06c9560d65daa3bfb2e7300b8a8de0220bcfc51f7cb5e155e6b2c171707feee0

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df49c9c7d56da7c9a2a5581244510bc8.html
Size

153KB
MD5

df49c9c7d56da7c9a2a5581244510bc8
SHA1

ae817d3396f15565bd150c9d392e9bad28629a72
SHA256

06c9560d65daa3bfb2e7300b8a8de0220bcfc51f7cb5e155e6b2c171707feee0
SHA512

62ea946e6fa3dba7ab20a2f7c4814ccaf8b0d152268eda3f1c3049fbd060ac018f5007658234f9a7a95e4fe01bffccdf2d386add78c05d2e234346647cdfe1b9
SSDEEP

1536:6+yU9uuyq+i2iClizrphhQUXnzBzEZ6z7mXb5zhzXzL8MV+7Uph43t7ykvZk6J2m:eQHf3JRNAZ6XKNjnt7pMywkR8MnA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B3F4801-EB75-11EE-B6F2-56A5B28DE56C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000aa47f00ff199a78a22f362ab45189e196d86b0c251a37f3e04cb20526b7f068a000000000e8000000002000020000000c6fffde1ca396abd13488af6a70c37a823ed29fc5b60f593651f28818b014674900000007e9c460dadd0ffe9b2181092fd4d21892e11e11599aaa66e1d5bd2a27e21ae3f20bafeb7503a988df4f5788ecef54dad92570c747051a09373424c4980aed4bbe15d7ab94f17ba9148e6c9a9c795b3e4826817cb9367ccb4493358c40e25500bf19946c37411ce8b5e2fcdc0a2d8c7f41d55223bc32b073dfa48a2cd7c0bdab1317567c411cc067ebea481a58b5b75cf40000000c7afae7e3bc4db4597dbbaf69bbf9ec435aef60143bacc15e273a6e39efb868c2b46458241d0c5bd7f35d20da91562709fe75b323624bd6fa98d0eeecebef3df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000bfdf52c4bb764df1f4566302609325128ea99a75b489260ca758d935d417b16c000000000e800000000200002000000080cea2949d5c5c17b162185893ac3b8a90a3dc7e43211c6c3d0f7285ab8790542000000063f973393c1353c8bae900fd880b4c0516e3a4fbd07139f3b9a90769a61e32ea40000000801fb400e3dcfa08b5b3ddbbcccc23228a2cb0aa225892145c6d45fab282ad2b94780c58e696ab195836841213d1570b8c8913d0dca143b65ee3fa7b89b6675d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417621794"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f033d00f827fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
352	iexplore.exe
352	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 2800	352	iexplore.exe	28
PID 352 wrote to memory of 2800	352	iexplore.exe	28
PID 352 wrote to memory of 2800	352	iexplore.exe	28
PID 352 wrote to memory of 2800	352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\df49c9c7d56da7c9a2a5581244510bc8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
062c7033de8cce3e5f99b123c58c047a

SHA1
e929da9e5ff76d14a4368f65efbeabad5c47c571

SHA256
95eb370587f02ebd64d1d6908f262e2e4d1d8a88783679906ce7235af2dd8ca3

SHA512
7ad51340ad8be119111a04142766a276f1d10403fe62b4f7aaaf876646f1f6b668214ccd7a4ba6fa0331487e34d64cd4e50516ff6a806a299cc89bd28035ef74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d5b99a1c056278a5965fcacdb23ba8d

SHA1
349df661cf59d41849a3dd8210016442172e8659

SHA256
f072092bc5fb0add0c45d12bce18ab7291e850001aa2435590461c89f0c747a3

SHA512
4ebb2ae5317332a181b9b9cf41207fa75b204e50103b3fb0dfd48b8247ee158fad2b458be08e4706abd5491b1524c983918b6e5cd3371cfe47f7f0370522f441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daee20b26af9a976457510269134c3f1

SHA1
8d258a191b0124d78fb8b00f2f51000b4d2062a6

SHA256
faed8a868811a3665de87b0ad4f1138fa0accb8322ba2cd07cc4cf27eda8d502

SHA512
fdbea0c3c91ff5da09a091b0c78f6834849fa2539d505b4711022c6d56b2957fc8a2f3d7d4008aa00f391b26e66fe0b90e610a0307bbe376a4aebfe1a4b2201a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
450d75eb39389992ef662b90caac6187

SHA1
694bf1a5d1f4616b6e78dfba504934303e063575

SHA256
ca135b540f7056af4aa46572eea54acfdec3bfb0921e5ce32c5ed2fbd0c8c3fd

SHA512
704ad84838bcc7d9ba976a69e1e52dba8b8d9e6d35f66f2cb7ba24672886d9b3875077e8860a1602e6c82db6c9bc93859a232bb55b8399ea84194c95da049c18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
202ee02dad50a923b3f5248c67f9ebbe

SHA1
c6b6ec784978125c9db0ada8c0e3268363d2cb88

SHA256
f39466b93c8ae3d171c33fc922a4a223556d61baecb078df77176b1f9bbc4799

SHA512
4120499ccfde4033dd4235e25e3cc7a5536379485968cab426b89c3adce1f459267b4e943b3c0348a46508adf8d85b2b5273c13cc869a96ee1a5d3d0dd447959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
139a627ebb2df6ddf2e06eebde587c48

SHA1
7b8b1ded9b885dbaa43bf95de937e755cf85ca36

SHA256
cde575506605b92dfce966575f6a2c4f26c1c1823ec9ae8396db9597f8cb52d3

SHA512
f82f88054b9618d188fe2c92ad30ab6e179a493158fb8b13740bcfe50602b29799a88dc012d5f1455d2e6286c732addee620228ac1827d7b02a55b4e2449148c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fce320a10a77a3d6fa7dc29cd8d26dc6

SHA1
a61b9d58f4a3e985ed15d1fc83d254610ee3c009

SHA256
9b39072fd736fc32a386b55e9aa067e6795cef581955cba412daba6c3bf62180

SHA512
f9e439a0ac59ed34a498636fc3b316d4d3aab63f340ce239498381cb022f092412a0fa8ea2836298991a9a99d7ffcea0a8afb960f426c5c03d6878b6ca977a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb0d5994016265972bcae9bd96e21706

SHA1
2d247fec8d228e5ce3ca3418ac6ed677b1e25fd6

SHA256
690a90cfa5f6b31a669e2b53516a85ff08f1541781ed2b713bbb7ba49813cd02

SHA512
d26f84d6aa0c290f7057db33bb7466a4f47c479dc0c6d95d1025da0e4f0d8846e2594bdf0f8f8bc2bde5a8163437ee44bf240b0fb13eca60b6264c66339a58c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03d5d8d2952ea6dcc2b922b95c31e452

SHA1
08166033910b4240077befccf3b7a159c07dd286

SHA256
662a485720b9ab217f1208d4485bfc04f7c562302402d9d0b77887c6b304c048

SHA512
a1baa6d2c651721746f6c3b2f226dfe12fa977fd012851aeab20376bbe5ad79c81e555f5e3bc190b66264b3065ae07f7768ce42662cf46aa47a31eaed46c2439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdd3595f57969c665e20bdc6754c9a4b

SHA1
644b698172f0f60353b2379acd55d01a0e721b6c

SHA256
8727cace1f2f8164d0475706929dcee80d5ec5f76c79f5af80f081826f26e4ea

SHA512
211d9cd4e833299e855de36aaa5c3cb7a9f28607f3f5344e64eae75a49a55e48fa35a1221a438e096f89fb4bc64d8e96dc43d603f16fba13de826f4cfcc4abf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95867eec1db0cd3b9c02d1cd8693ada

SHA1
1555e1f0dd672f343540fbe816cbc0f8c1443ee9

SHA256
b866e79823b40c8fe31f48ba400d976d5b4ccc84ebe7f80398a1239edfa18c49

SHA512
faece8b43321dc835f3b9bdef5c4efad27bfef2ac2f2f51b8b0a9cae714a893b4c9ee916541c608b6f60e5ddadfe9aa47febbff849d7402f029eb5bd1d7f7390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf86f0e2973360730b892ee0978e0579

SHA1
bf391d4eb4017c2c7ceebae00847a8cc728c908b

SHA256
8b4cb2d812f7a5f1c985aed5b9b098215df68a46e423204525a6e04d48b507e1

SHA512
f9eed87666b1fd756239cd8c4a396fde28be1dfccfbccadcb6907cba2d68c3b55c879e3cde663e7d2dde41ca6f87aa8d2846306f57d7aaa72b0255b6c5c036dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25d897b2cb5de1e77a88cdfee0972110

SHA1
9a929b35bb9c66a3f05a208a54988af575346277

SHA256
0eff70a0eed7624f21f15985bc5a0a4935cc45a25fe68b3a123a9aab1607d5ab

SHA512
676a8afc587ac06b012b561a2c73a364b2768a30f8d1c0cfcc102577d7e1e10ebea84fab5348d243ff054f4657f912a28689e49bcb99172665c479072d939071

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18d7ecb3ce1a4133ebe468427d22c47f

SHA1
39a15085fd02584f8283efcf0c8faa5c4b8ed3f5

SHA256
38ea512e1a63f0339c8042a875873ec1a76c9649aba451da7192fa700898b1e6

SHA512
56c7ddb77e91008c4171acd1650a29f772d6186aa48174269486be4a844036bad660c1f0b6080ae9fbf882ead87fc2edaed5fbd8346eb2f39db0e4c7750080d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2761.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar291D.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit