357e1d0013c415c

SHA1
84048c9496d2eb9e84a1875df0f9ab03c7c2dc09

SHA256
b6804ddbf4e67038c976ef2dc731256c709becbcc62e00421dde7b0989437030

SHA512
422562f129651c75e93c1567b0e05f872de6b3898ad17fc5bcb724c645c1c5b14e12828850bf13b07f45bbe09a0f84234d121603b3cb666fd0518d3c35c9d109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48a2aff8b32ed0dae79003d3a71d1345

SHA1
f29c9d08843468b8dba3ecf94cc7d313f5ae3d81

SHA256
472a9ab33c93f56d01d3936de67203cee6b389780fe446de3f93c9e7c791796f

SHA512
ebba2b23797f86e7c5957771878edfa8c1aae2ff77dcdd4f596f04a3ea9ca282c230669ec9a50ba9f41b3be2a482dfaf07621aeec334dd62005fb46433e44bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad45fb72800011b789e72dc3a58274fa

SHA1
f113930f6956d56f8eed03e72975fb2ca5fc83ae

SHA256
0e0e6bcc6458a4d6f78b33ff37171dbcb8c93bb297d4bed47dc474420cae877e

SHA512
f7ffdc235d0726f12e394a82f22500a2f70f3e08e6107dfe01e5c21ea968254bb48eeb9db22ec9e01ecce16c9304332c52be7e3429f6c173a3249e4dbe3ceec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e08b8c84e57b1acb2714cd3299007188

SHA1
5ca049174c06ed81b07bc3b8b258ffed68a2da00

SHA256
47d6a1db89a44a9cac81c268a0ba637d80a30c44a9833862d80c60a078dd00f8

SHA512
0b921dfebabb52cf33e6143180fc68d2048ed7c7062d4615522de7742262cc1b4df3d83a416cd8f2d842f95c62779ec56e3783e12558c79a141d43c194d2ac34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E67.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit