7574be66d3de35a33418b9e722a01fbb48551020af244556b667ad1eac4d538e

Analysis

max time kernel
131s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddf8c815e659126c245b850e5702e9b9.html
Size

37KB
MD5

ddf8c815e659126c245b850e5702e9b9
SHA1

18ae7d627cdff32026b3babc465c54bfee2c53c5
SHA256

7574be66d3de35a33418b9e722a01fbb48551020af244556b667ad1eac4d538e
SHA512

1bd4ee03dc1c5710ffd22818e44571b5859d4d8d2a767707de6191d256c0fdffa3d17c18ab28243842f7b86c6065d6d155de037f35db0c079cfa5a43647a0f82
SSDEEP

384:kydsF0RplkLTDF+a62NOpFXQUaRogv1PzP1wwL4oqSTG4WWzbM+LZW3BltIHrWzK:kGsU4BYtBXDR9MeeXObeeet

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48E0C0E1-EAA0-11EE-A8CB-6EAD7206CC74} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404ba959ad7eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000164c996bc3921a777c554c4d2c5116ff0df90fff0c0472c1d3b730ea139d5232000000000e800000000200002000000017369cec8d20d71a3d11cd7b028c9297f61f7212ef2b596a5f5bcb36e172cfbe900000006946cea505e2c74e2f49d5d9b5738898955633bd82a509088f8037b78b2e8d15794573fce237384aa69cd55fc75dc9134073066a0a4ec6852e7646c59e6d7d2c90e8ac6b11342da44b6d9aa9fe33355260a8cab2c2fc85d61748c7c2db6f5d884ba6567f927fbbaf6cf23396d95c91891c44120d89eb6f0190b8153c626d240e9f821ff063cc638eec7782e2728a7d47400000009eaed7862eb2db00b1b5771c6e0cbe0d12d86574bfa41a251ba0b31abd6f4d477751dd396a8ffe863a641eb30e2f87c7b0c1e85c070a9667c07dff974a7d2cae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000f5a23a138666ed7507c2976c3e5d7595ddcdc3b9234c77cd008b4c70ae9d07e7000000000e8000000002000020000000fae06c47fa1226373dabaf07e9c9d8728f387bd37ca160d30828ed927c65cbfe2000000001ed39cc219b2f50bd6edd0fe85e122097f7e246be76375c4af98f02a395943340000000033b0c9015f07d9679f816193455977b6d8d44a70b9db160d39753576fd187d15cf9cea51446248f2c509bb7da3ecc38cb218e7f7ff8a343929bc715a9a15c5e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417530337"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1156	2352	iexplore.exe	28
PID 2352 wrote to memory of 1156	2352	iexplore.exe	28
PID 2352 wrote to memory of 1156	2352	iexplore.exe	28
PID 2352 wrote to memory of 1156	2352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ddf8c815e659126c245b850e5702e9b9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c00fa312dbe688717f06896f99a2458c

SHA1
ad385ea2d5386e10991b8560db235b562a15895e

SHA256
6f44fe302b8d59c650af6a18a2d36906ba1ba27eb2c3e767ce0f612ca9373ac5

SHA512
79d87337bac79036349f7fb3e056e65cc6818e38b19b91009d44d00161a32996b1e90c907837b0ec7d4f6fdb8b4d35c12829d6febda972d602dcdce88007ab38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52acc78483f661d31593be08e68b8822

SHA1
af543b3a6fbc73e15780585491202079429202d0

SHA256
ee3c9922afe1836c40a2f358315e774cd6a7ac61b5e400a98dd23b3f2adf113b

SHA512
ef3fea1f7dad142bbad7d18e7ffaf6aad7344a44d6d485bfc72d7e3b7b343f8fe1f5541d3a0f02ebdebe41c23bce884a90a094a3043fb59c6c730d474abd5227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa3b28f3a90414ae692a19d709ce422f

SHA1
bea78d4aab98f7cd5b7ee5e00ca86f30a47f73ab

SHA256
c41eec112b0ec296cface563b2a126bd15160f6721493db7adb8115e1e32e819

SHA512
380b62b9199cff331bd5ee43309ac9fb450e0ded9c9d934b1b3594c9f3540c6023924a9b432ecd836809e0fbbaab6f73c6fd4368b338642ce89db9705fc52690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74733a16d7a2b058407aaa9b4b3428b2

SHA1
0e8943f5a3f7870ca5a35435a9be3a1eba4fb76c

SHA256
843367940f7490407a119bb29a1b1b9bf6a2e453f25f76cd0e2698485e8a14de

SHA512
491d79440b9103160ebec172c87428c77b8794e65d51d393ba9225288129bef32625c582cdef0c10d6c6df32b6291a2fe5c7cdf4fc163d4befdf69d18508a302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c9f61d55e8e453cca1e12ea12aedc93

SHA1
b7d84bd483c46e0dc9d294da7de42323ae8d3920

SHA256
c1e60746d9368ce2201e56366d433a34544f3ea366ca23ead561a775215656ce

SHA512
496e8b7daf0b7970d224e7075b54749bc12a7a0941f78a326ac41f373d44d07d3ae96234be5fa8f2f243ab752a1df8034108963a4b30c6098c7821f094811764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab487ed216869e672d0e30c269beb7de

SHA1
1387b08b1dca17112a4a5feba5d43f1b23edd20b

SHA256
9f5a8c8f93758f5dd8cbdbecd892fddb9d2f21ce510396333a76a81acb682020

SHA512
8ec325b24e896b67abea97a82980547377d9ac15da65f8eb99db9e6d389fbffc684c0ea6bfca1ae4e5c6990917eb8405a536179c895e93eb5a6a17a3e711cf80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95b5ec938b9fe44d94dd1d875ea33284

SHA1
16ccdd07e28d3c6f0a90809c6fb9cc19413509b6

SHA256
1ab00faf7fa4416fe8759c74eb154648e1d92aea4ea21f41173af24268fda6fe

SHA512
1a13cb9f1a1ae9e91449481475631c5492011705e5ddd14da1e0c0a4becfb36a6b8ffc43b10c2dc32b01694e62078329905f3a1fff0c38bda4351cec9c02e295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cd6813ee10afb6469491bc4bfd64caa

SHA1
e193c3fc1dfa5930343abbf31a6c18e1cd910512

SHA256
f49589a44a7e89bf68bf47523a06fc4e8e14aefbc83627fd4762438318f0cb6a

SHA512
ec6abb2ece8d684ebeff9c41a6a4d6dd8da7ffeac379cceacb0edcf5aeb4e1d959416e493889a0c005663a220497249df20cae88fdf6b6fa3ab531e7d2c81bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfefab4c07641df4ed6f2cdf1fb54995

SHA1
d187c8fceb7f38ac77f83b5bfd2b818a705f9567

SHA256
b12d1b9b6247bb9c851d770549415f6b34b3cbeda2a7781ac7eea926ad7be71f

SHA512
6983f65c7b4e54b980bb478c95b10cc13cac053127a7fb630640c11276328e90c61d370104a0a72be981d81175aef1e361471151f6047a917540388213b3946b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee95b3ace9b9fa9083e27821527fe52c

SHA1
d497c48f066263f2f4a958ff73ac6bfb9dd6b0d4

SHA256
245ad2bb06634d1898d4082b04eafcd4dd188b76cf56039014c5251562a53596

SHA512
64d1e735ff80a82a0ce48698e75137d3c564e9746ba88acf46eae69666e42064665b7992567ae6e7f0ccea856ab35dc220e64a44308d675da7f421e138627e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42c875f5266f866f4d2eadd646ef4852

SHA1
9ecf01826397d571eccc2e0bdcf57f37e8ca8b65

SHA256
7ecb0c65a5319ea06f3d4879094e4707333b20fba9b86a6e0503f33c57b60b7b

SHA512
34abd1573c82fccfc0d552f9015e5fb084e0752c754ce697b1b12cac8422f6a2552faaf15f6c1fb37a1ce8b7618476c0361f383aa31e63be5276eb27159c57f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a84d16621c73d8e80c4a8ed16431d515

SHA1
1acd0b3ddea7fce74f33b6cbcca570258f026109

SHA256
d1b982f6e7a4cf0cfc305bda06bf1320b3d0240373dc507ce03b5db1b658e6b3

SHA512
1f298b0e58ffa473f97e6d29706062c4b56d72c2ef84e32bef4883810c39e686d9f2f0406a64579f0e4a29544f08f92ab250e91079e41c15af58109af0174351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ef26e800f01b8b9d99cb15b8859f9930

SHA1
90b2d97ade2223b6a0e4536a98bb7385c1fa5daf

SHA256
45eabb035991f08271f8d632b4fb3e458142f5e822d0ad5c0411b51e2252ad7d

SHA512
ff7f49f4aba3699c21b49b590dd2de1c36e0e3bee798e172f8e5b64ffd52c6d306fa6384abaa3c4a2f3fd652a24144739834c06dad517d31a8cbf58999eb64dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29D7.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit