d87b1b2bee0f40b7f3b5e730790844abca6e7e4676008cb1749dc10ea10df82d

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfe0075dec3b4f3a924a8671e7821d8a.html
Size

26KB
MD5

dfe0075dec3b4f3a924a8671e7821d8a
SHA1

45ca063ca2b6d2d4b70e4984df820e1fbc46477e
SHA256

d87b1b2bee0f40b7f3b5e730790844abca6e7e4676008cb1749dc10ea10df82d
SHA512

da93089509dcbde15b4d6e9a2a488021b148844630d8a2c8bc6ead72d52590ef21ea9e7d85d763c8390e8d1ef0955340ed6995dbc9752527b699aa7deafc0c33
SSDEEP

192:uW7RIb5nrYld+nQjxn5Q/DnQieKNnQnQOkEntdhnQTbnNnQZYXCYAnpdEJ4cwqHZ:FQ/pXA2Oy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417641569"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ED466C1-EBA3-11EE-B8EC-6EAD7206CC74} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0026b14b07fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000095f59b1e0f9d6a8e2fc7d9dae9e5627643d276a88798cfb0eedc34c2fc32d503000000000e800000000200002000000081c009fa9acf387563f90ac60a50261359c6d130d0a13822c11bbf02d55b97ab20000000d02f53e0961144e280a369060b6f4cdf6e53f328fdb0c84eaff4d51bb08057fd4000000043b3fb4647dcac57bafbf1e7ab31b1b6d96f8afc94eda292f8030be3ebc8c93ee69753e4b027cce642d0a7af2ec440a4fb95b4111f9a19f282a3add5e2774dc5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000f65708243e8fbbe88e630618855e47a565e226de7c8b0c44a4885993d5a503d2000000000e8000000002000020000000f904dc2f143f5ce94c7f9ce4ac4394be43dc5d6b009ff7153d16da3b085fe61a90000000c2d13d4af728bbb700f018513c654032b9372c8055551d5ec0799dfc2b58bf8d1857c75d5d61e770d0abc85a03c89b1505b9ef28de696c2e2591996b31fef8b76acf0af88bd5281dd28440479a073f8185ba9e16062519855d6e321cdc2506e5db07c9c040c250c05ddab9802af3fb2c66deda526ee7d4eac0578f5c557ad0a5af7ee04f1a31991e54533d6a860a611440000000f184bac5b205aa335e5c8fec0825d20aca8be624d3e3014a7580b1b5c87ebcc9a9670ec90d603002c79de7f1673cff1cb682672abbca8c1df8a5500421b0478a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2552	2016	iexplore.exe	28
PID 2016 wrote to memory of 2552	2016	iexplore.exe	28
PID 2016 wrote to memory of 2552	2016	iexplore.exe	28
PID 2016 wrote to memory of 2552	2016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dfe0075dec3b4f3a924a8671e7821d8a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1688d59acdb7a8f2780d763d4f0fef4a

SHA1
10e74d2ca0f450a200cdd21bffb55436fc52efef

SHA256
314e01603357e66f5b8e4a7cccd4e17aa306e06a98ba3c4abd99fd154d6726a0

SHA512
a9d72de1b4f2c061ad6810f01a3bca4f0bdac027f08eb2778d6cc07813f714bf0d1cae408d6e4997527bfabe821c824d16ded393bc814904dee69375e18720b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cab342b7add7e89215eca1ab1903d28

SHA1
afee6d3d3c8ddc969ce4f6f586920c7af5f53347

SHA256
71c84d2cc0f3ae1a43319d5561bf3d7d41a0a14e2f4d2e6d9079b6a6b4df93e9

SHA512
fd670a46d964caf793f33aa45058b95312cb567cd8791d8d0fa5197d2184157eacaffdd03c0e25cd5fa24147ba3fcd3a17e5073d5060b0428c951fe459daf980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
034eb151b755757f59777e355791c786

SHA1
be169b8de4c61bcf6d4296f3ae8f9a9fc401cff2

SHA256
d5b734a56196e38deb352ebe03665bdd35854506ec79e9df8f97f22b1c7f4285

SHA512
8a065edd7e4742b192ec1895379af194a40397a082525306e5331a657fef599aaf90823c541bed3e77ef25cb5f36abd85ee80da302be01627acb4d9b1cdaa0f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfc9149efd0fe34c8d28f5011f494b7a

SHA1
3b8350c04e3c98a13df25242cb67b58de2afa752

SHA256
fe9467010e4a73f7a562fb170dba96296a90a0bbdad85533a1e7b2f8351bb58c

SHA512
2f8d46b4771f5a36677d66da0194ab19a6235a2a06e31a29affa3d2d074a3e16e050585274f106702e82941d670a3c7dd6f0c0195e6d155858e58a01df1989c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac915f4e655f809ccf155f66949c51d2

SHA1
7d55ab947fbd6ccbf948acd0799582580711968e

SHA256
e6dfe7bce9fef04f29e7786f8b0ded4d51c793cc510c5a28fc88e0f3367a2510

SHA512
a91f4c14c4a7e7c85275b473e38c8f85765ca9569ba488d589f3f2816009d48398d1a42717369ef4c243c19ee7ed414dfb2c8f720d2f3cf4bf02335a0fe123bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1a64391868e7b82dfef14ac6809afa

SHA1
9d4b900d10e4c29cae084ba681d3b0361db7734c

SHA256
bf2acb30c3dedebadf6144df3982dd194d49d56a291a449ecea57a5bcbe68dfc

SHA512
3d73a716d42124565b445cec1673e0e70d3e0b0607d0c376c63cd6a60e4c1ea606764efefa36aa8c53c982095ad4dd5d26e5cea015b0b845b02ebbfbb87def62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12a32cd39176e520eb7cd224bcd7351

SHA1
7684b36647d5cbf016475855b8488435a0784892

SHA256
e78dee4bc0d8c6faaeb393fdbd39385066a9b38d81dcaabbb165a63f2f54617b

SHA512
e88635646c8173b09d5ae3c0dce6891f08f8c79bf87aed248393475a6dbd1565ffa2510fd48dbda78c8c9c08124b22372608cbcbdb9d25e49e1ba5e1433502a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E76.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7F67.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit