f966c17b32e69975377657979d5d0a316335202f8f52059b3dc025c6a2ff30e6

Analysis

max time kernel
147s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de872df80c9a447c0a7b1894447cd53c.html
Size

23KB
MD5

de872df80c9a447c0a7b1894447cd53c
SHA1

39407c58171f3abf56fabf0cf3a092dcb0611c7f
SHA256

f966c17b32e69975377657979d5d0a316335202f8f52059b3dc025c6a2ff30e6
SHA512

2fa8ccc33007355277754c9aa0bcf4c92574f626d7a6d17cc0be28312367c5078cd525506df615e89f689ab4289deec7f03f6dba055b3e801d8b80efb7d121d3
SSDEEP

192:uw/ltiOFace6Cb5neSmVZZ9hzTp4YxrJanQjxn5Q/gmnQieE5NnbWxnQOkEnt6QR:3Q/WB7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d18beed77eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18BEC441-EACB-11EE-AFAB-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000007923ea500f79050f130957033b37f3187afe9e08bae5f57d5f613e567a1d631b000000000e800000000200002000000064b4bcc546f6201cb4a0d02a8dfd25549744a98fe697d0714a20214566e97c39900000000c67dfc786078436d2f1ba94e76863f298a500414f63f0c366733b86f46b58f334320c37bf73055b4e6fd13ee53363a7e94963ab216a3ee4c4563868cd3a53d50c85a288ef78c3bbefbb19f01deb5c6456bec02af0339d51ef445f5a59bb2e7b64620e600e00d03fd4d1db6fd85a816d147f925339c1b21fa6832c4353b163cf4b73163a40b3ad4a433efcb3c402dc1340000000a5ca6af8b1c798c0a5f06d1e99ab9b63554493afa4b9ec97f6da1cecbe3ef6b1f0a1a401b4b3d39ebf5cba84842ff5a4a5af4ca9bbb5ee8c2be04b70c67dd039	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000002fcca53e6622a9550b3781efc5ded5a83e25755dcba447dbe29bb0cbac3d5aef000000000e80000000020000200000002c2e47c1189a4a39ce189b28730b67c39f23734a85490b86a4c89593c2c50ab820000000032248c9567b14ac41cfe547df4028343851ddaac5cebc624bb16ff5a7cf062e4000000087b397848d7ab906af54dd93ee499ff8eb46fdc062e7d785118ac44e1f7e443301eb725a6f2d06f01529e90c73e34d7ef90488261bd27e3f8e4334c604fbabe9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417548732"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1528	3068	iexplore.exe	28
PID 3068 wrote to memory of 1528	3068	iexplore.exe	28
PID 3068 wrote to memory of 1528	3068	iexplore.exe	28
PID 3068 wrote to memory of 1528	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de872df80c9a447c0a7b1894447cd53c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c91760da2c19c829089d4bf5dd998c4f

SHA1
43aaa9e8238ee6c9970fbff10a156f40e6793b3e

SHA256
da24d9957983ef24306ae8817bd1a49fbe1d8f2649a3c5a1080e30bf403d6a63

SHA512
9654af216908ef3ee09431e96d795ea7545b4ad8abda71e3a2dab532b5e4c5842baeddc9509169919836eec041255003c7a5c5e311265664d9c7c32fc0393bac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5c2e503b03d73503f27f70df6e0c570

SHA1
742ef327c8e6de6499f0d7d4fa4cf7e243aa2f76

SHA256
5cffa7c504f85a5d5c61c79f0234d703215ba663ced994e5feb789ea444a11e5

SHA512
82215a9233fdd5bbeae78a5aeb112cb480c1dae270b4966b3c8708925e2be88c250d56acf8f0ab8d49ac9e3e72060dc6ddf583066019d0981b9cd0a224dd9fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55af0fbdef483d885db6ffa283580bbf

SHA1
5f227c36ccf58063983b852bdf78b6f1d394dc50

SHA256
3661b25ffa0503124b22f500d0ec998c11ddff743e709017a1c414515986e274

SHA512
1220b46bfbd3f60242377031928c2b0a25c841a136e31d690c78eb6eac5b604353b0ddbe695ab96eaadd27713112cce18e2e9bd176d42ef524f4f11aebc0cc65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
755d2b5d2c46f9534d4587ffe8535447

SHA1
f8ec4832103cacb67ca590fde7fc1812fb091e8b

SHA256
18954753d7b1b949f987672ac2cb0bd7f81745f18f9681a8c63d8a84ede737cf

SHA512
880424fad922cb29f24eb8e0d4482666d3629118592fa674cd60a912d2a29931ecf952cf5627b9c54f1f330ade05f4c4d5ec7c3140be7f187ebdf63706dd6a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28e21efd465acb7c6d240d83613175e7

SHA1
718223eb74de0f205f367d3aa837de9bf9282b02

SHA256
d2f875d5442a06efea1eca5a0a6688d4b6372a6b50af28e1fe624e099cf88ea4

SHA512
ac17c074c34f9026cff1e04b82dc4ebbdff1ffc24bb5472202f14e1a39bfbca57d53af36ae3907ed3a8577b92946021894529c0311eec983ac65e998f95ac8c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1bf28a607ce6fc48125e7504ac3bc16

SHA1
0ec638e77f5445949e38aed813a669b74549310f

SHA256
966600e815927ecd5da897c706d6062a04f040a35ca398f65156f3d6bbdf60e5

SHA512
68159b96b8307f93627de590b697a1fcbfe13045acb03c0f053523ba118ebd194efb87e029239e507f641c74e4f8b0a5e0a68ee664afb7ca68e936da1d3163e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fce69125b67959ed827daf72c6158132

SHA1
db9dca26e3f26541bc43eb5d21895522dc91912c

SHA256
010b7b538efd6860a6628756e7cda0964636b4a518695bac843bd49cb4e945e9

SHA512
89ccc745dfc81d9798a32f3eb207de21ce260b82b7a124c7263d0a5c5ea02764cf47069f8b491fb05517808d86449c16895565f02dc52e12442394d930b7d50f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6736c7f751866967836d0b68f98e233e

SHA1
e1565992946e64517419ef7489b8838fc19370a4

SHA256
154cc3b62e47568b16e2176f961806b7e213f4b50e514b7c1f3778eec5efb6e7

SHA512
c0d351b93008bbe71f3df849728605e07e594d12cfdfcd6f5631f7104a5ee9fd71ff8056d683f1c015f3a1e6e670f6299e899de6d7077854a3365e465ff728ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7769.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit