e5b8931a383ff9124b06686791b5b4da32288d7daed9a45ab4e1d97d766115ec

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de50d8a22982bd19ab8df5bcc7bae1a9.html
Size

1KB
MD5

de50d8a22982bd19ab8df5bcc7bae1a9
SHA1

23c606362e08cec2a240681e0ca8987aebac968d
SHA256

e5b8931a383ff9124b06686791b5b4da32288d7daed9a45ab4e1d97d766115ec
SHA512

c843738d9a89eb7bfde86d02f3ba1d6e714f08aba870a39a6cc803d93d71c6198c3407004573d4efb2f55849a0e6950be15d367478fb88907d3c3f0695c9e608

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417541650"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A37C0A41-EABA-11EE-9907-E698D2733004} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003d086f82ea76067e7444231a3b00aa7af23f8168fb5b38e92f9a83420aefe854000000000e80000000020000200000003da2fa2b59891299d6aaf39ffec59ee1242fca77202539c5c0a518f6f55916602000000086b3e4a9bd8a5c8c8b607f2f5eb00f89ec0692f928367b60c0fdf9c6a6f28bb540000000ca99bdbc7b87139ffb640f6c99037de5ed2dc2b5c08482594c3eb718ff79b8c45bea0e1f947023788b8a5fd60c47f9ccc15bb2a6629c12e43865e0aed252dc47	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f0d8ad29ffe882391e1a89560a3cd889a40fba382a95a0fee888505ecfe910e6000000000e800000000200002000000021a762a51bf78bd368bef60916f87b7d737a28e586c59d230e2c97d1364b992b90000000869f287f0f6ebc690a770b4e4ea8457e463158a883a0bd762ac0a88e1e4fdb84a824389206ec037cf0f9ad76b77551ac4772f1ed47ea60cc7799d2521a9a9fee4a523ae7ac4b61accb4a7677fc729ea447d51f6ae5a1ef14e738b3812f3b6a2f44e7cc2cf952c5367ec96e8b98d6434576fb53ab85842a6db2ef9078b651ae382a4fc8212390169abe985f7712c5fc24400000000ba2d39f8e6a1c7edea7b9bb89f3a7f807e23aa0a53b35cfcbaffddcd889d1a587f15882b792efbe418eb036415c5ea571ac491dbf9e7c3e2b1f76959677c1dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10002878c77eda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de50d8a22982bd19ab8df5bcc7bae1a9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e30b4067cb9cf5b5588321c79ecda54c

SHA1
21f16e5dbab690054c09faa89e066f24f2085812

SHA256
55c03152f133d63fdaf5d192f0a05a002fae0487de5a861137bcee055f70e6c4

SHA512
82f722c5716ee3b2875db42e065057784c1a40d23819675ac24b818095485df20a8907ebaf308bb08f7709277f1da7e2becba5fc7c29ac64b9135998dccf07e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db2e4bab01ddf6a6c5a39e2640c8374

SHA1
250c3b598f2096a07d1b3c2b21d90c4cf6342dc0

SHA256
b2f913eb3d4e3eb9f9f869337845ca487a504149de4cf53488fc7c008419d2c1

SHA512
c4b274378b53ad3bb5679722e4ebe67df4225c43bdaef7e541a535fc84fb74b7d0f8c9e36cb3fa2ea352bf37fc738b7927bbeac527ef6b63a54c55f125702c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39673728ea3fd02597b43802f839c841

SHA1
6cbf958fd86a579549449237adcd3c0a884ea6ad

SHA256
10f766d6cc269f094b3b3b86d35cb252247ff3f19d47be71991a213ce1a016e6

SHA512
c587a89fef53e45055fef33bb5dd208c830484b987ab11c221a917922f69295d15d939dedbc868e993ee64d9c961514a41999de59ff3a906dc3126104047a849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4276a0faf69aa4674a6f979cfb72db72

SHA1
1ad2d305bc0ca2a09852c2ed9c1daf524de70e8d

SHA256
3601fd9b7395c0ad07ae9b2bf71b64c87cc130b4e9038608d63e3468d89f5e8b

SHA512
5e3d566be7467dd7bb10f3691e485f2a603783cf33a3d94274d888db12a0920df67d2f83dd52293877b248a13dfe52317cec027ab13c0ba95b5103c5559a3a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f5b86155dc821be47f17218687dc38d

SHA1
9fd345f479e61b9a7c8676462aef38e3996c94d8

SHA256
1e731bdd21579c4b86cdf603e071176e1525f664356606b79451a81e4423fb69

SHA512
458e33779307fc28fff8c2d1423cb140b3fa1aeb2d20bc275e83084ef73e7ac88853aca4dea9d5538d7698676c1e35af034d8b8fdc5d6b1f57a2e255a9003ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
152f688dae50d13ee15a6d72f15e567a

SHA1
ab1ff889f725fb996bf63a4ffda06e4b1889ff14

SHA256
0fb3cc3ea8983a9b2223de21b25ba42d13b730cf28208d6b61cb564298d31041

SHA512
567e6ef6e165fc74a8c0dd553299dd79be88085b1f5b6d12cf74b4b282673ee8e11597716955ccdb924d7998da64c4e677042770db757f3ec04cd5a509db20a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9d9f1d20916911428d51dd86f7d656c

SHA1
be4457a7e5474f7f42778d30c8525dc913ecef1a

SHA256
95038b16dc1f0a5cbf1d913ec0e80a9e2b04f7ec99daa05d94acf16c2aee3185

SHA512
4e2c7d44455086f5c38542c2046e89a566cd5a821a312346e71230a7902dbe9bf731bb78f0762ce5bf00bd4ce67ee8279b32a8b9882b62d2db302e001aa1cbd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
763360ad5836d76b2c5cf348bc380f8b

SHA1
ba83afed15879a9c54af159eadb160f6905a217f

SHA256
2063f121fb36994c52a0dc3d6aa07fc4528d8722edf4194d0846149ba025f630

SHA512
efc1486c845ded7389fb2394342beab92da873fc80cbd2e07aa9fbb7bc090590b6aea4999442ef0d9bf6a7a15381a730bd801726e686d94f67313f28ced28c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6deef0344d94b4089815873dbbf945b3

SHA1
cbca4148c2ed32290dbdd0ccc41083a0296b4811

SHA256
89a8d8c99c4dd5a4590b2f12d512da5f7cdadd1cb350ea610a0c742456292252

SHA512
4d27801b44f7cce8d5a3f01e2f154567adf85f9b14d9e9865ee75c36d54d6c90c0d90100753c5358747725564695a8921c050a9160e1dc15a7d4242c81cb3400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8f53790b6f89b08c0b20179cfcc613c

SHA1
01ddd7ac7205482c5900759780dbf6d712d13c1c

SHA256
847b178af7c2a4e73d5fecb04dd38033224b9185e4044d697e0af2cd812e64c5

SHA512
a3faf103d49c177f03127cbc0b94d65018e406d34145d5b1262dd9e46b970cd32dbdfbac593dcc637b37afb50bff2e9b64ca41f66e3b4d544ec35cafc775b991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5403ded8deadf88746947ad5212bd7b

SHA1
47453a01c3e436f02a1938f121ac286b70ad333d

SHA256
fc44f2835c963ea510a98e826f32b05029d5de9d305e2a0e80623d59f169d837

SHA512
3be0d01fc0188935a2e4ddfca02daddecb47f06a088fc22e200ad9b2c46e1ceff3af2da50570bc68e2b8d7aa14f9fa0525877f7f379d99ee2ea17fe645211b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d25b829a4601ebcb23c01501acfe88d9

SHA1
5c064b961038e7a3a8eec003605d0cf09be60689

SHA256
90a5e4f98847fe22b885d869b9cb08835d4873eff3ace188a40c45c7dd3d02cf

SHA512
ad19a7ffc1e9a08f5d19f44ac510a1bafcca605c946eee644cafbd19c9d8de8debde3c1c1732127e6d6c766988c870bce28c7d7841afd219dcd5ed1740b81bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa35e7b8452ddde4c44b21a7fe186194

SHA1
9bfca3eb1eaaaf5e904fe5909b8939d444d930e4

SHA256
1da71dcb883dcf9860cd771ad6bce4a10be93326002b4f17c68ebf723ba139ae

SHA512
4cc2f37cbb3ae02e97ced3c0758bc733756c325d3a6fcb14959d35be92f30609b3f008b0babe5af06ab1f300ea666d13a19d8b57c885547370ee0c419385cc74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3028.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3186.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit