e9c44ee143e040c1f1b22a9e9035546c987aafe80a8adab33c8df5d31b18eeb7

Analysis

max time kernel
138s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cnrbtn.html
Size

486B
MD5

9bdb72aa9fc6d9055f7200879091da77
SHA1

e338eb05cbab8865bd5296cdda8a5563d93dade9
SHA256

9f325e416171ea2b19f4b29e87f2b1e1361666fcd86d5e03a2a10d9826d29d99
SHA512

bd4fae43bc881314623fb735141e426dd7701aa411ae0fa302cc3b292a621f7b102ec565c1e2b085803cea70a1105c70c281df07930dbd4ce8b3c51aefed3e1d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000060826ef482a936831224a0f81f77ec794b2a5b81f460aff6bd75bc36ef0e7c25000000000e80000000020000200000009ce1a544720d6f79341f1f77c40a2006cd0d5cc0ef7403a76bf53cf03b18944520000000cb06dc9ffc952de225fdc4d0a056ecadfd04c3e6c853214e3689d4ea13614748400000006907047ee0d50e7ea5f80831d3512bdac0eef99139867035bce6fde5f9d41ad6bf26d74dea7ad6a88eebe53b85fe2a2b652476d51cf5a3c41d8baf0d1d1ece96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F84AD411-FF42-11EE-8D50-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c582cd4f93da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004b1c9b9153ff6801bd63cf53d53f139a88081f66926d23cf10d39f48e34b5a9e000000000e8000000002000020000000643c5dfb14414cbe6da90f1d2200ed7591466a23ddc5a169342e600deb3e6e8a9000000096ff902e6ba02a0ab765ea058ba81c08b4f7d651b387c805292e6d3326a887ff6bf00d5fb40aac410a0f9b748fac4b63331f481726ae609ad5aeeb895cefa4f7f2afeb68cdfa2b59c58663d1745ba0386a55f3269540ea578ff7fd49dac04ed334938ab8d54eba68c40dba2007b93b2f94615770749f32b36f0139462b697af20f195ae7efff499bc2a808d85f54e82440000000e1ac031788e983f727a182ffd2724ef856a1a663c180bc94fb0632bcab227948aa2e6faddcd0e5736d48e9d147ef210f85cae975cb40ecbcaae1a17d4154ff7b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419799233"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2340	2236	iexplore.exe	30
PID 2236 wrote to memory of 2340	2236	iexplore.exe	30
PID 2236 wrote to memory of 2340	2236	iexplore.exe	30
PID 2236 wrote to memory of 2340	2236	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cnrbtn.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b00e2daa7d2cdb50b0d3cb7a720871b7

SHA1
24ee3a2faa3ca8f516a50478052ad29e563ac2a5

SHA256
87c0ea412d5bd2ca3cbde255e3c04c3fd0028bac5ed74c2d08d3310daf6d2dbc

SHA512
9900bf2aa83f41a9897dca19a234bbb1dee1eb9a35a3c5e444162831c5603bfa8467402d2510cdfca71f7bc908f71e57740550edd5851c389e8d7bdda150e113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c0e93b4faa56d5976e074537026dc5b

SHA1
0199e9c142af24a73a71c4fea88c06deb3a0cc42

SHA256
f81c17129a2ba58026bc6a2e569f75fe82573039115b6644d00119172d8aa0cd

SHA512
a166312b9b809edd6656be65025855f4d042c2b637eb4654b38f8334b0e72527d3f522266fe68e27107b578b49841da5578e42d0b87e19e261bbbc453e72951d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dd5d228d77686829820214fea6888a7

SHA1
7cc07e2e425f8173d8de0352f35722f8498a390a

SHA256
093909d022183f21fa46dd1ed3925a17348f8b681fbf680c6fd0fe9ea12066a6

SHA512
10db38d2fd9446cfa53a089cf59e7113073594499a925ed2249624982c3702b0b7355c9fcdaf15c0d406a007460663be39b81b8df64adf166c80115be6ff8431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d488f2ad97d9e35cd052da466e443495

SHA1
8f3a882deba1f110976b22994599aa64efe7ab29

SHA256
8c3749b91895841a5be9f770b00946d45914a4b807b5f9069ce0adc047b12ab8

SHA512
8b768fc658ff07ae50f348fcb8c7d0b0efd3edeb79b1e0dbaec8768fe08981b35426c43abd951b23c52db479110e45bf2817001559cf3c92bd63e3901be81af1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c0c28e8f2ae03850e213cb372b3f42

SHA1
c4e10079c9cef98b112eb090f1926b27642f2124

SHA256
68ec405e64a542e9c439e6cdd22bc2d72e3f4f68bff45e38cec3053f55ee031d

SHA512
95c95dfa0a36ec7b808e09fe5820539af985b3548329b71b3e5da499c229cfd043171338e2203b3d9d4e8ce9af73226806f696d4f29f5b604d85f32d347ea38f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f9dce3a8a1aa3e262ca2233de135003

SHA1
9c3e66061384165b66c320b03f4966fe88d44166

SHA256
d531598778e43641257252dad1c9482c9ba649651fdb64eac176fe79feec7c4d

SHA512
1dc250582e79fecfe17feb2c2c408fde987b3f91a12f0c1e5b78319c6b2ce7f78d0ee309d846b3108bc47d0ca6cfcaaa6c9a67e35ff1b5864d25d1d8e7101820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da885a80794a9be669677f3255985c2f

SHA1
630eb2d8809b42f023c77841537e3c1641c1d739

SHA256
ecb8e361594863b1e79edd3ba6c977704a0588348c0bf1ba8e47a3acec20029d

SHA512
e1d8a44b765d1c44e1c9f8093bddf7ba5b422f11f79d3a5d5f5970b8434c38708db8c721b6a24e8b455962a24d5dfb71cc26764045c816ad717e693b4ab4d5b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0a6daecd64dca31adab8dfd7190595d

SHA1
5d08f1846dd232127e842daf346dc689df2a9504

SHA256
35a74de83bcd89ca83b5e33035c9c60d6f37282ab0137d3fc28c50b97d6b0b3b

SHA512
4657af877c1ae4840992a64e48fc3edc7b6aa11c16c9c8e24887a88e7f907b6d2311953f935337b07d61265ab7acaaa5e17d09b1b871187ce16ab64fc4df8a00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c060214cf8bc305881ce455789b1d74

SHA1
de0994396179e3981d6b448d566f5c09237791e0

SHA256
e47dad7d96dfa65320cafd4122bcf62499f254e66781c7daecbf1cf71b939db2

SHA512
81bd0882e233f4559e9edf2ee278ec641eb8c242b943199d2df4b5ea2bbc0b567fa1b4021276edb7bb35cdabf7a77ae1f79427070ac37f4f2fe7f87127069847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a17d8ba017a94b123f47f1589b4f739f

SHA1
858918bf0b7e92c33be5fa05937d33e7da05124c

SHA256
5ba7fadca40a03652a68dcc954d49011b2fa4349277f68c2493b40e0e16d5145

SHA512
0bf552ea08d0f54f844f5e7fc64019c4b7edd8558e7fd034270d9521d4ab29241d18461a344b14e967487a8230a1a1c0ddc2b0658060943c6e64b7daaa350c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e38df49939e4cb3690cd3ef85f28957e

SHA1
b954b6687840c7a8379b4dbd167941e7dd4290ff

SHA256
6573c6c03a2fd458f5e15e0ba8f228ee2e6029be2174236a0d8d869f8e600326

SHA512
13e45715cf3f8c63ee8b841f3e99b6a8ab20c4bc490cf39d848e91622ed88622a3f535ca74c0027df09a7197ff241084dd27519f453b58a43e9d8d02ca3483af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85bc13c02ea684a90931a61cf30f05b7

SHA1
7166fd5cefd9f8591d395dd3914ae5dd2cac49dc

SHA256
a99bb7d1989b4a99decd3f9a483f9522df55f2cf55808048eb5c90052bd404af

SHA512
6f8408f1c97fe380142cd3198db58b03b7077ba1f298bd7ad7062cdf0d07b91cecb4b1f571caecaa13606176ca5e78a6c0bd5c6c35545f753da124a08ad57e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4797c882322d7729eab5010b49ae516b

SHA1
287e799615404e3f72f7f8dc391b6e2f4b8c0f93

SHA256
e160e5c6c384687ce0e8706f5d8355294d54079ff949751a899b029b8d128bb3

SHA512
c84051ac03b7527abe99b0ddfedbf239252a09d41ce26b45eb819c9f7d889d23147a5ca310277c0bf9cfe8534f303c146087b35133cb8bc47917903ae45cb8b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8aab5ad0af633d5dec5a1d2dc8d07c88

SHA1
d6e4969b7f205c9c93dc32c4c4fdd14728b296dc

SHA256
030ffcd723b9a941e08a18dd4c966e0e3e5eb9251a4a76bbed0acd690cad5c77

SHA512
2bb758925ab02a9ce1af14ac80f4ee583d751e63595041e8d712df2c52d601cf3b40646f571c9c1f59fb4d59d46fa5eaa1007da7d8ebdbc0dd564e98a8e497f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b23522e0a4e443d67ce55d0352818d

SHA1
e23238504ed09063e3d7bfac3843e380529ef3f7

SHA256
053d7ec2e0231b54b8f1506c041fe7db3ec6b57f43095b93f971b731fbd72270

SHA512
14c5d334f2bff95f7bbc3d4eef464c53d72eb2305a126dfa085bb1acc761979a8a0a4756d713ad3547e981c114973d25cd94411a98dd60df3e22429bfb11e965

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab79A5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7CD8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit