258814d099212a008e2e0de9d7fc47a8dd547c8f14c9e39a8ab1356cdd97a3d0

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddf4ff21b15743488e3fd5b149a696c1.html
Size

25KB
MD5

ddf4ff21b15743488e3fd5b149a696c1
SHA1

60dcc36fd19832bc60c82d5492d08552b0f6b894
SHA256

258814d099212a008e2e0de9d7fc47a8dd547c8f14c9e39a8ab1356cdd97a3d0
SHA512

585ed458a87a9e4e108233d9e38908aec06b2a86fefab0f15a40f274959d07af5995ead504ca874282d92a01f515975da96e87ef191052674294135b018eceba
SSDEEP

384:FfbWARyiW9LNKu3LgdSPPXZKpKPFxa+/9XNBOiCGZK1/+IQI:RMlKueuBLPFxa+IiCGE1hT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30043512ac7eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000002c6cd3fdc83afbc210f1689f8a43e8dbedd202eccf1254c1977deab5aff01b22000000000e8000000002000020000000cd206717529f159298c0ae19c7ec270b473d7f56f0e97a2484544f1ea2cfee48200000008ec1ab1329e030205f6ad56f20ab0b1a7e93925bc3390efb85e6f7d41aab1bcb400000000f804d1162642799d5016e27aa10a4de1b8430b4a54ad274ceb921b45f760094405c46b9de1875a2c5c934e18874c8faf1d53b4ebed0bb1d5d9f27fe05f0f0ff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A229A71-EA9F-11EE-BF21-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417529882"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000037bd00593b127df62cf955f41051aa1c2f1efe86895dd9d7bd5083a8c12c3da7000000000e8000000002000020000000a126fd066a552e14b784b21e63d4e15b1a096d60e99c18602c4417ab4b4bd0049000000058cd318c89a16c9f69b2f687e7b1dbc0d43801e3a5b1d365c45f0c676f19932c225aa804620a0eeb2e7e403898f7ca17fbfccf7d09487271e08ea61fc3b6e584bafe56c3ca1efdeee7ea2691b8c1f1cf5b352a8f0136135e08bdfb9824099dfc7395eec11d6219a3eb976a0610fce8363c0a111a40fe9ddb4a73049f3453430389733ae67c75f3b06bf70251081dbc92400000009a8be52e472e88918e5d5d1bba2cf120122c86fdd499efee8d1d261494b5938621563f1f2d82ea7a41bff0d69bef598e582d84555a8d1ac81a1a048f1a3efdc4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2464	2164	iexplore.exe	28
PID 2164 wrote to memory of 2464	2164	iexplore.exe	28
PID 2164 wrote to memory of 2464	2164	iexplore.exe	28
PID 2164 wrote to memory of 2464	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ddf4ff21b15743488e3fd5b149a696c1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5651db251eaa361d76398751e9c9431d

SHA1
d5dc98f548ce4d4398c3281028fab34d2089e0e8

SHA256
45eb82245cbd313858ff3166b72c40bf56c5dc7e47fa1dc56f8576dbca5ad81e

SHA512
637dcfc09d86b08012be9e5420078aae62ff1f6f508b768703f1c11d533bc2b17ff3101f55427eca81d12f1e84f4840e59b8fcec08540ce97d31fa306af794c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac574fdb70e113a379b9c56dd88e9d94

SHA1
928d1cab0f903af85d3a658fb419a1f1a8a80e9f

SHA256
928e666aa9d93a489fdd258fca4348adee9b1f67658800436ede2794e56798a1

SHA512
f4281b38b49969db42240071720524a6166c901d550c3b715516a0d0c12ca1bba12ba0782056092693da2573ef8460351f5856240d78af82797e61a44c39a764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a250160562ac72444bee9822045b8c26

SHA1
8a5a301295fed5d8d7bb45ddf487b580da27ebe9

SHA256
fe9c43949d5eb92c3f97e1bbf917532ac4281080b0e2d1755c7d4830a85c47af

SHA512
9333be9fc297a0cfb8c64e7851dcb8e4366def6489546288fce9cb97026da61d21421b2e2f56b63f93daf56bd162faac0f5a0874cabe1c2fc35901dc390e437b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
879e3c597567b9caae9c637b53c1cc10

SHA1
b5d2ea480c23d5d0c767fc405040577507d6424d

SHA256
c85fa4ab32fb17e33c8055ea8344e647609e75955b6567a8d15ac850fc9bf058

SHA512
6974b3fd7ef597d261df3de3b645ed5b63f6c458ab3d2fd81404d8cc54f00d8c3804de1ab84460c006cf71cd8bc873a20ebdf7ad420b4ca6e24bacc12f06f551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6586f2d2377a544bc83c7d2c6136065

SHA1
d9c2f6c30146a86e3f79552c8b3060b308816f0a

SHA256
d7f89d91ddfc3fbf8643c1d6059b9ba7f0e50abb45adb83e0dafa01fcdd81dfb

SHA512
2f23c04cf16a34f4a1c0ece5fff768929754f6b259b116924eedc10c92426210b193485dd075bba828bc879ed9bc07ad647d485e58845c35594a3308080c8955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f98452355a427423f17c783552156b5

SHA1
8a4df874e9e36441b3f58086c753d06a31031be8

SHA256
1ab27a3879739a2d19533b6dbc3712b5a45419f77f1a2dc146a1fe9c061664d2

SHA512
7cdf82043a288e6628a91a46bc77cfdf8510daa722ca53477cde91a944bc4674691facc85ed847298aee0472fc8c84b396839318d8cddb3ccd87847f9247f33f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8169952610e008dddb1b8cd6b5cf61cd

SHA1
6ed609cf539259afba99034fa1b693a61d58ea76

SHA256
363fc1622cbc29a7d8a12fe53749aaeca5442cb8b78de5e315c03b6be940d312

SHA512
2e40d7e0949ba5c1e5f7d9e6a265be103f7122e8f4b35487149a88504dc3d81b997d6b63d75819bad9645d38bfff1e885ec63b53c01ea1161a4fc80b0760706d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14129b73d9aa50cebde3b699172fca02

SHA1
60e6685c80ff3fa14e409dde2b2fd66a1532c4ca

SHA256
b8cca8c068bd9dc32c8e956071ec5d83f068521c32ccc97cd4873256c004d1a4

SHA512
7bf35b3d99fa77c70813dc6736c02e28b96bac7d6d307d475009ce2050a4194b9c0dbf3102da0eb92664b206b50da2f0ae7d49075ea5bcec914eafa0644ea441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f3f09d5d901418d791da7897f0e10ba

SHA1
4290c0ac0682140cb6cdf98ec619b487a155a0e4

SHA256
f8667e1bd17e0cb3450eff3f9c19566eea469ff040d2a23f083f6bb779e49cbe

SHA512
9f4136966e1b58cc22dc25feca4d1867c2319025e99d3e34ac53939b0eac568c18c2a58769a49b4e4c28511f886bc9bf7814e9ea6a8a191bbea5bd57e41bb21c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc90db4aa40738a9ce519591107488cc

SHA1
c41e13031ba1a7ee70e4e7a8a589443417a54b50

SHA256
cb5c6327a52fb0340ac7f8b9ee8b2645a5748d0baf682c9dd40ea019d81d2ed6

SHA512
c0d623d35940f57d998773985d1aaf3d9052445d096a18f82c47da1260f7320b0f7b8afcd9d053a2d8e1b621a7e05e6e33ece8ccc1351490a9bf7978e1bde3ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a323d5686fe5c73e14951759872457f4

SHA1
b1d86801c239ca9ee4764aea5ea541e176467a14

SHA256
f5c047efb0e53a03ccd5db17a2612b88fb14146c92338cc011f3f080e22a5d69

SHA512
2cf8e7a2f291dec1e636bc21e541d4e6f2ea7ba8829d586c62b1ef4dd1eceb2c890694cf14f4145e97e203ff70d61261bc3ee0820321b93b74bcccea1bb1265d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8c145eb7b03380faf4a160c6c359d2c3

SHA1
066d2f3bce367bc523089a21c9423f6c3cf499f7

SHA256
d49619185eadc69623ffad22dbbb25f6e3234163e0afadb7a24e828e46763f34

SHA512
f6a79be7ca35ef67f062e64e470d9e891784895b4a9e5e44088588105de97fb0f55be70bdaa187c20e3b5cd9142bcc6605e54bc6a4ef109c122a4e5d37758e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab66CF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6917.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit