31adb1d95f56f6d39b73d5010840318cbe74c5cb30faa0814d8982afce176497

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfc46abcc61e65bd74a66b1d4a1f8a12.html
Size

3KB
MD5

dfc46abcc61e65bd74a66b1d4a1f8a12
SHA1

99dd01d45e6aa24cf038a8262b4375c1f9d199c9
SHA256

31adb1d95f56f6d39b73d5010840318cbe74c5cb30faa0814d8982afce176497
SHA512

49aaf730da027174f808461810c5ae217f9ecb5691c38090abeca437fa3f44b84576a5fcda87dc08de228af243ce8f2d348cbd1ac52775f46872c58e02e17a83

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000669956a4866d65fcbe2e3bce9b3b50a8a2766b2390aa1700e15393f0148683d1000000000e8000000002000020000000a3ca3186253472e0835faa379aff06bfb7761cc2e7803e684efebe0f90701b649000000026ba16468e60e8628ca56aa690b04da5649394799dd1f23eb93ec7a0e1a1ffd66a765fc7ae1175103b9d2e6f2f992afff1f7376381291b662a096fdff0b4aa77aed38fa472178232c99111ea24f117037b0544a9926c23a942dd7be6ef2206762c8d591b3a6e3ff4d01e6c1aabf52a046f4a7c7f3c200f4a1ebf17192e42d17914535abdcef48b410ce705ca228e1b7f400000003affb7af2aa8990b56ce0d6e2405c398d24d990ca54e8a6edfb8b5cabc5bbe5038140b974e68bf44f39b2f6b95646ff6bd45c20e5cafc235da0fb38ecb38b038	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417637812"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83AA5831-EB9A-11EE-B55D-7659DA376B3D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0891b5ea77fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000a1af506e79a77c3e1e0a2414cbffb178a53a71fe3a30623ba63e4ee1ab91e723000000000e8000000002000020000000271d0053908df7aa64e877afedd5b8bba3143d140770d160810d7e4ef328d87120000000491f3fc67fa85d627ef101f793eb4e83cddb8c423183ff31d89b5f27138fa390400000009ce54778451e7f612a223c1303585ffdad313c0c0f3040477448feb2bdb8219f915df1d947945ae7432f6dac9e2bd54e49ed37e4806358627ae0f9795b0b1193	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1008	1932	iexplore.exe	28
PID 1932 wrote to memory of 1008	1932	iexplore.exe	28
PID 1932 wrote to memory of 1008	1932	iexplore.exe	28
PID 1932 wrote to memory of 1008	1932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dfc46abcc61e65bd74a66b1d4a1f8a12.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ecec6f079a9f5ce302edce9a9ea003

SHA1
8b4a60a6a3be0d9c94e03c5a6b9400396e02919e

SHA256
ff5365376debb8ca52bbc5260c8b697b1bebe998b6b8aa14bf6aad04d3466861

SHA512
cbe40af874d6962d074305003e090db98c54799068f9fd6650095deda24bec6b4543b48078f62db8a65f81f6e7d2725f2722ff26f4b319c35618bd83d3772a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8106390a2fecb7bdfb7af654aee4487e

SHA1
0617c13d7ee2a34d94cf702495699088f71a8d9b

SHA256
28b94a4b07a8d0900f20f8bd3755e4a584784e1df7d421905b432afb200b68eb

SHA512
235845b794a06ca97b54b14bbc30b7e1d2e36c9c89a9c8e21484e1e5ea3b6f005eabb74cc4b908774f75ac75c53b7d591fcda74f785cfba6b92ff4f8c236338e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87f6176f784d65da10a8896fe466c630

SHA1
b36f991587e3115f13414553f60bf6b523f2fcb0

SHA256
d7e2668e90b36cf83e64c89cdf1775b22ab7471c09583216edeb24f08e99c4e6

SHA512
82c688c9d1a5b46d8aca47b7d4ae7c1caf631e098ef52732743449d50f6edc0ec64721ee1f9371e8e15f7453289feca2ec6a04a2ad26b33930a0b0f764fbbb4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
653907e413e170c64ae06257869df5a5

SHA1
2f18e72cae1f15f7e470dc6917f055ec75f71d29

SHA256
7311c77ff605e2734dd9e9a3c6911088e8b0f8e507b1117331d71cf7a22710b9

SHA512
e2e5bde5c09a043571714160a4034c20588bec3768cca6353fa0b1ba5884b896b59147d07be9891a8b8073c669220d1814f7fef3b4e65cd223e279c87fc6af5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
614ac932b0ca0480281a56032dd1bfa9

SHA1
261b8a518923560ebc43942e372fe325d0d444b0

SHA256
b3dceba2bb95e7b1384ab66581b2a5caf4427306613dfde61778b5a86acfe370

SHA512
7881ebd71568365c7e9d03dcd01c3745bb70fce8d7d382b894e0020d80532d87ede61610aa9ce7099598d134f91836e2f674ef8c885b1ceedaed0332578e621e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5df337c64a33f1898ec4fbab1dc859

SHA1
90582b8cc52229670bc830ac2783a9c8a7d8e7cf

SHA256
f6c2c5834602835a879bcfadace39e4c104c5889ef815067e87d6b3dfca15d16

SHA512
02480b511b94af34d34ddadd66705b971d582927ddd22d307b3a2cdd1d4a3a62076392f51f0f8e556272cd9a480ffee1e0540a04f852c2d40cab26b65f03369c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e99efa8bc1201b54ae4325d1504f705

SHA1
4f0aa454a47b3293e01127e732a64a9b570167a0

SHA256
cf66349c16176a37eb720e7cbb9c038c12e417938c7078460932f0b598b6bc41

SHA512
cd3fa7c6fa13da3897ff8623eed642fdb4c5ea7e3d7292505d3b7e691268a8bfd5ee22e3efea74b05ff3a6c2050d3bd24538590a9da5bf4431a879e790296190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32be38063b0c4e1191b264970d958a1c

SHA1
8d3d87d10bae83b303e7fb0431455390348d24b7

SHA256
983dfacc033c814f5d60658dc1e7f16d61d6cff4eaa5a9466879c0e032bd38cf

SHA512
be6ab9a9d25dd3b1166357d33873b458a1a0f8587a2c059440ec95723995f3ed9818b55bb7ed00c01099e38883afec5ba92e0c800e87cb9723ac7d2f70da16a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ad7d60344d1369533ea90643a96f242

SHA1
ea68fa3b521ff5bdfcca3187691c750febcf6823

SHA256
c9445b190e251711ead7c08e00dae1add566633c5945b088ec105dd3eb0f994d

SHA512
c2f376fc15f1e44167a316b59af12f8201386c5cd903069ba83a62fc007cd89b68ef2199baf94f0ce465235385dcc7ecdc6cbc32bbd95fc1ef8fdaa17f0ec893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e37b910e9ee4c975cccc40cd68073529

SHA1
11336399cc5ac6ee2a6a084916c02ec9a2aca7c9

SHA256
4e9c06b205f717f658812d2c39227a8241b81bf63ded85abb322d3871fb3ef6a

SHA512
55380f12e53df2d85c0cc97659e225d20b1ff466c75d36904f5f2118b185d44bcc7f217068d51001ad6fb65d426bd7352d94cdf9b6d73d40275f2f2765a57c7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab98C9.tmp

Filesize
64KB

MD5
831c9c82fe49f32429e57ca1b028231d

SHA1
63da00b8e94875d83291d2064138676f97dc770d

SHA256
9603848cb69c87d8e336e824d6e0f77eaeebf4e017f2bdd94ca256f98d91358e

SHA512
f10648a39ec73ba61526ca7162343a2732a39486798c5ec8b0c00debbc6f218a26820a09e10607cebb11030b7451a49f83e60f50a897ce6ea78103c21564e271

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar98EB.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit