9d10c50749c9fd14ace209a7b92f66531166276a5366be40a16eb23bbd5ef942

Analysis

max time kernel
843s
max time network
844s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deQnkk.html
Size

504B
MD5

9720caf666460147dc54cad9910d0d05
SHA1

b8f4df4ae69e61282cab23159309b0c65455cd34
SHA256

9d10c50749c9fd14ace209a7b92f66531166276a5366be40a16eb23bbd5ef942
SHA512

6833a00c9e2d4044cf2eb07315583c032c753ee91990587b82a5c9bead8a2d544b75478aad3aa93ab9f95875a532c4d6ea2d2246f152973a70d79b1bd3b603c8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418511970"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7E6CEB1-F38D-11EE-A40F-5A791E92BC44} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000509029e23ffd2da56babe80353f560760216c6a3c0a9d6635c0974a9ce8443d2000000000e80000000020000200000008cd5bd32e4106c43eb60574410088837bdb4c3a2d0f289848ee7c8044dc7dc9420000000f855127c6b0d11b832cb7a205ef5a3d5b147519b094df36a3f808a462b0137e440000000f0e2a3eaa13ea27761871a73080c017504105a757e7db586c943e2276c06f4dbf96505ec4b47f9d3633b2f515d41d10c47ad54e8099f92183abcf056e768025e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009fe1eba99eb455826eec65caa4692aea07d02f8c5614a3390418841ff1706e9a000000000e800000000200002000000081c4009cb3409450aed673007f6cf19afe9cfa1a3e42e024b742c7aa68cb72e7900000000d38fc96aee091173ddb6c4f5bd976b8e5195004f68315ab6a0a2251afa5f2244190b5ca3eb70a978ccbb75ca6c987a76d3b50c975c53304cb2ff6d609f483217a5766ffabd12a11432b53211004de9d1910b8c8e8132923aef6a120d9a786091145bdd3f6d5b7d9faeb84c49faebfd3b060633feaa33a2cf331364605c99c5123941609b59f184e41ee28c38b74736b40000000cab650f725190079902064afca1ce74d40359b6e5e70ebcbca8ceede1123b240da78f791804db41cc456bbafe51134faf897d86b0e149f069a7d3d3e1580293b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f557ac9a87da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2156	2992	iexplore.exe	28
PID 2992 wrote to memory of 2156	2992	iexplore.exe	28
PID 2992 wrote to memory of 2156	2992	iexplore.exe	28
PID 2992 wrote to memory of 2156	2992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\deQnkk.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b3d6c4cee6702833883b45d733e538f

SHA1
6717d2b2b39fd477492e65e42f5c45f46ea333d4

SHA256
11fd887fadb06ad107164ff09440570db7cc9a0d3cfd0156a5ef1d6441ce014b

SHA512
334eb57bc1940eff536f46e2082ce87abaa485a9dd86e26fb89139eb9426666c5ec40ca5963187f657639ba78704bb6de1ff9f44e6f0ab3b2a81c9adaf9b9771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ff88a5e7d7e87f52c8fbceed925c4c

SHA1
307ed56b6189c7e371e605709556f5bfd51ffc99

SHA256
f540eee126c4f0eb2e807ba0daae74efa59edf17ecb65990260b0c8fa464900d

SHA512
b92729ad42464459e8b022e21d16421d8f1747d153d36400bad857153cbbd40d13e072283582a42db8bb7f03b0d39f5bfea84225556892457683f933091cb75e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec3581c2ea7fb7c515a80bcb8040d59

SHA1
2763bb427107de2567c31d3ae080c15da3dbb4ec

SHA256
50cfe387d4d34ae393c1617632c5d59d626f5193241e3ea231deb7451be3b3d6

SHA512
b024c4eca95d2056927f487e681f553de4c39e759f396db6df0f6a86be0279a2cd3b7849ec05a38a4a10a1c598cace5192be8e62c05c93aa7574a401acdad4f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e3352c5834402ff4d04bdad920df94c

SHA1
ba5782085f602c1066eb75f00ee80a19c4b2dc1e

SHA256
f1f8cc9ffc476b357266c53dc7d4eee896590f4b4bb8e917f142caa25717d1d3

SHA512
eaf5d2bb394ea01fde6374ab906f792a36c398b06bc0d2002b7c385fb8a6eceae45f100cabfddf2d9b8b9d129b4e3a0cddfe47886fd0ee04b9e4921a5835a680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4947ec36931087fb6de94579b94c11f7

SHA1
8ae3159517ad947427344347cd55291df5fc5150

SHA256
3088f01a70420a34c3434ae3d8fec87e860b036b86f92bdf8614195bdcef94ae

SHA512
7a5c01b2b3db9d81fb379133aaeecec1184b7391ec62c9534d2262feb9c92afde20100e68d3bba47fff81e75cccf0c33f7c56bdd2619faefd97fa51d8cdfd89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47174d4ad97c961dacf727c99ed55157

SHA1
580545d7ccc4fec7f0dcb3b9a51e32e5c24ad400

SHA256
b264f19049c6fec4fbca6bd26c3f93aef4c7f4f47f66b33820087b6cc78e7e81

SHA512
ef7145351c392e2e36c410c90212f880b43341a409872de0c69afd7272be21393b05a8658c69a42c3992975f3204f043420dcab3e71b49ae7fe77aadac195a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5cb995e90e02558f93210897c2037d5

SHA1
81c09bfe2cebdbcc98722ca363444c43e3804162

SHA256
985a0ef7641bd265969755f2d7163be9f8d708f3228899f9360bcb6421332502

SHA512
69782616814d94e57527ea310455e7f86abf01b732130643d9875d03a611485a6d4c3e7661372a88d55731dd66af610eda54afb97f11278c4a8ddf84cefef422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
611d9df8ac49c79dc017e7028ef81a5e

SHA1
2a002b6d10db93420cc266249cb0d19ad3daf64a

SHA256
d14be7a3822f0c57c6cba75a7528de7c76f95169872e449cf5fa4281f4991bd8

SHA512
0591a6ab504b13aa1050cd9a0965b6f6213c466a0290260639f989a349f21eaa31055416ad4ca67756b45714fe934b8f1430ba8ad234b9c10bfa610cb828dc8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14345ec437420528f5ed09057cc08e87

SHA1
9f5765379131df4036f6e2b0e3aac6cba1745821

SHA256
37adb5b43cf9c9890cb4b312cddc2134fec960f8b5cbec35c0ec3f0e3eb6a9ae

SHA512
aeaacaf28597764215d2dd8537dfdfe9b912aae55c9ed535f1fc66f17204bb38582228281ce886476416a56f406f0510db71122d0b5c3307c6a0846c28ef7a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe6d4332b5751d7ad0581972309e3e94

SHA1
920f62a4746714ce42b5e00c5c57245ed0c00972

SHA256
c28948b24fe63541c22dab8dd4c30b8b1391c4e232ee1ae933ad85815d1db068

SHA512
9db8055d738554aa3d36b8fd6775b5ef8d37bd62a4a611666563edcf970051c862058ab48fe93fcc539ead84592cd96c06926fc0cf07818801b1a1ef701a027e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7f810b95f80fe91f79cc3a3f3db27b0

SHA1
78b36f97190955970875a0fa64669d58f6fe1321

SHA256
b688ee89185f1596cf525bf1945ccef625d1105c6688b58141011dcb038da17e

SHA512
8374ae5f40309caacf11776713475d3be40f51f4eef91a7d2615d4466a46dea931659bf7b67b48bac86d19f66347851a4c597cf25e5c1e2a7cf1d40549f5ca19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
906a02add073692943f164628bb2a8e5

SHA1
406daa8920f6f25d56863be23f975efdac728f04

SHA256
5cdd018bc13895f3964dac8000dc1c05770bb51e7f8ee0ea04c09eedc20e44e6

SHA512
b4d1aca5b213bb2b1139a22cecb32e20a6728f6f98d9d3f31d01f8cd0c7e775ccfe3e19aa978b077d82252cae80644af1f23703e0a626225c895b9d84328a488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b18250e4b20d2cd8b7fde7cc5f65f3c2

SHA1
6c96a2dd6c2a5b6d8d4103a1b9e553a336b1eea6

SHA256
1bb4707272c531a6303a60bc9aafbcf6552747a9fa065c1e2158295b9e3c2be1

SHA512
3f0e7b6baab9d3746d91d725b39dd3753b99cda52e1797e2691a57b6e66c72078f861c8814e2759f901b53fb4e6cdbfb4bb7eae42390f64add685b101423af9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fbe36615168b9be0fff49b701943922

SHA1
33caab52a69928d87ac2fc8ac5de39db8c162ec7

SHA256
518662765a74381a254636aff78f35ef23e94f9831ec820d818dd64668c5c2d5

SHA512
3db53dff90b8c392f4df660974d57acfecd18d263e8dc58d2434eb4cada04c3b98d383aa1461e647f0928a5abf80536bd1b772c9ed198321d7485882d59f492b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e0c060f64d694a2074eb7ee6f44e10

SHA1
dfb7b1039d1ddfe85713c06c205e7aecaaf54db6

SHA256
7853474f0fafbee6a9114d79d945e4336046f913c16697982c9c3f24e24c8149

SHA512
3cd6c1b8f25d4457df7afaa5d6ec3f9ba28e8d7ab54ba63cc83652d54270b7add9d26cdcede8897e93ce726066aea46682f1aec741d49a865e821609fcf468c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AB3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BD2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit