d5ee53b678611db4747b458e8ff7cd9a3dddd0a5548ac3208d8f63a2aac0aaca

Analysis

max time kernel
117s
max time network
173s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6eb6e99b90063d7ff04a78c725d7d93.html
Size

2KB
MD5

d6eb6e99b90063d7ff04a78c725d7d93
SHA1

3e985549b7c275edfb886f760b91f373322240d5
SHA256

d5ee53b678611db4747b458e8ff7cd9a3dddd0a5548ac3208d8f63a2aac0aaca
SHA512

4fe39327c654a9e814910452b6b1df7f310dd99031f70d9535146d09db10afcc2fa8ce0dd15b19f50818ba0b1158be80cdd8ccf3316b776e92397f6dc45e4f0d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000689c8b36669a70aed560c302d419bd9982f9ea2ac8022d2041e12db2b3204eb9000000000e80000000020000200000003debea612b3f596fe0e0f7c74107d09eed0ec8f6c244f292e85d9df245ee7797200000001dd2f3ac6404657e3b776393ab874b24ba173afc2bd943ef03b828a6549a2ee440000000f80fb46830680739731b7ed525649b40f52cc9c0aba9627e311c9c95e1a4eb64ec0967e0d61236b97eb7ccf8be6808c9dee2973c24812be504710908f3289c27	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000006f2d9b0b9f0348cd227e5a48787a423e33184e0bf209b5dbc0ab76e5913c24f9000000000e80000000020000200000008654488739c51d628e731b6fa1964843375527a5e5bed56f08dd903c11d2ade0900000001e33d812503a1025ed58e46e511e75ee56dfd0af3085a34a5b178244c53a0ba0e7721a65e98e51888922e2e1d0c01affcf29f25b5b0c001d1b2f396b6c102c5f11a07f28fb662e1d64169a28deb246cd9b69db75306568da730bd9990b95835ba917fb708913f441617bf943f92de4f95f2dc23c64b984b079478e82e0c5250ea81a75736ada1e683cffa74014b9fbb340000000bf977b3d28484f458591078a954a304b6b928f1b46d3e58897df8aa741eb9dfd780b85f4ba69c649205132b406d90f592613ecc646ddee67f8e59688940bfb68	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417037972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ec4ac0327ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAB4B591-E625-11EE-BD46-52ADCDCA366E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2924	3032	iexplore.exe	30
PID 3032 wrote to memory of 2924	3032	iexplore.exe	30
PID 3032 wrote to memory of 2924	3032	iexplore.exe	30
PID 3032 wrote to memory of 2924	3032	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6eb6e99b90063d7ff04a78c725d7d93.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b487eb2011fb1593332aa2d3f5a347

SHA1
085d547a476cf301dff24432b09cffaacd89f714

SHA256
cfd3ae2f8f02fcca0ebb3ff474183906720863428e68a98e233fb90fd836e0dc

SHA512
278e466ca4f1311ca06fd2c071d6c16ac28e04c95b5f98f8315c94a10b6d517b3794ebfed39ff86d0cc09a44648df7df12870807610088a26a2cc556b076ed73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803daab506d201a850a55612718d2c9f

SHA1
310fd7cb146552b50c1a5433753f7ae2b669d4d9

SHA256
7f105190a2509068719d9cc02a201692ff2970acde87a58399172414b423db0c

SHA512
0fd92dd1a5e67dbfbbbd5fcf3e25e68e68550970b906afa3caa67e86722e7591595df27dbab40f95c503cdca003db8ad8964711728ba677269406c56448e0236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02480f06585a51db9821eac0a0ca0c8f

SHA1
d6fd6e8b1b8d9b60d4e3e334cdff7143e37a42c2

SHA256
dfb2216f7b19a2d3adc3edcfe7f629412a6b5987f3371aa14194b81dd64354a0

SHA512
da04bf4d712ed9188c970784918afc259e0db872cebcaabaf06f4f554e32c5e685a666c5db517d1712749eb9cbfb93a3456e12cc77009fac4a416fd6961a70d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5a822e98f01878a503f7da7c9f3c615

SHA1
30f485050116aa8f3e11895817ba12c8378ddece

SHA256
6ce25cfeefa2a27fae7ebe9727b3315211c522fcb9fca656525af8661624db4e

SHA512
3b767ff53653ee0e6c29e743a0e95c81dc19793a5139adc4f91b00b6393fc7c57daa33772934af5ace2e5422eefaaa836d556098c200a8fa7d699800270e7885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce8cc354580a567ee1cbaf1006b35007

SHA1
87ddb4e58e03a4f7f2716ac05190faa3872caed2

SHA256
b2815c00d38a4e59ced3905205c5ea52d2b3a175081b394ea155499e7fc6212e

SHA512
905d6d4e61e28c07ee4d53d0f80946f5ef57a4944f0de30e174bd887986622e9c0e634c513d7c0efe686c28dba4edad65cad92ef4ce8a3f0e72265784c83aa0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b530457bbe2e850a96e2b7515634843

SHA1
252220262ecca9a14a980e5a25a491d282b8f37a

SHA256
e543f16680faa547e4a85efd282f295d8104f16f91dade2e2f76cb0127611867

SHA512
083847b66d2f6ef708a131dd59633749fbb5f6762b1cf859c65398f83ad30f43a2ddbad0489583c0f4af27d7ff66955f9624504f3bfea755d9e3b38af82cac2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92b84e6d7010b5ffd3faf89938c90169

SHA1
060d81d46c4a25c03c5d37cbbed8cd697a027a9f

SHA256
33c9d5524e049f2097bf23118a2c8aaee46d5a2f320388f9b50c687ed92b80b4

SHA512
edf57d7a68df4d465f1e5ecd84df869792c74ac2cf97f009040cf2270a6cd9dd7b292a722d8dbc934d54486e77cd81f1305853c00b46b67f2962b0c3d2d5c5d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
314d7648fe7ff9d30ea7d87eb1d63c72

SHA1
99c91387135bedddfba97318f621fb1a5e4ff3f5

SHA256
57bcfe27555cc3a2c4462bebb16c6e385f84c525fefe0264f842aedc118cfb57

SHA512
037839079c34cd93bd5111cb62688075947134bcd1c9812afa15166890ec68cf56d5bd92a19db5af2fc0dfe478f56219192b2627cc86b9804e9cabcdf0590117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e946f80348bf5f6eea8df131c2c66535

SHA1
9123cde6d5dd1ad8ca6c29f1e38bdbd4923454c5

SHA256
1c22cab1381bade0983109e7962a36434e43d4963c32ab98e02a8eae54286b8c

SHA512
cf4ada62678d9bc59ae021281ec2231c7dd8cbe71c8acf2ff26981941e691977aabe5214310f8d6e3a2cec2a0d5a30a3ed021227998e578d034b5002bb45c04b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d751adc12157328dc0565019d507ff7

SHA1
b070e6f049e42bb692e8cfb978f0d8d888145661

SHA256
a8d1af5f0a6fceb1408c562e860dbfcf56510058f7eaf70530902e7e13c87d56

SHA512
624ebabf769be11f8af185d8a15c147d7820801d250df0a4bb6a80af401189ac89a693f52d7928ee28a9ccc542d33902893dc1cca98857d3a9fb701c8b50a06e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ef579f93e0d00aff24b7c9ac3922853

SHA1
12c2bafad7fafb2b6118e30e9345d74612b06e25

SHA256
61f8176e068477fb05f6f82eca3dd481df90fcb5503ad62ec26a02f7b3669b48

SHA512
e6e3b4f421ce1031f3d6a371707cea45e869c1c855587b5962be522b9f6c3c64cca64dd9abb538e7dc9b8d114f570795821e4bec5f3139b7e446a48839dcd7d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d257f1713c69d143c5d02f81ed197547

SHA1
09a7eb2b64470e584898c63246cfbab75921afb6

SHA256
f87bd819d488b9090cd2661b8366715111e0fc618fc9b0b578a5463b9bca45cb

SHA512
821f0ffa3f3e901876b31ea670fc13245f2ca76d808876c41ebaffef22c7ec0feb67239beb8983f46a32bb13b05f4c90939fc9e1e6ba12bfc779d99dba99204a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfe37b120af49f47429661b0b15be9c4

SHA1
dec81b0c8b24d62b871484a005a2d13a875c465b

SHA256
6349d0b3b7c82c8400facf32a792b8a80b47eb7a9fdcc61b0e7e6ffcf5e230f7

SHA512
b22e8846074faecd5f71afe977b3fff6c94de0dce1cba2e0eff3f2dd99673dc885c0bbfa45d7a755fcaa98645cd8663a2e1ce11759e537ffaffdfaf6421098e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11CF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1501.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit