bccea92012c0270e40eb01f11f21601cad43e6fb45da576d1e0378a54d1d6272

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e19182dd75b73f4147fbf79cca3b0eb5.html
Size

71KB
MD5

e19182dd75b73f4147fbf79cca3b0eb5
SHA1

475816ceaf263bae21d1781950d5275f9b591ff6
SHA256

bccea92012c0270e40eb01f11f21601cad43e6fb45da576d1e0378a54d1d6272
SHA512

e348f8306b17ecddf0c507c7d19e12350e9bd7482239415d39e68e35e90bacb8666f4702f07b414f2e866fa77d1334d0afbdc4fa36a30fbb4bf117d4478097fd
SSDEEP

1536:CabquklcMklc2klc7uG/bI+3zkcKklcPEijZeqhUEijZeqLyUf/DZvLa7mEgM7bc:tklcMklc2klc7uG/bI+3zkcKklcPEijy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BD3AF01-EC2E-11EE-BC03-E626464F593A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417701224"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2556	1888	iexplore.exe	28
PID 1888 wrote to memory of 2556	1888	iexplore.exe	28
PID 1888 wrote to memory of 2556	1888	iexplore.exe	28
PID 1888 wrote to memory of 2556	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e19182dd75b73f4147fbf79cca3b0eb5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9290f3198f8ddb5649898ab51009fe8f

SHA1
1fa75df5473164313bbfdf347f1e4fe4c919575e

SHA256
6f3d550fa4a27c135f3c74bb48e6a7a17738065c5663db31a65665406534edb4

SHA512
b31bc245a7ee20e970a071f9ad980a2966828cc7aeeda4af6c41809bbf072fc3c24b9e0e7039c45e0716bcc9b3ae5984ac4e3b37a0fcf7d56028b09a8d0457f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD81D8E4E234606E8F9A1C83D9CE616C

Filesize
472B

MD5
d40db7ebef8073061baea727e0cf0f10

SHA1
d930ca52c03495ad0dad03efc423b1d1f6319493

SHA256
0907ee65b4d24cda8a107dd4566818822f18b4d5f8ae2674d1787640848349c0

SHA512
7c238e7c7b68e0852c05a44367709d2e71c40517bad4e9a0f3663a853c78b8deaaf63e4ea7ba1fbc1a819387a47b62660dcc563ad1dfb96226a7127c674c2c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
06c507c8a696e4e5926ce84560475d99

SHA1
40bb2e146c8f99b60d2c867a400d7e31a56d4118

SHA256
271762c3e8611a42aa2ebaaa636484997f8a2f80d7273863f16eb615061703e0

SHA512
8a8f20447b62d8a6eed157ca02f0bffcef4d41d8e349b88f920b1f4e86741b6377a1156d267009b210ff0bf94d5a5983026fc1d69e8c34c08546747802df9907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e424250a1f547a1b667c51527906aa58

SHA1
3ba5b3614b8bde0581c46b5c53072897ab397081

SHA256
5b87d33f2ae4055e705dede3bea83cbe900bff5a706327d3fdbd286c8ec2c647

SHA512
68e4ab6e150b5e3ec2a06f2456dd8fcc9a83dffd2c9d5c1cf5e6e76eb1fdfc17234b0916434cb17d73f744ee3320cab4fdfddbc6e0d2731a4884266df3f54bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b14ddc2d5ae0e6e15153b3daf4f480c

SHA1
68115aa518ddab3038066a141a701fa63976913d

SHA256
ec4ffc0077fe9a44383e10f2c0f434a1cc6a399e909009e9f14797e7854c5f64

SHA512
721af3c0891a63ce7767ca58b87c2dcfa67cee9786ce954ac39b3a2710652aabe64e4c03e9b8fc2b37f7599c5608bf412220b3058c5d762f4bdb4e6d9db3f997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b6c3241679dd5d637ce781477065f81

SHA1
3ea04fe69545a958c737bfbc3a5fe23530b46dbf

SHA256
16265af490ca17f4356abc86031d4ef26453a28ff7fd219bb3b2425af0a34fba

SHA512
7852361f5d824b6e460148fd63dccdfd5ff9d5fc4e672a155654baedf19166bbd59668c3f414a1b05c7b07c8d4a1076b5782c8483fe7569745a7f3288a70342f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebd6968a4cf485f595c4f11af265056b

SHA1
724c11cf2e8b0b3aeae8ffd9c5991104c77b1c36

SHA256
f850e1de4e7ec39c1eb9c6735f286c86c3c85b3150eef47caddc400e7dce0355

SHA512
bb33d0abaac5b9ffe708269b9213f2de58ac122617f79fb6126bfe7e1f245b7880ff7b707ed7704ee7db383164d43be6791c8861b007f74fa163c74f5f1c9e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d043fcd09085868bdfa0b22fff09140c

SHA1
73b94eacbc8c6ec967a199acde8bdbe9e6df7a63

SHA256
a60350843fa16e39fc9be31a746ae2dfafaab99bb1dba3ab4ab345d99439841b

SHA512
026d9db1dbfe57eddfaee64d78a3abf2f8a42fd5b6b6f7580967d0e10505e2f593bed600249038a440b05cc25d400007a2b1937aef7c3916dc5873d90cb04ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fe9f70d118c64feaf417567e69c5672

SHA1
a38bc84de44abd509ab16ed3305b7d9ecc29d015

SHA256
6072b36097ad45166a3a4e4739db7505bc69c793cb7ce140efcd427cecbd2de6

SHA512
61b3312c6b428518d8393f5800ae4345a5c2563e9fe6ff6706c295239a14d2e3c35276e527cbed1c13fb80f2cb40851d044ec96f3852f3b0f528d117898289c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
d8747775734be3b83f6fa150f1bdbe9f

SHA1
0e550dad0ead9e98fdab915296447502a17c6a50

SHA256
abfd63cb316664c305b7c67fc88f9396cf23b2d1c3660774315060c5a286ad63

SHA512
fa56375fb9c191b23de04df7cfa92f2a172136c6730843a10f0d18f106bb90565ad8c6b9561761cdaf24cc9fa715a826eee3eec39d073ababdfe3f6b08edd309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e1210275dd4d92d24c5735affcb017f2

SHA1
092c771de22434b9ba3b2f1596bdccb933aa4963

SHA256
074543b902086d89d6218b7beb92fbc98c632083d3a03038f6a4ba45fd29bab3

SHA512
f4584dd9d28ae4eb52a260013c7268c631d090f93ac31f4430cb1c7ff195bd50755df6482cd178ec7e2801e93cde9280fd8b9af720b2541a6790beaceb05bf6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13F0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14DC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1500.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit