0535577b6222ae3fbf40329314cffd523a050d1c857fe0a6405d4e78d791d0fa

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfb6daa7d0bf55712b8d6ee13b5a70af.html
Size

55KB
MD5

dfb6daa7d0bf55712b8d6ee13b5a70af
SHA1

dec4c1ae1293b8d4126b3610e27e4615613edb73
SHA256

0535577b6222ae3fbf40329314cffd523a050d1c857fe0a6405d4e78d791d0fa
SHA512

a9f86cf8436978246b59bcc52c5d7e706ecb9804cfba43cca6ef5d6da994fb0ae0fc35a539496652138a6df8ce309225854bb1191aa3487b2b6807b232461524
SSDEEP

1536:/yTupBl7F/qUnPbdBfagI/GA/bfuCRiaALj:/pBlBFbd+/bfuCRQj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e3f161a37fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417636045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009fd0a92d48d8823deae7299b646988e9f462516beb4a727fe900d7972ff709cc000000000e80000000020000200000008767dbe976e345d1094b5960a91c266b20e66a67304a8a1227fcd5efb254e8b82000000054f7f21d0d1d578d67db3d5773b3ac02c2a724554ff422d4d7de73a0da442b6040000000305b2b152e5d2fe2d940c1afd7c0380035885c220b1b0d30612ea4bebc0d81ffbcf3d9c03995593e9542f7a271da8c193ea583def23290eb2b99ad230fd597a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67BE5A31-EB96-11EE-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000de1f6847a76e0206dd832e4eb3a6c484df04c4240d028c38da9bb5190162e72d000000000e8000000002000020000000dc9aefbfc732b33be659c732ec00644cd01ad1dbfbad27eaaf5655a2493e7c199000000032c59d24a592d1c07eb39f5ee4e9ed41d9fb5819fa2f647d01282ba64b46167277cd6fb6841185605e69f9f5305514b973f748ee8fddaed4df4b84f9ec2e6ff166d43c98564f6db14ba928f3b9c91559efc0c4146fa3f92aa9f365911524d505af8b8ac1ff667101a2b597f874daeb86b3ea5f7e7b9b4e06761d9b9bdfc9f0aafdb2bea4caffdb07fe16b4f7b1f218c540000000ce809f13ce8fcb9b1b66bb98f0858dbefe7d11011f28f49339cc4249d70200a9925e19aa74c2fd1359cb92a75a8e546890863788d0ac1a759067f679276893eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2508	2972	iexplore.exe	28
PID 2972 wrote to memory of 2508	2972	iexplore.exe	28
PID 2972 wrote to memory of 2508	2972	iexplore.exe	28
PID 2972 wrote to memory of 2508	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dfb6daa7d0bf55712b8d6ee13b5a70af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
b877c2f76b49ea8ee6dac7f73dcb9f99

SHA1
7e71afcd7275921ef74676025f2ac76266098e68

SHA256
ac7e1c3cbc5788d5c76b3094d3bdb68213541fcb508229e5be31a087050b533c

SHA512
8edd92cf2c549d99df133e51768b696fc26d1779d1b52ea9ddc4fb711cc182f91f62cfaffbdfee96edaaa11209dc1da64dc3012e486048d2b89a5e1705bbc99f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8493f6a6d892770e949c6806995ae26f

SHA1
f8df56e7d552272c36a913f47df2d169aa4ecda7

SHA256
b3908c82b38647cef4d36ed935311e260c26ef048c507e05496578d711a06176

SHA512
1657a05e5dec64b2dba8b85aa8a14c75c82c72ab938fe8a2e1bc7612a965cb4854f237925c455fa64a473901a4b74df7dd0d20ec25cb0b9c6fab5a089e5a49ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4b8b34cde2d68af10d683df94cb231

SHA1
c0903e8dd9974ef44ae3a75e58e13dc8a2fb973f

SHA256
880260b23ec626d8e8266940cd9848522e8073c618ca6be4751540ac9109daa5

SHA512
1d1b4975e6203d96cba63593fb94d97bd1cd789ca73775ae544417d963c3084bd3c7882e70d7a8ab6a14e6108d0d9d764dcc6edd2af2a8f8612dab8ae346af08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a724d293e8c5b7718cc39c227b40ee8

SHA1
126965f6cabf6855fbf3dfaad69a32fed5e260c1

SHA256
97394db0db59db691f324a85ca0dc46d99fa075a2b4e94688a769ee4b8331e48

SHA512
ce1f5b1a0d0e9f92fd26a7e9072ea8d32edfb227a3d5860adb9ef66cb2073297583f233e88e2782361d3eefd68c0372ab3271eda23d0cc0a28df661ffd0ee7b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55262559de1146f34130271fddfc0577

SHA1
2acd1fc88b1e98b9c8eafcc5b876d82978a9591f

SHA256
e4cbdad6f047266ece71fe1ec26ca5c612da5b941e42cab9ff711e08c368cca3

SHA512
be6f2669b95d039adc2155a84e798913565fd990821bb3095fcc6a0bda9410c8f79d930f0c153a3656d09c0e90c5ea47681dccc53cc420f5766ed4f4931cb38c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f7769a74f91680309cdf7fb99f65098

SHA1
0dbdd856d51939961f6e46ac604f8425a2fd3959

SHA256
6249b60b6b302f18954615bf431cabeb0a8d5cab8a2f62a3724a9e484b976b4d

SHA512
0dd5d2453796ee1d05dc012294737b5eb31464f57058a82aa2b042f22472aff0e50bd6b2395e8a0873a65b0ee6a888704139157fa8b9d7395bf1ab511d7ddb84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4163fd96325b254a2c6c72097e7f0433

SHA1
1a9b5af95981a76bfefaafc3e5d50891e16c45d6

SHA256
aed487d13fa21e6443856a9869d228a8cf1abe667d88dbfc7757e5a95c401627

SHA512
cdbcf280e6cce0c9f984eaaaef6333d4d5abc9d1f6b1bc700f8df913c618d304bcaa720568984d4281351615c8570cca3e5f754f86ff3c3ef54609df222f730d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e214cd36bddace402ba5a88909d7429

SHA1
4dd73c4b928502ba947b6cc106f9163c1b73b3cc

SHA256
bb89e998f1325f4734ade2b51a211a42ce5aac5e0ff93deb397bda1db6a09be6

SHA512
12adfc4308fbf003500e4af17a11ad54c5b2083b8bca5451fdcbf068ffbf175a5ae043c19243d9696a2ed98a5333db82b42c4c2c65c2a2a5d4aee94792173eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2df7728ebb6c9ce41652f6c6b4554df4

SHA1
60bd477d589d408bad16670fa331cdab660b045e

SHA256
1d7e4ec8972f0bb7d65d4dd1714445665b3f4d45b5aa2a09cf715519e0cbd512

SHA512
90749edca1a35141f0785f9c917d4faa530c70012ec1261c0e36674fa7f1a033f90ef78cecdd1251153f0254640af7b1a7f6f6af1b10896128555ee8b66eaf5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d6a31eafc7ff2dc37f392c25de22e04a

SHA1
cad7050b83b86e69ac6b67addb2c0f4dd5a6a74d

SHA256
b15b0d1d440ea4912f45192ce96a141506bf5f0c3afaf3cfa1a07bfd1c768f30

SHA512
987461cff8bf638d8c5e1f0ac6658a9afe8f6b8bc74982bab32e26f31d0303449727e7cd5c9499ada41a0c782d1582b631fe984e4e841050e5029d7d540632e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\plusone[1].js

Filesize
54KB

MD5
15311147ae03f9fdf5233356bfed5329

SHA1
e79fb48e7a50fd4cfefd66da0c7987c2bd4c2f61

SHA256
bbf52fa72bd341647f0ee087568557bf1014cbf59bf6f79f35c2493feb8ceb64

SHA512
ae9f6bad307e135a491752f046a9011e941ef42558c8bca82fcb4cbbf40877f93514020c7f189bd15175b5cccad0d67400b531c982dcacb637339da0f82034fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\cb=gapi[3].js

Filesize
132KB

MD5
0c64565bfe2f2cce29ad1286489f5213

SHA1
67c237750c866ada366f16b82cdcbe6d2f15e558

SHA256
6946e80b40cd4062d31f049f4305ec4c0a1072733b162763bf9466dac7a2f0a4

SHA512
3b62e27fcc8c3c2817b0ed1dedc7f6ac5ffb492083916398b3a580aa51fc2eb69563a4a1195ee3328d7e27902fceac83d348c8acff71ec3f2db6d7ec8464a6cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1779.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24F4.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1950.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2586.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit