ddec5924bdd5fe672e4f34a34b2029d3de232e6300326dd250e0118559523680

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e09b65cfdbebe42f9892e33cdd1c20f7.html
Size

92KB
MD5

e09b65cfdbebe42f9892e33cdd1c20f7
SHA1

c048432c2285285af03efc955ce66e7294026163
SHA256

ddec5924bdd5fe672e4f34a34b2029d3de232e6300326dd250e0118559523680
SHA512

75df3d5545edf957ebb6eb838d2f13d1fd3fc10cff0b1789c28aa359d69aa276ca115b01ca61b39a7d9fe1d939e5ec691d46de0daa8bb4c1cc49137af6b5e6ca
SSDEEP

1536:gQZBCCOdg0IxCFxxOSLU6tG4MDU3ddAMaRJ3SIVrzw/Wwryv/3BMUivKxgbfxtOe:gk2e0IxfQPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000006a040852284deb775f1c7e854fc0eabc396ed5e8ce1df82b5a6ba3d4e50faca5000000000e800000000200002000000033c3641b2253dd3c6dae9f938f60a8563828d99da3da49a0d837d8a048f3656390000000d5274d4815a49a7e1165dafee5a858c1ef84320f9be0d2ff5b04661a8de58936e9abd84733d2771fbfe024dba97e30603f90e4789115d6844bb0923436538f661a40bfd9db0497b6040acbd17fe340fea89d3df732e5b3a830b0243cad43978f0eb84767fa9e834129975ea6e29f011149b4f1bad44dd814340083e427a68561c42a9c3244dcef6be9a96bd7eb599675400000002d5f08ff407ffebd2b637bc92746a823f62a7c61934062c1abd1b2973a228960d33f7d35ae1f37d4c8b41333c9924365169a6aede6da36f8c61eda89bdf83b5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70eeb55ff37fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000191572cd9f7b35e82576c8b7253a27cad7f8ae5bf7e8404041b2a88428f3b823000000000e80000000020000200000006f93eb155caf1b62ef118be610eb09deef0fd0bfff4dd4429fcf356b86552eea20000000d5eba15f56298a20ee01e25e2b6b836c751e7973c2daf89d8ee6c6e9ddcd267240000000e2839dd3b348afce49dd1143d6275421b55a7282a4853240b974c0f2e5c9f499e80c84110a1d5cb9511938b8b244deabdbcd8e938ab7079f6be2bdcf803926bd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417670451"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83D398C1-EBE6-11EE-8C0A-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2696	2236	iexplore.exe	28
PID 2236 wrote to memory of 2696	2236	iexplore.exe	28
PID 2236 wrote to memory of 2696	2236	iexplore.exe	28
PID 2236 wrote to memory of 2696	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e09b65cfdbebe42f9892e33cdd1c20f7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a68704e8763e6d484f09947ad3b9abcb

SHA1
f8e579927ca449800f4abf36a15c412c3448c465

SHA256
269ad59caa93f0251c50a6cb982f9faf0f3f4930df3aa367429a0516ca7565bd

SHA512
519886bd247d577104c77f1551db97c778ed8b606d68e29386fc6fc4b43e5400eba909585e5fbe6e52e9fcfda49df30bd427d4d8db1525031ccf0728d9f2e281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab27df27ad156317585f5e75673649e

SHA1
9bbec86bc7b8ba462c394e99a06fce3d2128121b

SHA256
0b8cabc3f3b3469fb6066d8c18c3593ce7cbe1d1e05a3d8cdc5028d361522828

SHA512
042924aaa79260714cc7a05fa15bc043c1673dea60c26fa5852bc2029486d08a5c07191fad604ef7fb761f7acaf0c6edd9eb40e3dc2abcf04f999c6bc720cc66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85fe06f5fdaf91b9036be22e1334a7e5

SHA1
582001f89dfa58928b3e2f2eab2084dd17663c50

SHA256
2749b4bb8f4febda5f7b73744fcd443a5f211b1010cbe2fe2e4e58b37beded09

SHA512
f7bf350c3213378344ebdbc1955bb49b1d9155154713566586a17c4fab2acfa59188d343a91fe1820b6168fa3bbd966a26e26e97333ed6145a0701ce75df1dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8778a742a12bb10fe73b5497cc4d06a9

SHA1
315099d045aeb47b1bca89fc358e3281bb0a7f3e

SHA256
d8004a446867026e5239c0a742720849b4df85986a35679d80f688322b7b1d16

SHA512
7a08cb64002e9c189e55fce2ccd2c4ba81db75d57dcd31f1a0865f8a7cf13b8e635b9aaa7e5ee7c892b47b508d73ea52d8200709e51997ebabaf7e063874b7d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12e083c3b25aa7c9865d23622cd0fa4

SHA1
b3556bdc4c2be87b0037db388e5ca5c78f95f302

SHA256
b828e2e3b366f8646514bf3e0710bdd78a34b89c9d12a01bdda899588d2cada2

SHA512
bc0700bf0c913d68728acd440fb1784af27052e70422a91cac87014588dcfb68db4efe770610188dba58ef1d03eca9f831ea1d2188b744f9d0c9664b67b5f48a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f5228f3630adf047f156aa5144ae8dc

SHA1
45d4cea212ac8cb5a46ea1272ce4fdf27007c567

SHA256
f5d4d9f26761bb4dfe0532688f617f6a3c857b29a06787b34c554754233bc465

SHA512
f9a1bd408efde2f28a3ce54754307a67bf2ecbb8c9187c2183310b93e0f1569dad2f702c8317814cd8219fe36ae2660cad9b5f850b832c8c9fe61d08f400f4cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6d58baf517efb231cd774a68727ee7a

SHA1
bacc9e47f008458612aa2dcc696e68e344677b5c

SHA256
698e90b6ec4bc605b7a3c9502fd3f4f8b2eb4f83a837f89b405acfacd2987ae6

SHA512
5ccf3951e010cd279e62edc643ba7873bb7927c83da11b64f46c037a491475d2e737764aeb625f6f42b92be806719ba7eecacf96dad37932c8295b06985bacc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4db516361ff70fa13d85bc6dbd26800a

SHA1
530a96041b34ccbbb19ead18183d3a047c089e98

SHA256
9244070a687da1aad898707c362969ebf263f2807c76f8e3a99e67a9cdf13b28

SHA512
d848fbc21185ff4833b6b851a594e6a31b5c07f44c1124df0b5786a3613587f11178e38c7f659d3c5410c499ac031f1510540130deaa0617011304e1dc948ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA93D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE43.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit