dc5cbfc838aa07e3913577771c94ec87848418e42a9a10e41a8101fb60875938

Analysis

max time kernel
139s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6e2ea9404adc143657c7edfa78968d7.html
Size

6KB
MD5

d6e2ea9404adc143657c7edfa78968d7
SHA1

0ff0091ce21e5e7f5a23fbc3c5c5713c42fbd795
SHA256

dc5cbfc838aa07e3913577771c94ec87848418e42a9a10e41a8101fb60875938
SHA512

613c4a2cf857e4067fd1d9da1d9659c2fe1e0c266a0934a2c8f0c6b5ddeba0fd78649fa89b56661037d7a2076a0e3a915dc16fcede0015e5cf4f39e97d3f295b
SSDEEP

96:uzVs+ux7LZLLY1k9o84d12ef7CSTUJ6o6M6dcEZ7ru7f:csz7LZAYS/Lor0b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{135CB531-E624-11EE-922B-6E6327E9C5D7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000209c2d03541cecec907453824b7a0af4a4fb692d4bfa6830d94ecfb126c05797000000000e8000000002000020000000ea92c002491d87721ee3bd8f16d232b131547fbaf2051fbad28676d43dd30b6120000000f1a9e86e1d887f8d4787f7aa3a9e569f52f8929a8726cf732b486db627d12f64400000004e8aed891f12ecb31e0ada5e96246ff151f3058449edaf20d67123b18cc48a98d5eabe604f18346800c50e38758a9e34505c45f63ebdf051b6da627aac5b66c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f629ed307ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000008c5e52927b401b4180640166a4db72d5f7af78a9c20a8f896716cae6fe76a83000000000e80000000020000200000007cf930a938c7ca5fc357bb9cb9e3b67a1bfe004c60cbd7fd33a85c0396b8156c90000000c31811a29093909fa9f770f4be4983a08470a0f8c5c0ac615f4bde5690379d69f99945eb14abfb554e071e3f17bb7f364063887608cae4f7aa0151de239a317587bc1b96d81f050b6c4d09e52fedd39d642acd28981af7e23c4dcb627f121c1ee0c989e365aa26d24c13481309c29692bf7f8fa439f7fbd3ab21a6b6ba90339db361439fa2b8c8d14a2180f871ab501440000000c8e9567dc037c7428b7fee84c0b574dde62b5c784f2c7e9f7142ea7e6040c9a598be6f02c87e1d1273e631cf039d1126c2a324b92471d049d88034c5dd04b225	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417037184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3032	2248	iexplore.exe	28
PID 2248 wrote to memory of 3032	2248	iexplore.exe	28
PID 2248 wrote to memory of 3032	2248	iexplore.exe	28
PID 2248 wrote to memory of 3032	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6e2ea9404adc143657c7edfa78968d7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d63a1cabb38782a3fde6cc30a14ed393

SHA1
60a2f27cde2c36ec7f9d3154b8bc546ed4f4d606

SHA256
1e8cd5a485f409cb99037cb5abafe295427705aabc4560e8cf7b5199a77806a2

SHA512
75d08d6aa028d28bda22865eab462bc92cb22d3e44fccbd7ca45cd82fac18c2f944838f5d1af6edd2502d71191d76d4e76ef110880b2e05186773433b26d97f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f6d45555f132e07572c72415b68b31f

SHA1
b15ca2174ed6ff0de86c9a2d8af4de0f47a3dc77

SHA256
8f760b4bad42b9846f2304a8d2bf0d868ad6c0fac429669c326d30f30235988e

SHA512
19fc4debe35289324e345630355fca641076ae464785de8a48b858cf3dba8f0b0f8a450a0f5a931d5eb49fabe1adf9dd38f1f348d126ac99740524bb9fc2da5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d80ad2f15d59b4a853e94f555f39696

SHA1
08702aa3966af0f423f0f38d5c1fcacc7a834a4d

SHA256
b7d0ba8c4c21087aedfa6b1476026ec77452e03322477de13876fe2dfc246e82

SHA512
53cf306933002cda595bcedcb3c6e647728ee22ef4b4c3ce7e29620be0f62e68d8b4962bdd10f94f4c121390061ced58c5e6522e3ca481a1bc883ec1fcab3514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3188cd84581245468cb9be9cf57fc1db

SHA1
46f3feebb114df8c6e20cfb7bdf82b7d88409197

SHA256
5aed2c2bd948456b7055c44a2eda8113d8d28b18611fafd09cca4a6d743ccc0b

SHA512
bf1078ae8374a1f53f06c45fa445dcb2aa7fefa649bfd8859e4850e210e0ee5ada013b66c4cac08c4c6ed593152b1e9430edbe6e811e22b591eb2a419e2d27f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24e349381b7374aa5e630589470f31ec

SHA1
3c70bbf5ba82cf21e69ff96d3a00feb645e5d687

SHA256
43b0bb7bb11f0203d677526fe73101126124db89a10d19c144a16db896a3ebcf

SHA512
843c8eb8ce98b727015e7d5d144cd38432cb57ed4193dda747557567a15e81316c8760fea4ba83888a279b595683f20db977f65b8b3613f8fe7346f1838946c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
168a0ae08b3a9ed7a0c21acb9e8069e4

SHA1
725f642c9354b07ebe1f36e108d5d920efdb02d0

SHA256
fb5ff3b2cc2e508c0173f1fcf517865745372cd81dafe0a165780e341be2982f

SHA512
2d97637bba54b5b2701faab4394a8471aa3aead0c9e69d966fb6ce298e4595838ec8d1a52f87c8c4edf14a784d7ce3dd6ee8142a24b98473a84eff94c68828af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
052dda963ea11a043962da88ffc9e731

SHA1
0c47e29ab863d80e0d313d2afcdeec0a4c82cf91

SHA256
c386dabc16d8cfb8912563b3f2edf608661d73e236d2b35de8f0d9cf43358d14

SHA512
df90d1a6be3273a0fd17a3c9287a8f3336d8c7df918002fff4e13409bb84b4fe9aa966d7b7368882abc23776b66e0dae670a9d66156864ac7253a2c3d428428d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05a7c4eb0609a91d7362d8bf4f6caeaf

SHA1
f7e09dbe056a6111ba8c8c5ee9859e5fdec8b716

SHA256
4e39eada8a308b98ce168b17b44bd602a33ae9d029b4cf88563c7859f17a8a68

SHA512
ac0f11a729d0fc32dcfdfe982b96c2ad7cfffb8d11e4aa363d36395988e1078609bc82768fd4acc301ec906393d610c5283696f34f1866a764b1ea6b1360629a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e9fb484b65a3f45356d528c7285386e

SHA1
f57aa75d8f6368434510a0af63d49a4061c8fbbc

SHA256
5a0f8fed5405568676ad51c5fdee77fca4504c513735a727c806d52731d4d8ac

SHA512
63dad5811ec991a4a721bb4e4493017a7e2f711a13c915946ebf9a1fecbfd7ace139bbc53b9ed3a98d66348a141019524c07a1fcd451b2f3f2db599b41ffa46f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9cfe33e2fb9564fe6dc66bfec32f795

SHA1
4cba6c312c3c65e65fdec3d962f9fd5d81505bc4

SHA256
61a1fd89660961bf82d7d017d45c1cb604c12737dcb7e6835f067f07f719595f

SHA512
cc93caa4cf7224af6d901c187fd7539e3868ddb47f0251ec78c7ad7e9e96abaa5eaf6fa15f58651555e679c0f6f62b84a4575b26d250ae5caa166bb34e2d9ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a819d6809faf6ffb7a6ae6b06b0037f

SHA1
98f29a282e9ff1ab7b87c4ebcc49a0b5712c39fa

SHA256
23fe54d2d34fd899b008233ccad1fd27faf3ee30f568f9d77feb2e69f9055a35

SHA512
3fc65a4043de94c96055469a5aa253edf1c7444ccbdba8287e4c5f3158c71c34ac4de464dba3ce3943075e9c93ac35ffe5d83d03917f633eda000605df767c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f934817a2af95399eb8cc71a9f66a207

SHA1
4370ab92089762c2214c3f7d5ab1961cc33a938a

SHA256
69201f554119a2ed9ae065c5472c6b2934faccb79f3f97965ab9445bc1b1c179

SHA512
d2acc7be0f6308519d714b8a6f51ef46204ba6f002f83439f174d50ad6fd54401e9b524d72516603d582095989a1fc185bc00e959267c595bfec7cda13310891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43509afda63257520bfb8937274cf256

SHA1
8af44c1306e5d1ca9ed443f4d62fed8c05f09b60

SHA256
2051452b18d9726ad47c3fe256d22ea54c80324e9db9d0f9413a6b2e82ce410b

SHA512
9bc792b523890b7e9e8857b8f669e85e70b221f9847bedec4d30545006afe66a8d2df4f9d11c38a6e3ccb1ca9da90cf5236bc9edbb75c6d07de149e48c87ecac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4556eb3901d9477ba0a28dfee39d395

SHA1
c0dce6b53047b275179b861713c09781e50550cf

SHA256
61ab7c71a3ee056d73f89fc098d0d87f467dc055a21b3563d7dea4bd071f4eb9

SHA512
568b8ed6a8534db8cefc190a5a10e49072190651b8bbeb5961fa7ad60bbd34d30ed254097ae406a60260083737e002a26c07a45d49722c5ad8ad7b9c271aa234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afb95d4ff250050240d723bbe058b464

SHA1
2b99f0bcf177351b4c2806a620ce3f8d261e8ffe

SHA256
809ee7df5a17ff393dd66cfbc07308a23c3baec4fd3508da6d9953469326e43b

SHA512
44d0461676f9678202ef281fee9e348f5e0226ce6f398458bcfa5721a953e2e700e9aa49c634a44c292199f20974de5acd8d7ce5e9da776fb7ea0137f0e3bed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14EF.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit