2beca25ad6f524ce41f00f60dbd47c1cfcfa2436809792ffc7d693be9b3a0173

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df3461f1bbd241c0bf185fe4e360e80e.html
Size

216KB
MD5

df3461f1bbd241c0bf185fe4e360e80e
SHA1

68836d0f745c5068ca865f2a2703b4be85a65a4e
SHA256

2beca25ad6f524ce41f00f60dbd47c1cfcfa2436809792ffc7d693be9b3a0173
SHA512

22fbee0e201155df83b475073fa2480f90a71b77ab4228945eaae1e466a90a7c8b347b7e738256ceb9dbd85c4310cb34b9a656a331797c6b52e1a13a612c5a22
SSDEEP

1536:CXPwwtiEszgyaP4kw4/uSoSWSiSQ+m9nO:8e6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{658D5351-EB6F-11EE-B33C-C2439ED6A8FF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000029a35074282754ee9ed6ac351c6e55c625b64ccd0ec5191af9c7afa7fe01cdc1000000000e800000000200002000000058e96ed933ba5d3419d8997e1082e201358e4ea99322b5e1d380c324149f433d200000003c1c1d216873ea7bca35acc46ea41dce16cc2a8ab6f8b09d4f194e8343638403400000002a3369a93a30681ada201e0df2406903b58a0585342142f9ae01cfa3a23c25aa8b9ba6dd9590d7805a69ba4b8cdb3032afad54e0ae373f70f610fdd1a7aa2b57	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417619286"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000407e0603f7bbb44450e1526d1cf550800edb634b0ecc401be7328041c88cd015000000000e80000000020000200000001ba529a62f73ecbc33dde2e5cb23a1019c12fdace52c7fc36d1cbb5a3f3946b790000000a8bbea23d58bceb4690a6d14ada720f90c824461f32a08d1d2ce049602b55b7f9e589692f943b4d92bcc2b15e930d43890acd22df6bd237dfdab9e7d36fa387e4820ed17d1fbc84c21ba60563380a0c184753cec7e73e99fba046a8397b8f7a87936e92b317e39b0a2c3551b666aa424b880cebfa469c7011ec4c5aebd04e8c029f91f2db0b2c0cbe79bb84940035c0a400000001529ee3c22b429ea53da2927d19c438dd6b0335ea7ff2213386ef0bba67892481771b307dbf6dd9253f86a009f7360ce3e263f19b00ee491567d03dad458e6e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e7fe397c7fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2368	3024	iexplore.exe	28
PID 3024 wrote to memory of 2368	3024	iexplore.exe	28
PID 3024 wrote to memory of 2368	3024	iexplore.exe	28
PID 3024 wrote to memory of 2368	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\df3461f1bbd241c0bf185fe4e360e80e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5763cf59a0a72b629b8c7d9bcf061094

SHA1
07adc50cc552f360ea12da60c4afddb725b629f7

SHA256
d4aef91fd4c5598152dd3319de919a8233de3fccb982a72da10e2a168363ef99

SHA512
f752408caa9d3d206449e9d8fa65dcd970a2a96e210f5d4c054f1c6ed503b02db329c4cba1cd1bcb694ae8b09bf56b0855d6b4226f5de12a80dc84400326f7b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8834e962dadb32bd7d465f781951a2

SHA1
5f38855fd787c64b9aa66d5c5a26a23d6d7b7a2f

SHA256
4f2e46af3acede29ea40294897c4ab43f44c7003eb37500acaa3c0ded2937785

SHA512
f49e83518bd076754014692ad4853c10a83eb8252f206e13ce929a47d0078e4c3d931f24faed5687d5a4e88f561824b3c6e3af3c416ae2ba2451aca4e59ab6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
243a51fd7251f7e2c79c4c82defeb387

SHA1
b7db5a0cd0f7eccfd580c99cdd452dbc547c6458

SHA256
19c597d670b8fb2f4cbb8d0738567a291d8f5fabd32d99001d99286ba55a48da

SHA512
b9dc7ff539e61807cdf80eb410c8bbb2f9f5e3f75846198964601b5d1de61e78491bef07d578cff540445d74e07817b39a2b19f7de02d8cdf9982ff08b177c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da822e8a02dd90394a09097e3e6a0a88

SHA1
b6e7a244170af60afc397064b3b951c07dda4b07

SHA256
a66e6b775b49c1bfba9f4e70c134973a9903e77f9a376d88d44d5e9014b51a0b

SHA512
fc8f27f8bafb3f804021ed94b4c5a608517f081e242e5e2f5be0a779a3159b48577dfefbc1100e692ac335b1f1b1b747731ae38c064d17c64e2cd69a8d4bcecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6af0de5ec589fd04317a74fce09ed2f

SHA1
292b521ca3d1329364237c7887248032e73dabd8

SHA256
c01b34a34ea83622e4839e5add0c8a74a3cf5dc79460910790c89d16e8abc7f0

SHA512
22e1e12eb9aa2defabcce0660054f52395de341c342216814079fbf47ec96894c93001b37211b15197beadbeb3557188b6ceca7f6cd95837d43024f3b3826434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98a55c876a68f1115c59a9a7ed4d1280

SHA1
0f064c33e75e48c63b05b65fc0f6a62730c834e4

SHA256
451320babc5e2b89f24a1ad5661b607bf11beaa0d9754546c92662496f785d97

SHA512
bbb54574e5090897ff9052966d33bfe7eb59f22efd75485f47b63e5d42b1f0254d424a2293c1a01db560d1157d4db4d784f750fe1251df83e71dda40a2a45699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
168eab90227fa8d0802308b990c8e06e

SHA1
c9e7a711ea6e871a5481e60bcf8fafb9f48a6e4b

SHA256
adbfdf58909f492d24b2eccf2a30c5db7a1d2ad25e9d0c5cf59c4074d299a55f

SHA512
446304eef48a2fb0ba8cc92e2b9204d85fb808c0a919c45566542dbced0c0abd887396b272ffbe97a0f5fd798e31660c4dd948637f763cc4a9748eb6f315936b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfdcbc3804c81740bd4215432148f656

SHA1
d25711ff86540a629fbb0d3379adc0f12eb9843a

SHA256
79c76e8a95dd8c565f231a7b20c61f3e70c22b1bb821cb5ff40f964892cd6da9

SHA512
dceda7ceb952b9e15b3171a81ebd64bef1de883860d5bb0cddade6e734905a093dc4c58fefc91f9d909e54d25f4d4c16d34452c590d8631600035a3b0efa83f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06522dbe39ae06575ab31827418a16c8

SHA1
c3c8d4bd608823f82bc94eddd2e9a83d69d233a8

SHA256
e3a5348d4f8809c72773fb9a62e39a1b0714d228472a205512be08b7608b14e3

SHA512
29d93181b5fb2e9870441cdd90006ed7cc20565ab925b3fa1d6e98305b474432c4e147521eaf26312827f6e9d16317e970f4f733b72fedd90467ba68a7576793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
591715f36e77295c666eb20cb587a1c6

SHA1
854b85830cd6a12c302bb5d7f9da0c5dd8fcae8e

SHA256
1d95f7b8675cafda11f464f754461e3de1242b0496c1ae2b3727884836a9c2a8

SHA512
f9e9ce0b3437685c943bbdf463cc082894c85ea88812f7ee28536a0963c2bda96b5ea997855fc1b1ed7f816c4fa43e77eb0c5166b930423cbe5356b84299e534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b911c11c797a8b6c8e692ef0e04a918

SHA1
5a960c777431240dd0e7ae3a0272b7db37d067a7

SHA256
efc7acae2cba1ffd5081048b72f209f15bd7342af59b12fa5e81369751daec2a

SHA512
63efe8e92e69a990ceb7ec33db3a506c026c60259691d230b9ec6679327b1f75f443b5e6e96a58714c22560cb32599a29afe01d2cb4b81ba57fab097dbf5e743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8364c0f6f7394b3f1923ebb53f1569c9

SHA1
175477132b89f78cd926000268421accb7a7fee9

SHA256
e05598b4c01bfd6e51fe50b5966795f55c3728668b5b2a35e770f879b8313dba

SHA512
11716e61ed7ace2e41f2ffd967f65a07d666a1fb014de124a2e4a2ce6eebb8ea0b150c4a63a2d39d0578cf33e5e2606c4d8e69d2db9ada7065e70e4bb53d376d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
105e0437bae174091dcc648d479719af

SHA1
0e800f6e343591636d7adab5b131113fe265f446

SHA256
5f2ad49bf8f3e48c04828edb5e67d3a10a67d6034618040c474d4fbbbaaef4ab

SHA512
2a64ca60b927320caaff827a15112232cebc7e968ef8fa337025026fa6488d2bfbb3329f4c997ef8313f815582fd2eed5d056be7de41f0036b5d9770fceed670

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B0C.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit