d0eb99a52a5a492ba70f995c39af570d8e1a636dd5db07ff227626f08b526c91

Analysis

max time kernel
141s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de5f332bf8cfed2d7b5ae11f48de3466.html
Size

1KB
MD5

de5f332bf8cfed2d7b5ae11f48de3466
SHA1

542e46961b586697a2f2fb87cbbb789bf78e8300
SHA256

d0eb99a52a5a492ba70f995c39af570d8e1a636dd5db07ff227626f08b526c91
SHA512

be37e0db8b7340b62018d787f9a2a496ca379b995ac06c6c9d38fbf66acceedd9aa2297338de4d9970dd45c2da9ed7ff38df111506c40421704abc1ff33a4cf3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d212ddcb7eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{020DCCC1-EABF-11EE-8698-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a7d0ac3844e8062d057d15d1d371e8568513ebb0b96b9b77d0c4dcc81f83ebf2000000000e80000000020000200000009bb834b04686c1f77fa698be3b66ff2398700fb6ef18e9e9e9d40e343dcfa5f9900000009601b0d8a705610d5c14b67c396d93d28a3b34a96ec73e9cc75240688ee72839b63ad53726c0d9d858afd963b2f278fbdacd46c812df0bacc0f7062023bd65c325d0e7d0caa89ed6d1a4fffd963be88c59975a2318b726e2202dcfcb6fbed80612b50a63ead58276d1c9f9202b1eeb9f93beaabea1895f2762284b9e389a8c62cbb2e38f23205104ff6085b935111f2340000000a61cefe2a106bd846e1848c7a67e6cbcea0e3d6d295c287f9d6ac3c43b5ec11fcdafa0dfc2f4cbd2315e9befd3016bef2036e7753ba8a7f49260491b6202a701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417543534"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000002d0e020e09bea9f324e5073ff77dde59c41df84ba64551a6a021f053b582e17000000000e80000000020000200000009f1a621b1487cc7065dacf5a538e9a59211d5aebdd992ea479b54bd5936e8a6f20000000b23d2e490b2c1244b0c12bc3abc658d7cd07338e51fae74149117298eed0932e40000000150c77793ce50021f85c739e38eb01450eb563ad828904415a16ab2e25a2d5418a2fc2de084e5d2538c1063ede2eeb9cbb2dd1495a1d6a768d27886580fd6810	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2076	2808	iexplore.exe	28
PID 2808 wrote to memory of 2076	2808	iexplore.exe	28
PID 2808 wrote to memory of 2076	2808	iexplore.exe	28
PID 2808 wrote to memory of 2076	2808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de5f332bf8cfed2d7b5ae11f48de3466.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddfffa489e061f3a060c47a7942c8274

SHA1
076dbdb52af6549f0665b9e47dea37fe10ab04d8

SHA256
0ebc9105f6310756890b3d181ef97356e1295e968b7175ee0d0cad81aa3ed32c

SHA512
c21cde0de93177c1d72a480191efeb8bf6c53b085d914de5903467a1076ba870b2d60ed37ad4cf0d4047c3eebc51c18d53cd82372c2d5424bf6d1eed9581b67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
887f5fd93651d398bb381d7680af8d47

SHA1
ed73b8b0d629cd8856e981c8399fff9e926aac43

SHA256
6b859a4b42e59c03dd8bbc1483bef187fdac946be0e68432c682bce83bf9b5c5

SHA512
a55527bf065696cc13b86335bb582ac69e7e54931aff4219118a1d1d137f9ed5bfc5c0c027a0e2ce6aaec8c142e277ec6689b0ea4bad96f2aed821800add38b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b2e793df79907a7413f3aa371154b4

SHA1
f9517851a8eaf417f405e51c8a4635153c3c8187

SHA256
a68272256b367910e5ad7fbf14e2b12594bb4607d84bdf804053b09e093e89ca

SHA512
31f8764c04b7b75b6f1900081fa4f5746eb641162c635bffdfff5db39aca43ac205438cee9b890bcca93f06a1cfd163aa112b733ca58b7263d19283808f2ab4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33d82460116882e19b660ff1e4256e4d

SHA1
fb6e8cf1514cd49553f72dee23701c99ec353c7b

SHA256
cd0d31ae901cfc5134883251cfa08950d19ff0858999005fe40cd7b11d1bbe45

SHA512
0d96781335bd6033621de75fac21d91299c904fd7403bc9161f57b4ac69de89538ca8a204ba02750115d75da8f96b64ce4f7f5789b8971f1aeb10d6b8e6d4a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e71cc652399d9c0b947cf09ae2cc2b0b

SHA1
68257d78b4b51c1b6d4faa3fdb4892dd9ee130c9

SHA256
cd87ffb77f24d503bbcfb97182a357b563056e66af07f18606d5e6a3d47274c6

SHA512
d21f2b46f8fc4a543d8ba14b0c4cb95dc8a64646480b7d458e84f3a95841ab77d5bbfef4e6430bbaf47e1dd42cf3e5d2d3738084dceacd2a4f4297fbfd1a46dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50dbd19b5d8a239cb7bdbbed4bce80e4

SHA1
f3d3a2b3dfa5fc4877fab639b064cd48b7fe7d3f

SHA256
b13a7e96993dc78b17d0989c1b88200def3e409b0964af0770cd1c4eae5c4f8f

SHA512
5b1926da1146e3077abf22e47bbf73e8496d402e2bca1baab565fac41ba2e01503cb6d5a38e471c26fa9de0e0a268a9682498c202c315ae60bc249abfe672acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee98636660699a2f08b6de96cd32cb85

SHA1
54719b8f70fa82eccf335eae91a09b631be65760

SHA256
a7e4e4ad0554f683ad9063bc4b7431bc724eb8b17d186f87c67a817795d03441

SHA512
c88bf2e8126d1f65987082d6baa1841f0db4015b453e0bec81cd92e81e09664da85c96df5e3ef126ce72a45a9f93d2744e10849fe009a459654412fdc37b1d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
583e446ebfd047cbc68413f7114c1ef6

SHA1
8d5306d3e71b90641b9e18f87a74f1c2279debc8

SHA256
8107a6f4eb58199f53e67face05f519a4eafe41df7b5c493271e4a57cfe5f2a4

SHA512
63aff723a996558e0b48a48eb77746090333a4f4a7d110afc81f71d5b35e84e4c30e789472462b18c401383e685212e97cc42170d6e365893247dbfb30008e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6aa86b52d5ff65d316b222990be69af

SHA1
e342eeb8cc00431359a669d6020a59f5efe672cf

SHA256
6fdf54d1c129c42b60e74b98fa3bf4297a8896061df26b0dcdd4a1da107dc338

SHA512
02de22ff40acf8badd88d75f472706615803b645b66df2b8d563a1d7032341fae0830d8c52b04b0308cb5e7748701d15f84d12e676eaf2e48f279929536580c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fe62c519e6e602a946ec77f05c01cd1

SHA1
2ab6d35f621858c6aa79499d6d9e6694372c66d2

SHA256
7a81005a173ba389f6ebdfa46c12e7c9a315ff677780de36a4ec95547f3a0782

SHA512
e818cccaa4fe79807e4761de13b2287953b0a333de77261fbebd323c6d75d54bebb9c96814b35b6f5259ef4d25504fde11a8fca29f3a67206a7fca8af7e8a2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD9D.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit