7a3c4043af8f0cac8b50de73b3ac65a0c50d9c75c5ef791d81c90773091c8eb9

Analysis

max time kernel
143s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ded207a50623be91b16c67a010fa0106.html
Size

3KB
MD5

ded207a50623be91b16c67a010fa0106
SHA1

66802499cf9c58a6ffbc7d077deb45f937280039
SHA256

7a3c4043af8f0cac8b50de73b3ac65a0c50d9c75c5ef791d81c90773091c8eb9
SHA512

afd57fac0e3ef1852069da819504de371da31f198bd5b6d9e40313bcfff634d40f7b3d3d053fdce9d698640f7e54e434e40df93b1cc2c4d0ae3a7293b870edc2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417606757"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35511D11-EB52-11EE-9201-6EAD7206CC74} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08add0b5f7fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d86f296771504028d015f8f501ceffcafa0b46261d0be986a2595276c3dbb3f2000000000e8000000002000020000000877663651ca49518f8e09fb31392e90bd2324d323e2ba1f157b067d16630aa8320000000ebba59e8a4cb21d7160e119202181a133ea8d6edc962b0118c954d3e97924024400000007f900a71fd1ead5f76aaf9895986f0ba18830a92c2f8aa972d9216ade062d9b5572d7165e4158957c77268a218f1a0ea71fe25fa935bd945f56b12aefaa23a38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005a5e3805e01e2f48c8a8895a72cbb9fc52d6269f21067321fb651abef86a3f9e000000000e8000000002000020000000485ed080953e9ec75d904d497b99c051cfc072ca24e9f1860b7a50621fbf59f290000000b722d100efa252674fc3648820a3098e12b4b326020fe3220648600b1006b853f56c3528882e6efce9f3c4b0109d58df657dd616c3deb9923b489972d89f0e569aab0e8829e7b41b082214ff79abdcbbec78fef310b977de7d3c8290be771b202300ac548ff1f6d786052b6e5b925c14f8d9acd6ddbc68e6b9417570c72a96528d057687ff4ffb6fdb357ad6486a1a9e4000000066374c6530ab33ad18bddab6521bbd08aea31748cc7aa861e6f85f097e77ed13130fcf4be5e93d7fa424d857729e47c8da3ea01d8ffbf845a4035fdf20648fb8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1524	iexplore.exe
1524	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3064	1524	iexplore.exe	28
PID 1524 wrote to memory of 3064	1524	iexplore.exe	28
PID 1524 wrote to memory of 3064	1524	iexplore.exe	28
PID 1524 wrote to memory of 3064	1524	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ded207a50623be91b16c67a010fa0106.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9f2e17403726a8c87af92a72f172fc61

SHA1
42e88cc6edcc4f0a9c49fd71861e0df8d08c2487

SHA256
00d16eaac3301719b0861f64c5787be4eca975e44e694143d42df2cc4f32deec

SHA512
97fd25a8bd4e5b826397f59c784caad337b0175ad4cde1f7a98508669e9508c403b4a43dab346fe315e290c7db116c110aef848c498972cdc77af66f92fbe34a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c867337155b499905a49f71e4cb4e11

SHA1
78d327880622bb54b99c615eb9b8265fbc398ba1

SHA256
e40c66a4f3fe8dd0e3bfdb5c1522e3b17c0c20565e9766fd7314691d368835b6

SHA512
d2c6bb0bf5891962d5a216f591294c23d5cb815a81a6d3ebe4860f6a9f82777bbde531f9288856e4ab75ea408fae597bb000965da711c9ee21a53a7df5d15ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21b6d133fc53e7efb0af9d604d652db2

SHA1
48175071df5b86de94cdb809484cc53daacd070c

SHA256
e0c60c7f332358ec59aee0ef37d3c90207d0a2f893d63fd994adab3e1b4a9e97

SHA512
3a747c1838b0634442d90a46414c6af1e4e8aaee3f6acdc7acf8d709939de89451a889b5fbde7a34b25c4162ceefc4fa6dfcfcca3f5992e2d616d50638d3928b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be44093ceba130b6fc1a787417e9b108

SHA1
afc8d4bd931933582a06158eecdc08199b8f496d

SHA256
06afa7b6d3c5aa310a0bb930422a59d4d261ddd029c3d748b213c612dd945137

SHA512
34bb854f2b70e3237ad71034ffed34b3df3e5b505db3523aad5346bba62872bfab49be22430db8818b891ef2936eee2c1b019087d4097949f88b0541e6203cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6e9edb93f5418c1e06b6019c6c21321

SHA1
d4b086d63d00f56ea91a7add0b7061200f9b8c17

SHA256
8f28687d2061d60ee799fd6ebbd583aa012053fcf590ed1d2f405417097b873d

SHA512
086e1a42a41ba65b97a6b535a5e5f06fc050f5ba35b9b7a26d6c2f00082544bffd88509e3d7b5e2686bafd5037ba8881fd3852dfa080957ea60b40ec8cd3fcab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cbd287c26b83d81857f8a5a573775f7

SHA1
0a1f8a1c5e713b7df73a2a380125ea577e9512d0

SHA256
5cac110ecb91f0ff67eef3807223b5b56bf6678d3c3fa98e00ddece0b9fef5c2

SHA512
f3265e809ade15f94655c0b93769584276498e1689aca3cc89f15512ffec2a211ac769afabbf968d17a121dcf6a2b3e573c8c29b2cdb50ed370ece265e588d94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9acdf2d9e46be3619fd56e294ef4adf

SHA1
0b5bd1799ba175d744b562b04d38667a2efc825e

SHA256
13e05be6049a8a5ef62f0f5d04b3dee8f6503ef4e2aed4f3e537546d95104b65

SHA512
2a185b48f2c0b1953c9feb6c1a292e10526875f9968a5b06b434d0b324e956bd360c2715451f1162a8ea6ea930f38632de6a375187d28f3508d290267f2a3fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7668924c81188825cf227e4fd67b17da

SHA1
f3431a342eed4c17ff26210b3d9e1b38fca30b2f

SHA256
cb189d616e71b0b2b6e73c141aa2b61e24e7f528c91972046a35dea1dc38aee0

SHA512
c658b70134d414289701be380890ec453ed87d71ad7af08bac4408b19305707ae4a619460b7a185f4b9eb89b013941a00310a11317d19cc4bdf3b4f40e84b3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e5cb2b194dc057067b65feadcaa3f8e

SHA1
092251b1630065864ba811afb11d425081b8fb7f

SHA256
2fcbec305616d1b94c75e0953d55340c35902253c4ac2debf476f8507e24377c

SHA512
ce7abf22d49b1ad9b9f50fb4c53f84cace7ba916faff83f922f10e8cbf95072e0395cbd78fbb35e9460633ffb3de075a10fee4bffdd53757a3c78508aeff4f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be35ee2163381d20ff5176ab6cf545fd

SHA1
07a3b3025574dd7e65148464cac6b1562011484c

SHA256
76fc5117cd48bc446a254f24ee4dc3da84082e11928e59b42ac11d362f671acd

SHA512
a15a86c879f4a679cc6df537c607788765a7e0a18cca97a931c9d3577b0dfca38cc8a43592ab8c056e8da5f0d134c51ad783be40f69aa3d24d97024d03764f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6ef9eb14e3035b285bf42a765f2e0b18

SHA1
69b60f45012790e973362c86d75ff295a3ec6d07

SHA256
fe9d38bad258394c6cda01ccde1ce51ba63966fa857a4fcaebfbe71f2920f39d

SHA512
bf997908048d6da7cad30903bdf14c06fa0459db79cb827599d380b944ed6315fc9eee6af51725ff9b467e66b8bb396964271b1ff3e115511b931348ac845fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B40.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B43.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CB0.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit