7a8cddee77ec4d66a7d725c8ac6c2f1c9e98c827c379bcf8ec1c3ed50fa08f32

Analysis

max time kernel
119s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfd5bbda797db922d234c9ea31d6c1b2.html
Size

10KB
MD5

dfd5bbda797db922d234c9ea31d6c1b2
SHA1

73667a33061d9889c3cf04227fbe458159c3c108
SHA256

7a8cddee77ec4d66a7d725c8ac6c2f1c9e98c827c379bcf8ec1c3ed50fa08f32
SHA512

edecad7d2ccc04f05f509c88d5a240f2a9751d315ac7425f9f6bb242418864b1cc3eb45391130c700877209bf028155f1dabebd5f240e8278bbdca682b3c9d84
SSDEEP

192:MNUGwN2geRazM/oePITpqAFw9qgp7RO/UVPhZCeJl1X3yQeRc/UGx:M9RagQ4pAS9qgtgcVfr32Gx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417640206"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B0623D1-EBA0-11EE-9D28-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000f7605686c94462ca9b445aace363dc0104ef616f62e0f1051067eeb23c71b8f7000000000e8000000002000020000000d8c30a86099e7c0769464f536d114a8f4f6466786f4501f883997c70047bba3c900000009829f9e5ad6ba031bb70940ea1d170292ebaeffcd185e32aad5010f83dd79a6e63e6473d696b43057f6b59ad3e06dc80c18229c9b00aecd3fd54bc805d516163b0c1b995864d1c9ca1af50bd8a21b6a4f1eadbc44c50f986b5583fc4a85788040084a1d35b8c4380fb2a66f897c718fda198b8adf73b0dd1c633e2f50dac7aaf0dcfc2010cd4263d658a097957d91317400000007abb0a13e8d353b33e2aac7e81addb763322da0e1207601a40ebb938e70ef05bf0a29eda57faf9d3ab03b57bcce5475b2a936377527f82e92df2f859f70929f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000002ad8bfc4758034a575be02209be926bc908eb7dcfb41dc0f3d0fdea892d9ad61000000000e8000000002000020000000aaabd809821b4f081d684ffa26bc46b01726432d067f08287bdddcef6031b92620000000c7167a8e8d755377d99c8b60a2482c16cd0d84874aac6394717061719c4df0a040000000d5b0ae5caab388a830c7d313ec5e0d3502b109a483f37a804130ddbb982e505fce2fb304d04088615443dcea2b45addac18e0060ba89a9c34c3fe46080bfea4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901c9ff1ac7fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3044	2208	iexplore.exe	28
PID 2208 wrote to memory of 3044	2208	iexplore.exe	28
PID 2208 wrote to memory of 3044	2208	iexplore.exe	28
PID 2208 wrote to memory of 3044	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dfd5bbda797db922d234c9ea31d6c1b2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627606bf97afd0debc9a3aa3d6b1deb2

SHA1
0d91bcdf592e1c878bb9f0fced3afa7dfd18be66

SHA256
3daf8e63d34e5473e922e9dd6a2f2b8e725293c5a82ab49ab8c82fc3a73759dc

SHA512
65d59a6cea5f4481772fd56f05041587de10693b12ebbedac0f63ded99a6360d25885556bc64d2c7ae6d610c958a1b8e0929b5105c110582acd51991d45d38ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
005908c6442527c6d88615ff0c3ddafe

SHA1
54a4b514b872faddc0717391a413cd4f60528722

SHA256
02a5fe6ae64b9ef581228711327080361b6174d328dae03e75ec9dbc274728a9

SHA512
b7a8f88b4b0ae1db314583477fe4f02888a0f543b6c72863a514f29a8975637c3ede2c4698f8d776f13a90933d9ea48ef96a7e9e80ffa9fd63838924a2ac8336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb8495d9066a6608e328b2f6dd064b8

SHA1
596570c0ed63d50ff0e6f95f4b94562f0d9a3ee6

SHA256
92c2f99e7287df8172e8645ae7cd6de6b851110dc187ebffc2b7e1ffc6be311b

SHA512
155a06baf7d969cb1fcf4d8f16ec1f0fba4e3379fc47fbcf375f80a772330b3be6d0084aff5b949ad7f008a02d40ef67a6b29a156c87d54e1080c8bed58a7313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b85713f176704d7db008f2b708ef1ea4

SHA1
86f969e9ae17384a9a8e1286af0781c67b81ee9e

SHA256
7a71ac7eb642b796aff3125cc9414094962c2d9f9295ce77bb0400e2204aa8ef

SHA512
86dfb28544240b94b63abe62ad0f7ac7f3a1ba0ed367ba1707d619f8eabbc10c616b5336c8f28b7a9a0687b9258f35d7d7e7e59d43d65e1aa6d11d7d9acac7a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d4787c848b8c947c7ec49fdf4c69d03

SHA1
a65f7bac8d4575b80b036426c6d4475ca2bf4297

SHA256
360a23ea632babd45a5b43812441a584276de35292ced888fa20c3abdac5cd56

SHA512
d1abfb91b778d5b3818b7276800de6625a5784e6939b4497d271fd2f982d9a9b26f8f3777f6990af25a71841fa6ac30ac0c848f88239a3c308080853813f4082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b096558abe562f39034efd3b5b0de7e7

SHA1
fa2ef1c178315feb3e94d927cd6e8cf1933470d8

SHA256
d2e393f041d019b85dd70b461c5f724983c3d39c66a4f1cfea1c8c86437c9cfa

SHA512
5214c75ae56fee3d7e7bba6ec963d9be84896642a47b82ab7f6e9492e6b842c7c2c0fed2a1419bbdc09693e793ab0aab32a00b337cc4f4eb31f8dde68e409af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f5626a763e9a7b53f2db59c3c09002d

SHA1
d8221eb99d46df617f15c0276345c8e3eaf9cf75

SHA256
215db1ee5756be94c32a98ba5c82a9a4996740f831e9fe4b72bdd9bf888cd5d5

SHA512
06c0f44a4f89135b6d58353a7bb48623132fde3343b87ee747dae283f4514fef8d1cb0c9a57fcc82e0840975f1025306f862d3fed1983c30c364f95275f03e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc22d1df1f816f29ad36fc71280c0ae

SHA1
d1a6ecc9b89d8dc0e1aaf731c6159e4555df8b5d

SHA256
27347491fed21207106f964fe95d24e78e6305608e0f7603fc5b8054f51f6e78

SHA512
764a963a3655274bbcc5354319327b90d882d26e6e4eced0db2463ebf919028b6e9eb314494af3cd48a2e2a74d115a98ff27398b1b5c3d8616e709ec8b0efe0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69F1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit