cda2899f84cc78f7462fdb2fd58b89b0d9cdfd8ad5db46df60966599ed439010

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

def2cf958870a6405d3e233548e0f5fa.html
Size

51KB
MD5

def2cf958870a6405d3e233548e0f5fa
SHA1

e6662579b2b60e734ba9015a3fdfe6f866f54a5d
SHA256

cda2899f84cc78f7462fdb2fd58b89b0d9cdfd8ad5db46df60966599ed439010
SHA512

c17518f0f3c051a19929888e9508b1fa9df97b633377098762f0fe418377fb7c3f62691de638fc61d3501c2fa0fb7253bd7c06037ddfa85ce7c16a852693e00f
SSDEEP

1536:KR5CFLeJdqH62I7YT3KvrnQO8SOcfErMzz7AAyqwQGvkBAGhqiajp8B:fFLeJdqHGY3KvrnQO8SOcfiMznALqwQd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32894E91-EB5C-11EE-B17A-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417611042"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1812	iexplore.exe
1812	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2772	1812	iexplore.exe	28
PID 1812 wrote to memory of 2772	1812	iexplore.exe	28
PID 1812 wrote to memory of 2772	1812	iexplore.exe	28
PID 1812 wrote to memory of 2772	1812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\def2cf958870a6405d3e233548e0f5fa.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
38b3b9521a58230c4c67c36e0c262a93

SHA1
cbc43b9b04367f76d4870a387db01e40b75acea2

SHA256
cf7d15b8a5ac7a0960568a7bf5d8765b7b480d9fa079c5896b58655b7b2bdaf1

SHA512
d68416ae5009cf5870f13d57f8499b3e81bd33e243b332bc43c71b07eb9555732831e5e12b3c255085de2885b46e5dae12b32b0c56b1f1c75c51ad167bfbf5ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6634f2d1cbe75c1b7d94409a4ebec9e8

SHA1
822e7b2b14f569f5d0f45da0f6c9406fc4bd90bb

SHA256
59183eeeb9aed228b87494abb01c1bd6d12993d61dbf0fe17c2110e6393d1d32

SHA512
2bad7f2f4a5a0822d12363a738b4eee23eca9e595430db0be87e1a1347906f440fd7ffcbbf97afb1ea3794818aaa2e10481dd61605345c952e56327c69db829b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
470c046fb7cce298d19c408b5e4e10cb

SHA1
88db2ace8bb178cc30b24b315901d4df91758744

SHA256
9f1a746d3255822f1e67cb2cb7a791704de3da22c39a260d49ae1769e13cd124

SHA512
5f13973eeff47c00393a4ac3bb206966ff3acaa4b1059a0ac9f6f2ab96d3df90fc4382769f568642ce1ef6d8aaecd386f7dc728b071f251649683a14a170329d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c02f261be4720b058fb8be76fe4420d9

SHA1
91fb989f517be30be85bfd18fde820d490784f54

SHA256
3a64ae7c880a290571d2c64f51a88ac8f3b93275fc2e1a6f40285aa2bffd5d71

SHA512
995f7c2f1a4bc25b2c69620aa3385f221c4089dd9f359c75f520b058eb0789f015ee5ff13bb2da03279e6ac8b7a03231905851de339770c8be0e09210ec9a21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e09ce0206501037f2a730988f4d2fb55

SHA1
58bd4e1c865fac3889ff22d5824b8924f59fac50

SHA256
2a6ea5076b71430a919994f5d93e3cb9e023160544aacb110800f2d1b07d6ef6

SHA512
f6b2f795ab4071d74a1e61ce082152a79b0b836acdfa194c8dab52eb66f4ce7a20bbd90e0f9b4b06212dce9894c9defddd6887788740f265fa260f2ef81ab64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
301eb1b4d00f80229c34a6b164e255ae

SHA1
bc0a00915c1874ace747ba216955b1de3bf299c5

SHA256
8d249af2e0be6010e75207b9af0b3974cb2731cac3a5eb3a03e7367e49e280c8

SHA512
f4b6e47524972c96447463a01cbafbdea51ae6d5aedbfb602d91af516aef040b89131d5b0018eaa8bd3e96e31098026485502327a238eae99b73d7cb2be581b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be75b55a6afe0beaa856c37af2a8571b

SHA1
48ee084d1da2ccf7b9b4e068b23666be63638002

SHA256
b90dc7961d1d755e3775f3cc17734298208135a073541f7534fe3c24e9ee533a

SHA512
8e8e2737755edc4504184dbe46737e0263dbb131dbc283addb2b502a7a0d9134f8a1c9547f9a2de1b9d417cc832092ed1e64b0f32dbd477e191ff9b257fef1f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0187cba5dc2dd5f4e8b6ba6d11b3535d

SHA1
d815d3f8d02c4d39787a9fe499f224ef65e0eb06

SHA256
6c7c05e7fe7d7d8a5241dc29d9fc73291c344206e0fb9373e375fd88e35831e3

SHA512
929c180fa99d028050291fdc70a73be1e7fb1708eb35572ffcc75ab8ecd885251a7bc35d84caae05bbecdf8b1325ccad10e14e044b129d771eabb92f11d182d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14d4ed5cbad3f9c9e0ab8590c21da1c1

SHA1
a65a520e1e8a01019a55a9cde5c62b4e76c28d64

SHA256
fbb8c6b953a3683104340d385e14e3cd91fa1c1973fd53146b577220c392f3fb

SHA512
f73f8120481f5f3f51c07e9b310fdb15d4d05074be6072e832f2c1554335cb49f1fab89404c0a87f820b9b645708e26a52c1653eda03ddbf194c6615307ab6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d2800fe90703102b9e66648081ff0af

SHA1
4e044e491f8f127741c0c951c2d5d7bc046f69af

SHA256
1c140f56f258c93b7abb82212c2b686d9738843a3c715f8f3d37cd76b5d8de34

SHA512
8136994f3378c1ca51a9cb65263993d1160ad4bf9ebae6b5e692993eeedf6001bd4af2b90107420ce33e7b6bc2453fc1eefb7076b19e351f403bd9a21db873de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353e44b8b1afc55f3dd6bad97a25045f

SHA1
a7fc032c59e62b145fd9ee0910f10026e1934adc

SHA256
39c94b8c52c9f100a6ab2831a7283488ad47a6fabad62474945c3a71db942754

SHA512
7a9f8874185257e293bcaa1ab8415f16eac083583ca8ee7a2c4bec95983ad67f082fb501efdb50b14459a25c0e3416b962d897d9aa8fd05a3e89fce883ee6a74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
116c0976d4d861d078b96c48ee6bc5d6

SHA1
222345d4afccaf3c52893bc531346ce390872891

SHA256
4399229cd7154a78cee427e613c1aeedb5a780a50119ba86e1add8a1b8ed89f8

SHA512
960b53531e35f852c46b58c2cf77608f2ed4cf62acef62e2c0dc80f437dc38e58889f224fa8176fe2b10eeec6847ac96a4fd0d2b1ac8fe8ac287c67e15f09e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c7cc9ff156f7e0aeda49099902599239

SHA1
943272ba685a7935f746d66d11493e9a3fb6e3c8

SHA256
757c80435336e1bd9dc5c4e9bf58fea6aaa26454adf47aea2bf87c044ea0423d

SHA512
940769e6884410beac67606584eacc111e7d683bf0c491b539731f7bbeb8290d8a9a152cebf72291808a727634a3bc17e54355c1f2fd368b777becd58b5f3855

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47EB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A91.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit