09c3097ef358fc4c199587e849a26b33438234d5aabf8d30fc3de29eeaa8aa4a

Analysis

max time kernel
136s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df1322ea9c3037e24633cc11f6655399.html
Size

27KB
MD5

df1322ea9c3037e24633cc11f6655399
SHA1

b556a6b2a8617fc71c6935e83740bf37524ebfe1
SHA256

09c3097ef358fc4c199587e849a26b33438234d5aabf8d30fc3de29eeaa8aa4a
SHA512

7aefdf13b00f016a0b4ccb454dea099990d44da37f7d1417716011fb16990c1d95693d3e42af42a128becca446879436029f98160ff4ae45993326acf338f58b
SSDEEP

768:+aa6+b+DAHOvGFOzG0aW/u59doax9BoKHlB0wkVJrFSSSL:A6P4OvGFOzGdW/u59doaDlsFSxL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f64b88727fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000016bacc1bfa59d402651282dd6548f166b378c5416bc54936d31a6dba9c105675000000000e8000000002000020000000cc553c7c5e4cdc7bbf7271c6df0a00e95a65954af70b58e7f63e1d9b12b7818190000000f3e28ce6c161344a8633df1af4bee5b17172744baaa55988c20b7d83ea794c4a9e66cec729b27e9d0634946647514beb21504b59db4d14843228c7a3914d71d311729f4de2c4054d2c09d9f6756d41cfa3d73ca7518d317b06cd8e7db6822113a96f3f689a3dbd4c4bd3fac2c47328b093b3db9a06bd8bdd09b6c2a54a8cf0a8752ef3cbcc7faed65efef85a278bbb8d40000000f3009d2fe3b0bea625cee16742efee5c1fd5883f0848ffd2bff54455a82112ebb26fc0d5ec7ddc5fa18bc7551f00422c1a74bbac6eff199ef7d2489c117d74a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417615125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008293ab2cb995d635b62fb51b15eba3024ea9153ee7c9b8699761322bd5f005bd000000000e8000000002000020000000b7200f8f75d8c263262b317f96b5cd0d91d517e58a37544d7b8b3c45e215b62d2000000091f3bd9d1cc8e1766fd780fee9534957dee64e78f35eb43ec170f04ed55fdd75400000006f993305be9997614122996e26e9e5629929904b0aefd495b0d62564a2bb25fd0bf5d6bc0770948eeab1840c2441a85f806cde4a546c62b1f91c44a2e79e7f93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1AE7201-EB65-11EE-8D50-4A4F109F65B0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2348	2044	iexplore.exe	30
PID 2044 wrote to memory of 2348	2044	iexplore.exe	30
PID 2044 wrote to memory of 2348	2044	iexplore.exe	30
PID 2044 wrote to memory of 2348	2044	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\df1322ea9c3037e24633cc11f6655399.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73a4d819122cbcb0efdb3cde6dfb8c06

SHA1
467168dfa70e0ab1de13cd60da544b88b9b17451

SHA256
63b666b07b46fe8fd58cbc7f36b352576f85ecb0f917a9fbd628ac58f7e9a6a8

SHA512
897ea7da538409bb936e02ed941ba8b7c145835ca1b70271cd95c3c35e27ff563d4ca0e6c5123d72dab8e70763264fa70bea2d5484ba061e46cecd50fd325b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3e78ac4dfa8186757dc2bbb23f3317f

SHA1
918c26f41e8a9fbf7bca7061aab22dca8cdbc984

SHA256
eed0e706e0c9882278db76e74462e6c7185182aba6d883eb67b43c2b9f8f10cc

SHA512
5b7a1d1b85a10e80ee05ce3c8dc4193eed081d5035f240ed85d6ee9307e666e1f49bd451072a9506df97c40c8f0eb306cbd614cf8e3b0e996c4af5c55befa7e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
444186b8f372bce3367f4e2c3657fa3c

SHA1
6470e263cdc7e14bdedc4aac20d82e7af9772bab

SHA256
f8ac1e3a8445bf4e0c02ec9b7a02ba3f2204d780dd446884e2b605fb56f57bdf

SHA512
24c02d73b34d44ea9796412a73df298c9452c4135faad1f630558d108e844d647173ef9673f3829b22071f069390b48769afce1e5fa9e63061e8c92decbce4c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a6a79ddf55668645433d3f6bb6f5b2f

SHA1
a5dfad5d2ba8d49d4b574cf7d150d990e20fc6f5

SHA256
91324529e43ca5cb8dbbf175450fbb545229f2d410acdb7466d17900d1db3955

SHA512
79d58681ebb968e45fadca1e16be5164c6a23673297c75d35f29a3b465a1622fcbb9c0f1fc9480fa1e8f369d9b4fd5a2168bef0a8752a370ddea1d7ff04098ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da01b6a2760cb84727e63cfaab59ca87

SHA1
c672aa68a8082899a6073514329d702a3124abd3

SHA256
33c5cc741efd3a0361aa92fe10fb213f7eebaee91dfe28a0abdd72e40f384721

SHA512
1522774764fe3b6eabe165c45e446db469732c170f4a9be34eebc6f8b2e0964838006087214d289e2345cdd33c6e558805e5f14f3347d317fbde4ff26521235c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6527419c52aa739e799aaf5bd8fd5062

SHA1
5703c59a95a22bee124a9645edd0112034def9f2

SHA256
056c83371c0d6b106ad185018a559c9f49f05243ce7e0d8ba01868fa9b6b28c2

SHA512
93cce57ad6a3b2fd507fe55835f14cb30e953ea4d527aa2a38bd3b01253e77bb9a41cd11e73dd36dd37c6959f9e0490f372ac3353ebf74e1b27e0b0ccf7d0a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c52665b613e500ffd9863981cfe935

SHA1
25fcc4141f59a30edb2c82fea08cfab3a98858f8

SHA256
7857aa850e4c432c823faeb11bd58c995cebbd7252789e8a8259aec4c50a0ce3

SHA512
e26e06e3ee569f474888878c1afa93e314d2ec67f96914375ae75fb3dd7fc6fd8506a06a8b32185a8f57461127cdc270c581de3d35b235c66daae5207545eaf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d571b28f967aa211aab7c4707e0b1404

SHA1
8114c78be22b7c12c2057f51d9ac287733eab44b

SHA256
9bc4dfc892c8b1522bfc5128a932d951084c2e6254e1e573131384bb918336ef

SHA512
c07209ac3dc75646969a43bffe555715e770042c052316eb4343c8f09b32120ede8c5d622fbf481249bbb38b40765e019d4f8cf2c5ec70bd8ad3160820b5830b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6105528938b85ccf3aea94f45a9e2855

SHA1
227e095d1c7973bf6d87c9e0050faf6fd83870e6

SHA256
2f385de8f7f517ba400bc24b50d54430966e7ad22a6df206f915d5d73492c2ec

SHA512
3d319e72fb4ea9c4ed9f1ddf9d8fdc16cc59f5b086851729677ea91732b2efddc01a68aec74649f68030ac58e3cb5019adae5969d040d9809efad7e95d423d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a33ffd4637ec5027e0d035579f27828

SHA1
642ebfa613954aa64687ae1b2f8d35478cb7f167

SHA256
74659ffe639324d3adfef826fdaf5c9c80cbd282825095f9868d73bb16f2563b

SHA512
1b6c5c1444615d81a56e4bb49beafeb84a7c072ff5da61e1ef8b235c5dbdc72b3c15fd3a94a8bce8d0a50a45e78bff9006b4df692fd1d96663f2a5886212d902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46a90ee6633cbe1c58804103f9db9099

SHA1
9a9246d121df50e77c74cfbf147c8b2a1bf32e9b

SHA256
90c1e4df656e0abee9e713667a172de4a2acc4202a204fa1460ab22e3c87d36e

SHA512
3ff663fb3e7a93725b921fd8106c447d0b82f7699e156c339a73537128ed7cba653a3191b0c9f2566aef81e4cea7e368f09648a43d1329602982762ef8c04dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2a10d4cce3f2f40f8e1e7bd1a6fa83d

SHA1
48c1ab1f4fadabeece28b82d4ad6361ece52c72d

SHA256
4e46d47ab6a95a86b3e68d3ccceecdec6da9d4b448e89abaa47df29c75c7edd5

SHA512
95691dea9a4ed084ac7fb768663fb543890a668f163219e191bc74207defbd2e2ca1e098010a9c4c91e27639b200ea275baf1a0679eb065bdf87630197149d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a806beedc044fdf72f851a8e55ee423

SHA1
500faf0c6c6bd20c938a21aea6fd5d119b2749ed

SHA256
f0f550f31c7ec4c1b0e2a74a8d090b3963f726dea0ff5de07cf21d477ceec2d9

SHA512
18026c5928ad31899bf4b09cf6a3392712db9ea82da21d426a17d4868ca8256aa0a73c4201bad36306cb84f061b1598962b8134653ecaba1c799af65a9717265

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab72B3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7440.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit