e1b2e8684cdcf917b96c3d7b074955875c6588c28923e310d05e078fb4101b05

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de73d51f99a069dfa13abacb1b8c5c99.html
Size

1009B
MD5

de73d51f99a069dfa13abacb1b8c5c99
SHA1

199b2daf1d0045fe979d6978845babdea8929be6
SHA256

e1b2e8684cdcf917b96c3d7b074955875c6588c28923e310d05e078fb4101b05
SHA512

531fad21a2ca21f6e61f3995256cb48ce789fb6045ab9bd6aa860f8cfe1c401706fadf70c860c8f814fff6ce945c6e5c3b67e47de6221c561ce23b099e699ef6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000bf5239b5b415335eb3566ddd153321b2ba6a93a90cd2ded365a1637a8302664d000000000e800000000200002000000040ff808f702bfb0512b815564acd9c14fef2f05cb5508a9d6fba1d7cc6de4b80200000000f855438053a82880f069ef7114060f407d650a2633073b8b81e5dd6189762d140000000938b0029e36bee46d6218948bcf30fb869e3fdd36c849201c9a265b241b5965d1a114970e989dc78f137f0de7f22a8d9b0b4e0ee12a1ae3afd8f5d6af10470a3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417546399"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04a0286d27eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B18246D1-EAC5-11EE-B6F2-56A5B28DE56C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008d2f2d4cd2de4b0e0ce39ff604d84413414b886b0d68ca04fa60abd1ba396ab3000000000e80000000020000200000006b9b304beb7d867b6527af94a15f13338365e11625ec6cfa0974ee76a585f6c090000000a59423663f7e1a4ee263e437f23ddb61fc1720abb308cdb6de7d06142f16bdbed7ad8a3bcac62737961779ef2a8dc9cf89a463bb14492dc2ededa38c5d9a686861703c2513096c47d0e00de00ee5120262d94afb810f50b6d68a04e8e1d6421305c19514d8f942262591e536110cc814118df24c69a5fa44660129fc7d9941795aab9f30e0911f3f9cff9e5b8e09f76c400000009605875f021225981eda2062126b1cbbf709cdae799b4f64b65dcb2bd5bb133b4a77b1e4b4fee3a2bd6bba9e1577b354c1e78986e1f2f1f95eeaced77249fcf2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2168	1288	iexplore.exe	28
PID 1288 wrote to memory of 2168	1288	iexplore.exe	28
PID 1288 wrote to memory of 2168	1288	iexplore.exe	28
PID 1288 wrote to memory of 2168	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de73d51f99a069dfa13abacb1b8c5c99.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1d0c2aef9ad7ad45a14b3ae79caafed

SHA1
a790c202d01ac0c47c6e0068a36bd85028c5027f

SHA256
f2b6f0055b537f7a956916906b391e6e1b80640c234eafafad7527d8606a9584

SHA512
7e0ea9a262bfe1a5b08e9f59880418cfc16b4908e597605be78016c74c46f796661a01d6b08d48757cded82baa527fc61ad536b5e954d230865294fe29422d8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aabbf0f1967c9dad6df16fff26cb491

SHA1
9303b383f0a7402a28f7e1942ac4adc7bfadac88

SHA256
189e3ea0bda513d5ad09f5f2e109f2ada0beb4411546e4ffd10cdb1f5741169e

SHA512
ab64a9b901bbcb5542a897db784fb2a4606acea980f516587135e9eb6a6b7d7fac16014351e7179ff91e212f2c9e2c411146fe59572c0f12a9cca3568cd4ad09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c11baa842d3de4883088308789ee5f

SHA1
1568518a5711d487028ed33d31511da1c58936c4

SHA256
21a81b76b6ac02f12ff8fb5b5a33726db0564e41005e2beb02fbdb1e3d4a1ea0

SHA512
7ec2dd7ef7b8ced11887c4be70a4c530bc30d578b78b126a8e2ead47ddc37abe6211d5f6c0524f05d827ed34faf9b180f7d30357b913edba70b6c1d4aa77eff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4f0f0b0305a0785c6dca3a3c47c51e3

SHA1
e0d365eea7828e5b1cfd41659ee2be99def95c13

SHA256
10491784b0e8db2680e548d158ac06f60ec3b9d92f05481b9cb56645f60e1700

SHA512
5e5b74bb83fc2b977c9d9bac4ee9e159eb90b35f7ca63a6db8a16fa040cc2218d5e7c5535fcf5ec9e58502cc942999589ad41587f4485b0a4755062d72b8587e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d5fd2c8c2055e6d2b2ffa685c0f0e36

SHA1
fcaf6e8680d57f84da17081557f279e81a5c84ee

SHA256
5fec0d3ee608156307f7b08660ee92ee1c5dade3c1766cfdbf0e05107aee1b70

SHA512
15fa4a5917ab033a853f681dd6723109bb297e63b1a61393c53804b064313d0b282199d2a5d2172d859e2ffcbc7670c0421ab4b3b2185bcf39ca320e1e484d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae03158edce10c13358ac74097be4a76

SHA1
17f3cd5c27ce697d2ad2b874060afde1f23084f4

SHA256
76cba54698384ac5d569ea474bd736cf49584345537f0fee5eadf76b4abcdca2

SHA512
5a4908b1c30e010a8015ff912816f2db4328a1226fbd9abb6d524e7777a4a943947adc79bb58983a53eb18d1b05b0e4c2358cec45e5fa76e8b39d3912223bb9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6e7b7acc532138eed2d1bef1dd0c4d0

SHA1
f7b1c32687b5ef8adbf7c669f04878fe0ce5fe19

SHA256
038f4f6d676ddc5800a706f8ace00c1044db9e2e33166b8b6b2c915cc2151295

SHA512
3d3007c83fb2634ce691c84e77e962152e1f5f3d321f51985ff03ddbbc84e010545878cedcdf1c811b10e80c51941be0fa2e9bbf91ecaa69ac1095003a4de23e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15990d1224e5c3b808b429d875ed850b

SHA1
7a0f3b6d3456a7acea6245c7ce833ee9f7382c52

SHA256
49bee262cf2ef369b860082215aa45757bf0a4cfa2ad9b1987f470b7e123ba4c

SHA512
6d8dbce5e00396f034c422318cc66ea5c48199d7603297eee9eaf542f00cf3713eb0f4d5b470a3eb2158935b5e9876ce57be70bb74524882e1b950af9ba56e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fafeed2bc9b40f321c3985575a375f5

SHA1
48b7646123353e4fd5961d024472c7ef06613a4c

SHA256
1f552d5c06099e24dbc7bd8cd65807666d90aa18d1d16410d872069895f2ca20

SHA512
ccdc570875018856e3fdd29c75ef8581652b50d26bc00b32ea23fa6b6d1ecfbf82b36cbc59c633ba6d2e9f6ba0e85ad60fc7759587f0256fb32fcb4fa73bab4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b032350796d83234c76cdd77a1efcbe6

SHA1
431f2ba832b42df084c424e033c95463f87be616

SHA256
378bb453c17797c4607d17d0f8911948b19c8ebc3cc49344a9dbbb0b16871f4c

SHA512
5c76e18e4759c5674211b265c22094c5a72c12cb8d348e2aee8f227cde5a9986a9f11373ad2c040a046ca7c75f797123c77050edb4f2543e33172ed0760d29ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f3393e53f699defb108c80a2d74f97

SHA1
fa858e7220388dbdf96da838ff2d3fd8222f2dc9

SHA256
8e1f82cf78e07837a476ad1056e5b3430676793ed693cc408b50aeaebb01cc92

SHA512
3194b100badc82303a30ab2baae1d677079464a1395ae291e30d1d6033e2d684f71a784e23b708d84e6d36740f7aa1f83c60c4d15860af2bea6f4f98c97594b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8eeda29cf6140e6608230369b8b0189

SHA1
42a294c2f384bfc456c0134b5199f2b68ddbc612

SHA256
0d975154b0e3ba831a0f906fea9ccb85a2573e204de8aafc8ed42f7541cb8474

SHA512
a68d9118c41419f9e1088dd3bd3d1a8b0ef2fd92c8dbeb7a9629b32826d3eddad850a2dce5482dac2764ea748c99c3a89cae8a09ac8249fa8c6e28a4d5e76550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c395e8374fd689364315625b5c7044fe

SHA1
ca4e1cad0f08f5e34d89b30623e0003ebbccbf4f

SHA256
150ba9870b71a7455c8d9767cf1e69a1bb241777f2d643d233dc6cb69c631faa

SHA512
0c67e483a45f4dc969bbb15d99dd303d80c2e713069fc2bc3ebb16d16da6fb350bd401bf3e3f0f01250c2ff9e7d4fae5e708e9fb424befa77928e6dfda345971

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29AA.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit