e106344b7736a1f50a8817fb6caa8175f65622dfb88ba0d63341dc404974c91a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de94f59ec8cfaa2a61f34a56b5903d9b.html
Size

44KB
MD5

de94f59ec8cfaa2a61f34a56b5903d9b
SHA1

3d1b0d3c6c14d953613ba0e99647d55df08ff6e8
SHA256

e106344b7736a1f50a8817fb6caa8175f65622dfb88ba0d63341dc404974c91a
SHA512

e9c7c3448cfac789eed03585cdb1b493b07f327f9676f8d51f4c1c9bd0ac39287b6fb8ae9bff736b455bf2366ab33f965a8161477c308cdd6a702c3bd2a6cdef
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2oT0elgitUgMn+fk:mZJtV0elgi0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417550293"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000003db7af9fbd5ebc1db28f21ae6074e817764f5400637a91dbe88ef54d46e64605000000000e80000000020000200000002f95708acf8bd9bb269a4e1aae24ffc9ccfd263275ab46a878418353c2c8f17b900000009972d8121d3fb9bab085ce17cb0095557a2dfab3a1314ceb07e07fac982216d8a7f5b09c7f53a728e28650b471474de582fb32fbfa6f9780aabdb5e520aba8f4c3337e9f9d7cd650278829a00615b07a3378fc0ea0e7da8baa0518985cd8440290f006ed2d2f4f4cb3e842291e3e9d65731ff92a49feb71eaa572722a200e03958e93cbabe0c962c403b05e363e9254f4000000098a02b124e1e6101294c5d5e8feb925185d99a34100cdbd222035a6aff310112c78724d9fab54e3e17895def3fa24009f7d5ebd435c69e407355fc25fea22809	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C293C9E1-EACE-11EE-85B1-6A83D32C515E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50665dc9db7eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000073584adfe03be3672b8f8ca4dbe34df07d181931c82edd405392c3ceab4556ad000000000e80000000020000200000005e9368610eb1507f531d486e80440f29ab890ca4d18cc85aa49ada0cee7b05542000000082dd2a8d6000299b3a8f2ace727beaa13de6f10904669c5d827728ba6ce6cccf400000005f1c942ef185c9b5c34c95692491d28f5e1ade6b5ae35cdb70f140225accf8dda67ab23905629bf68d755b390dbbd2e9fcada38d0072a23ca6f9646179873356	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	iexplore.exe
2728	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1216	2728	iexplore.exe	28
PID 2728 wrote to memory of 1216	2728	iexplore.exe	28
PID 2728 wrote to memory of 1216	2728	iexplore.exe	28
PID 2728 wrote to memory of 1216	2728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de94f59ec8cfaa2a61f34a56b5903d9b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94fc84b7413de443fb5dc5057cd9e298

SHA1
30dd70fe7ef565fe2569a1f0ff5b56b3ecb95d5a

SHA256
24fa56cb6aba6eef8d269a8d56b7c449353af1e9acbdba9c22c2e863793c54dd

SHA512
4edef63e6fbb0bed886f91173770d1b2286a301de13896181d27dd22721f814f850901f71cd04024e047e9bb6f749a5b1ee2e96e441afae3bf03ffc42d86d483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44b340f794febd239aceef9d3d738825

SHA1
25579ba7ad57a1d63d90fc195c350caa8ed33072

SHA256
f876994c692400cc25eab2768018eaa7657ec4ba8b61122f88946b5098532545

SHA512
153201a978e991bd138d7aabd58d0703021cf7722d1979be3802ebd912675d52e3e974589bf60b3994e9a2f788397f882999644057d7ce6608d8519f44b64d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21d0301dcf5301e9f5e3c7b1d8bb24a1

SHA1
64cdeab6986099012a6c283e56ef83cfb59fe332

SHA256
a21b0043fa7bde7115895bd5fcb8ad26904630ef31e65366ee15439d6618c98d

SHA512
8083b8ae21c270066a81273adc577b810b5046c913bbf484854373f70505e7a482f539c16462ac90f38f918ae34d9d6e4a4acd26c749bb05738029244d15e2bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
602700b14db94d8c3e970ed4d61c7785

SHA1
54baf47e7e996ab0f4e6cb8947aaac21112f7af4

SHA256
fc4d972c6c59456665921622570c5eebfbd61f306ce29ba5aac3990489fa48f6

SHA512
4aabd390f242bfaf53084bfa9ffdafffd585d0d37b2808c6cbd6868e208c06e4833dc7518724b09e1f6f9d86bb9996f757d1315855c6388b63c50a072bf80a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73984b81d4bca1f8b2a3059edf97273e

SHA1
2feffc19f345b2cac028a4cb434e125a09923304

SHA256
b8277e7caf36d7f3354045159e7fb45e997cb7e66cb48121ae2c04280978f91d

SHA512
75f0c36ee05cfa3148c4f3c5099f96e9f17fbf362a216b4a0d39ae50827030289b11b83b6c5aabf98935c9a9e1da788a900ceefeb05e80f1196ea87a748ecbff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d46e83549d8f6ce56ee38bd7248864cf

SHA1
087453a125f24058b4fc9a1238e502fd87436b26

SHA256
55608c624968d6cf04745dddbec34616f433e3790f2a0e69bb4e930858dcd44a

SHA512
7d8eb628fac1e2b9b48d917063b2d6094befb475ef12a4e554defcaff85e21adc920ce05b18893bb8ce6e338994804396c0202c404a5bacc0c671b53f9b0a81e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c84f10f56598c2156b87321931724fb6

SHA1
13f7aad44ad8c7360daa7f1bd357b1e0fbee0433

SHA256
8aaeed1ded1d24e025999416ce249009fabd03dda9fdedc33dd5c37cc3e95649

SHA512
7dee5e4fed3d9696d72218a86152fc8cca54aad0d914de9934069d712153b4b4c045a579ee28058355199aefc199f8a78e9564ac4a75d735f01db5193b9d2bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac95157412cf8b00348dc8f3fc366b32

SHA1
5c609c581aa463252f2ace2a45416814c0713388

SHA256
e57af83b024ea16de7e04af2d2d6b814cd18972278bf06f8be8949fb9b57b9f9

SHA512
e70e5fe32e764b27c612f381dda6fd4a1ea2b1ba3d9a89db4a2abb2e01d1603e18daa9d7906731bb697e0c6a3e9895829825161b94878e4268b655904b616fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60f88446eb7340a222f45d9edf833769

SHA1
bbc1aba7794baa692e362a95cee7fae101c834a3

SHA256
3931cea7869cf4ff6e9a69c2930d9c75f82a9ac999d2566b1767afafd868e94a

SHA512
531728650429854211547dfdc0aa4489557a861c2f651ffb1e3478bc606cfb848d661661bb79ebd025a4b3a0d963be4586e779617349c0a1a99c8582c4c75659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c4e242816fcdf7a59277fc69fbcc532

SHA1
f9be51c208de92c7de348dce86ab34a6eb9f1d4c

SHA256
6b283ddd00dd782d9428ca6bdeb128e4a772ae4f854ab95c9c13799388726840

SHA512
a6e7cddc6bd42eb77d892bbf02bbc9d7538cff2e1defd7ff132de3895dada60467503b2afb63679eca0e623e13b51633531e14759aea9a0bb6f1c60ef0f8c67c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9dbe554532de660b4bf944c32e70b4e

SHA1
bb40e8b7471edaf5c6eeaeca3ae62e542362a609

SHA256
d4722669fc27d5beed260480daf69c914f589b8de5abeb85aee40903d3ae5b82

SHA512
579889cf85feada195f0565935bc1dd524a8b72eab4a33ca79fedbbb44b0f921b4e1abd516a46a7d2f5b0ed46ba40f8ff06936357c0686ed8536d03ce0fdf53c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb304cce3cd408da3e84c71382e2c90a

SHA1
0b9c0d109dd0dbcd5169b64d336cfa03426157a5

SHA256
fa9e772bf08635abf31610e5498a3fbc68d9ee51b0de21ae3e09f5bb0ad200f2

SHA512
3fdddb208fb2ee9da1a9716c77dc629d7d272b500f55d1bd9aee82960db874f8864ff53c2f0623ac3cf47be20b1d3e45ea92dddd04b4470c8c0257ba15352288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a591554728ddd5c33a8d0583a6b5375

SHA1
8813759b5035012097ce6892635e6d2654ba08c0

SHA256
d3daaad09a08bc2a706639d4e143101e8ba9305827615b5aa71a663f73be298c

SHA512
9e010e7353e627f84605dd69f3d280eb9d0acf8b42f7439e2843b897da2ddf9f715d486076f4559249b0cd4b66a38ab6f551cceef3f2935182e0391d6cf8b33e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1040e6ca16c636d0a9a99382c32fef7

SHA1
d3f90c5dd81f4359e004f8d57e013b5f6947660e

SHA256
d439b478fce9c2ff86af498fc29f0ccbf53aa77946d560f40b4981428272cb30

SHA512
c386eba2c02a2d4feb7be8e8cfeb387d7377bce654a71d66e41270aebf55ddba9087da10f26d13c186a99b00276fa311d89386bb59b43f31e80fa1ec568369f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5a0764e26f98763ff22826066cd4654

SHA1
c51aec5aea96d6e3fdc6c1e2239c9b2f6bccd765

SHA256
d9669ef8a9a5fb2eb28fc6c026a7877a835c0bcab49ed361bf21703f33f4de9f

SHA512
b7328d554aea53c15e0f796c6487884e958e1b3af68766b773780fa4710261b823cf5440c1e398842f255001ab3e924a016a197f5cdc2adb1827a231e9617579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1e104ea467eb64c2470917696cddf72

SHA1
c1413d3c47de1ed9c8ed746e928383984460a27e

SHA256
f56446222152ffbaf26b2a1618d39f3274056285c44f83dcdb72ecc55e10bfd0

SHA512
b5074a4a352ef58f2b70bf5ee3d73d7d1a5932f552e6120cba73aecdd6aa1b8d58366278270cf147d6e5d54c3fef3c3a3742a61475723c6db020c196bccd35bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E39.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit