fed56e9fac13ab5ffadd464b32eda5a20cb6d1e0c06501676a5c7693b5ca5909

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df8ae16ab1e6d7ddcac81529adedb7e5.html
Size

239KB
MD5

df8ae16ab1e6d7ddcac81529adedb7e5
SHA1

90965e71598f541c474d7785044550c250eb20bf
SHA256

fed56e9fac13ab5ffadd464b32eda5a20cb6d1e0c06501676a5c7693b5ca5909
SHA512

88da707f8f17f6463e7aacd5433d4b9066a0aebd36150db921d0fef068ddb3d6a2abf188b296f676edb9d24ec7636d8a994941ee79005ef8fa79f0d5d2db6d27
SSDEEP

3072:b+cyfkMY+BES09JXAnyrZalI+YeyfkMY+BES09JXAnyrZalI+YW:msMYod+X3oI+Y7sMYod+X3oI+YW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000470ce9882acd1761af1b4fc784fb7f31fe93ee0872637b217dee1f8baf63b8a7000000000e8000000002000020000000c985d74a7c4bd1ebbcc52c2e76516cca2b05e82a05e54053feb66cdee9f2992120000000f2ad8e13897a66edd94b20b18a24fad0e5e3293f02461116b374429e320bcf9f400000007b578540f97cf0d48fca0a1816ee60547666cfc209e8a2398a4ffa582add3ff8561763a52c1711132858e1da7cb8e43cd89f46d5e94a9b116916131a952fd875	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417630268"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F501C6B1-EB88-11EE-85B1-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000930f88bfcd20cf366f83601912d0318c603fc58e54c37a5dffa7fa004ef2baf2000000000e8000000002000020000000c26af26addf04ff012c33781c3987f541169b5edbeca5f5344c447f1614e2503900000008513024b9738f9ac43fa9743930ec288efda14a94f02a6ef6db80921332e86be32253b4fd241c591936c3fac4aac3ee55886e48751bf8ee705ac1136e97716c386f3056ef9d99006bd4e7a693274884caeb1caab65363c94d77d6b4f69805032f92c03946378d0e947f8fee50ca4ca7ca812a39df0364b386d09277e0e2cd03c76fda50fe428ca85b7576fd246c4d2fb40000000afe7ad7849abc1807bd445b4ca427b4c3c58311421758ecd91cf9bc93c16010ea64d0268fed44db9b1f6d8a18c8378d2a9d0f5a61cf4bf59043c2958d919d07c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c144fc957fda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2504	2044	iexplore.exe	28
PID 2044 wrote to memory of 2504	2044	iexplore.exe	28
PID 2044 wrote to memory of 2504	2044	iexplore.exe	28
PID 2044 wrote to memory of 2504	2044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\df8ae16ab1e6d7ddcac81529adedb7e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f7d5dcd5135db8c7bd11e76513de7adb

SHA1
2eb2a9deb2f40b01f91c73b89b537fb177e386a3

SHA256
6def76bdbdde847e3e6ab3b437b4b16319ac3491e98f681dfe2f21a24fedffef

SHA512
609fec038da18448b2b7157846cec7ed5487e25c0b05b579fc6a7baadaf9c61c76e402480472485dccf6e205d28fd86e634dcbfd8367385aad3a33398b58c6c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa3f099138688dcda7fcb30da388a3f3

SHA1
57014d303df78e1a5f3db1e78ab8d7ef936a2543

SHA256
f8aaea0789e33bb958714730dfe263d8732a076013ebf9095d5ca2d415c45abf

SHA512
811b8565f9cb22e048a79c62f860d4da5a6e1b20b7745bc8e21b5cf2ffa438d93873171a53416c2e70235cdf52fb11d2902994edeb177ced7a7d4714de2df630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ccac6e1dede177ba4940c8fda0de194

SHA1
592fc7d6c09d1a0d13ec636c1e1cce158af9a4e4

SHA256
53cc81b10230a4b53710d843db4275456164c99e7fe2d9f0b340607fbeccce59

SHA512
ce495bb9445665eca2d9f79e6f38bb9ef9253c07f7f5e1a919f5ba4423ce8b8329f033c9040e19a0357501f88fe5c2acb009de96353c4e4a1420c6dd85cf28c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0601a0d48a6d83183d0bf74e296091b9

SHA1
32339d9a78ad5f58134c6c0a1fb23b5e2690774a

SHA256
99c1591e113de565fa8bbb94896db046e41cd182fe5234d351440b0dd1fd6dad

SHA512
5f181a643d0e3563385a0a82bd182a000294bc2486ca281fd1b60d35d94c099cdfc556316aafce02845ae79a28f9b54d89032b57a7b264eade27af3e217f0f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d99c77f86ccba7cb6b0d3b0ce165458

SHA1
0dec33fa2c13987a43f6caf7ea47c8f6694d8593

SHA256
8246785516b811a47876d5536a9a913c29e797c8d8b28af1fd5b0324cf1bc465

SHA512
205c18279d39e8ecd3b0a5b53ba8cdc61352732f96259b84467869b5bf4f8b65920f6e4187f74ea6c462641ba8ba5359dad77c8aaa1c9cb9ddfb173e23a7f7cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
135f2d31e38d93024e9d2a5068c44b2a

SHA1
9ca988fdefacc61ccaa92077c204d214aa1db889

SHA256
4291d96ed625337772fbe109f606bfbf7d525e96b10ef75c5c848d0de58ad3c7

SHA512
fd5f5768ff41a5f3ba76ac5c413b62855ee4e47ec7eb86e66c2b3e98f0b569f7e8cf5666294f811ce836fb644744e655dc35ffac6d58114ff8a22353febedf7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d77774df3edca5a8803811a123c15e09

SHA1
86fa6ef022697220f2b8c246ba6329eb41c3ec28

SHA256
f34d8ea7307affd401f587060887dadf9a57879566837f40569fa80a67f89c4e

SHA512
c9ee56df1aa281077d799d770cf3659936de2889db42dae2db5bd185aaf1d7198554b76b9e8c2791e242f9c4694479f6c59484bc589a6c5527b2908475bc1c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f588d6ae5fb5e87300fc4c412673d6c

SHA1
bbdc8dd43ca5a693e4f6a566ac985544355fc41b

SHA256
309ecfbccf5fbae9acb74caec08e412dd6257c7397f837c5d7ce39491e6abc92

SHA512
61dd17e25b12debda81c95d329a014dd14028ee9778a900cf1b3257c285b197192495146c099ea565ac7c034348d57c17c03d836413a89babc441a60d7d6e20a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f51de164c5f4d52c051e26b3c2b18560

SHA1
b91d4f676c7c592114e3d756527659e10cc7f298

SHA256
fb1a463689d7bc0c19286c4141a38a84f8462cad6845876916644828289fcc43

SHA512
968257d07dcdd28ee5c73d48eab92f323f2892cb838e36fda43704bc6ba0575bdb3b83e02438686f137e64e3bf806d259566dc79495a06ad2c80e4b447ae17be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30fabfd8798aa1c82ebea0f41e1c6ff5

SHA1
4d2fc1ee24aba8baba9d96f9bfea19ea14966864

SHA256
0cdbb2d2170a1c063a1b70552e81b620d97fecc994dd9ab67199c55325f3348e

SHA512
f86a12caaedc5d7e411dfbe3d7a3ffcb3f4a8078fd2271763770473e160af517d2f68d56033f30bc4688f7832eb4a847efef01aaaea547c530450132b0588b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e16c8901481bdc2cb5e56970e95d076

SHA1
ddd59e29d4e19250e63f40e66d7c5bfbc15f7a42

SHA256
378351fb9a88983606b99d918e3d04562a7cbcf3c86f3363789b3a1eedea4915

SHA512
9f6c60440a9c222d19d18b3cb20b32e566517ea8e98c9bb4135404d0c9eba41190ef74ff49a5b997e120031d6993688735f12668d173c9a2a79e3572730a4b3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ced76af258374fe430f3edbfa50b8fa7

SHA1
e0a5bb59ca64919cf69e9bad4561a3660cec4ab5

SHA256
daf5479ff23ee48b2011fcf5ee8c7f24a35095760e6fb87674137f775470d541

SHA512
e8279bd0ed1de378f77c96e3656c9bc19c88a3506b2a2f3c87aa7602175575776cb1ea49f04fd03adef79ccb01a59a7fa553a6875958a6cde95c282452f97430

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CAC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32DA.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit