abfcc5f1807d8c6e9773859de0817c2c2fe4ba2372daeec9b7cd10ddf80e1862

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de2e501939a277d2b8e3cd438ea7d26b.html
Size

435B
MD5

de2e501939a277d2b8e3cd438ea7d26b
SHA1

297566c77ca021b500d3f703cc591384888a96ce
SHA256

abfcc5f1807d8c6e9773859de0817c2c2fe4ba2372daeec9b7cd10ddf80e1862
SHA512

40ae460395e72ebe6c2c22cb8a41ec7b9e0c6325a3d9483964d0a99df15e04c3bbc710e428bf49c8ed65526ccc38516dafdc93d000ecdfb76110387851a27fb1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000024a7b6843110f240afb9400a0d196c250000000002000000000010660000000100002000000072cfaf5e3e76a81cd678312ff7f7fe0afb11cfb156890ee04ccc028ccddf0ac7000000000e8000000002000020000000a0b67c2111d9c37e1ef23f822c1b87da32eb54c85c1da43f677f58f4896b256020000000d385adf4ba66b16359cc2993cd16cf3c391b47c7230ac0a354dcf53d4e1be22d4000000029d58cc00f3cdc82aaddeec2f24bc1e7a6ef47f10083c06337225512674346586fa7608a2c0e79392f44ccbada0dadaa5988bf883555448dc09b6e9b4d2490aa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1088dd1cbd7eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417537204"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47AE0291-EAB0-11EE-BF0E-72CCAFC2F3F6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000024a7b6843110f240afb9400a0d196c25000000000200000000001066000000010000200000002af98dce885a7bc554191e9048d601bbfed98ff18bdaa824f980d264d6863b05000000000e8000000002000020000000eafb1bb61271debed8a7f7115dfe75dc3541e2ddb381e0f895d04142991577ec9000000097202e20ba6c2128317c082b2db077a6de71ec1b5a3ebc44b22aaa9b5a5426e21a2396af3fcbfbefbba4b1c4f280b7cb8c8e0d0c17f802c8d04f3ed2522b27ac1f9e6fac5333178d54870de5ef6cb05405d682ae5dfe472a38e5881ccfd1bd71707c710ca5663de797baad8b9b0612b53445da31a82c407d45437612c451bee25a7c09e785d1660ae5d79e01f869e34740000000d31ccdf7677980f788d3d79506d9e1b35be1da5328f224f07ed715a3ffb7a36315321fdba9955c48692ea49440db330c84649d3529a1fffbc6747930c9b63b45	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2056	2964	iexplore.exe	28
PID 2964 wrote to memory of 2056	2964	iexplore.exe	28
PID 2964 wrote to memory of 2056	2964	iexplore.exe	28
PID 2964 wrote to memory of 2056	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de2e501939a277d2b8e3cd438ea7d26b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
862b4b9430a142e70c00cf247fc75ed3

SHA1
7f0e48ce31de0df9dba85a23d7ec66301b9dacc7

SHA256
30a50f2aaf8ddd86410561926f077f34da6365e24481ecdeda070816201e0f24

SHA512
d988f0e8ec8c17e8557bdfc0f5343d9729ba97803a039d4297b7460b6d5243146c7279006721e2e0a0679528d524fe600322a4bb5057b720d89a953eb87e2e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
924a8cfe45e936f1479a2b813c8a7344

SHA1
703e2f7a46a29f483045f0db94b3e4a71cc9cb9d

SHA256
1ff6c786aeb0b3f6f0f28854d1ce66de543b5c68ca271e60969be948548e90da

SHA512
8b1fb3c0e1c74596575d6029ea5e3c9f0869cce715d2e1a8623e4fc47f5637023252a9f7838e2c9f2bfeb4401e6dd9377f6c07f3df479a6a94f1dd64f6781677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2d928054627dbba952f38ace21b98df

SHA1
738578b03122bd489c4814fb5448e2152fbe1390

SHA256
f141b43b6ebc0d23e539a88938ae0b142ad5e698482e2e065b15e07128d79088

SHA512
983ad22b80e4263d4c5dc5efbd4777f608ced093a4e2ae8f24f0244b2774bc75ecde1b1904ef50cc6c8acd8e10024636745aa4c29edc386851fcae3abcdb98b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e8ea7256d8b8fbe98334809af2b41c3

SHA1
0f3b97d45ce42cfceda8d708fffdab6947c656b3

SHA256
b4f349931300d6cbdff3e4cf4c32161aabece3328bc37035f017d9a56eb7e50d

SHA512
a346672e64e8b9700007342184a09261ba77bec3e4cbc521dc113de38d0103c43f517a70cd2c810ae4c71132187280860907e9183284694acb3f1a8babade23c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14e822eac1bd6028f5df1668d8fa4ab0

SHA1
6addefeee36263f0697be15bd4863223a7894f81

SHA256
f7b13add954ba2f9f52d22f78d0839038c7e204ca54aa56f86f08f7ef990217d

SHA512
e176bbd661446cd3c9ea8a198e7f6bcb61e76760b698185b33f4a4e052e69871631561f00b62c3ffe4f86c14f7745fcf9de707b37df6d287ab3804edbbc44526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3be5e2922abd8d9e2e6af3787a0fbc0

SHA1
25219eff36fc7a6573133586b433b258fc20c559

SHA256
43bf5f1818f55c98a6ea3993ed4f63f5851e2518f73c13a118720d6837188691

SHA512
802b828305f663693e2cc1b8594f2054064b9d53d0ed27fdd95034c8cba5542106077bc7b0ae1f91ddb51a79a6d1a8adf5133015f49ea390149028091100cfae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7e57e856c5ee3fbeb9aeaae80781693

SHA1
ced2f5b549bf8f7987ea8fafa2244c3206aaef3b

SHA256
e5c4b822431378494a8179f1f1fe0ea34f9c9bfa254b1a715a24c0f2682e14a1

SHA512
706d9c6be7e446e6b8982f0a06c9480476d5d308201287653b2692d880f06bb94f443bac177c6a00d3caea13aa646fd0401d587ba8c9fb84175ad41595fc0747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2b1c0fa62732e6c4f7a418e567d0b32

SHA1
dc4e71eb85b665f0f1b12eccd32d0e94f4d49aae

SHA256
1f01ffde0139ef238d8547ac8e1f5cd707cf68f7caa8571226fc5b0650b09504

SHA512
36f5e2e9e6ac8c8389315d388139403816362807064434b0bac98bc51ed3a3af99e1d29404d8f4a99eeb6975b83d97badd2fb2af86f20d888e652564708bd713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b9fec6d9c432967d33e7f9ac583c427

SHA1
5aaca018a813d8aa93640c01bf08f6c0addee310

SHA256
3332195dafc06cdde4a5630690f089d040f9475693c1a378d02c4ec083ea210a

SHA512
b3a7b49369940cb6fa9fd96f09d29f622c14a2eb1838cea6c568bf687acf14bbef68c34c369ac1c25e0d5bf59e591848100865a0b8d8e1197573af45b8e7e4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e1f930de87903656ec20bc6b0803044

SHA1
902c98246d9b1a5be2049ed585a4faaa1c69e14a

SHA256
2df24f94805d98e0cef1eb7e1862a4ad6dbcc4b9a265bf4dbef566209716abe0

SHA512
58b2e02a4fc1c8fbdfc5e6a5c235d6b5f830f4644ad918a8ca3c82ab51b4c670db0c8a91532a1b05dba778af1e033d329ac600df89990ca85d0e569f7580ba6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be1844386992e385a21366c3dfa2c6f

SHA1
66cf8db16a8e5aa296eba1068db87160a0e5600e

SHA256
c9f2bf1362518fd9c9ac84851bfd1f9dcb92b4f30fd41d360579aaa979dbd06d

SHA512
82a45ff24ca6c48bcec1763d5cd209afa902eb13a516a96760d65b7f197d15c9dc4d5013ecf4bd75b53d6bd0665ce31cc4655ca7f78bef157c4e6f484549098c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc89947291f9b7d6234cf66bb023619a

SHA1
4d9ab6bd3648f67ac20af2d945ca7356a215eee8

SHA256
e6db0cfb442b945528f73a3b464255819888720ef173b8ada3b84be38421352a

SHA512
a14a8c574b64636906788c432c89bcc19feaa3ecf3d231f51d43122cea13504a5d6065e7ca564bbab9584134cff2de84b991b611da3e962f08cff8cd3534497f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8d2a522cb446d53d71f881617c898d13

SHA1
7b221f52c94d45f2df2f277dc1d75a2b9b7b8ad2

SHA256
4bbd5c3b324312c7da5175e92db2c83270a9afeac7218b8fe89d7df3c53eef1c

SHA512
f4d62c63672d03e9a58189843c96b060011c07e1d46b085146e56416a024d9cd43e2a4785123fa529545635d99b8b4e1966e0dbc6fabb40c27ae3df60fb803b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45EC.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit