8236dc2528522dc26e2df56b05ff6b87bf74ff15fb089f1d250bec73f558498f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

click.html
Size

21KB
MD5

29353adbd13c73ff0ce6663aaf4ecdae
SHA1

934bebaaae861e8ed1ebfd9965a52311135f40a3
SHA256

8236dc2528522dc26e2df56b05ff6b87bf74ff15fb089f1d250bec73f558498f
SHA512

610754856345f37095ab14ec52cd25d24d555ba1d621d40dad9b673ca003d7b454cddb005314054fb3824a13a4f26336d8aa1549d2be1f0682cdc622091019b0
SSDEEP

192:PNx5Ssv99qXoqTJkNr4234kHkFK2Cl8xmB63on8RW0lRqOIMQXRwGKKs0Ozglc8W:5Ssl9qYoJkNcVSlDYpW0lRJ1p00p82N

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40395c885494da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a678b7bf9ea9198c6d03d94b8d1f5714c413c9c2cc6cbb4139746fb194f72d22000000000e8000000002000020000000d97f14cf3cc0b646e7918c76a686512bbd2c60522f2029e6f0ac53e85aa4723a9000000053a1eaab1e3b0659ec3b0289ce3348798da169dc0ef5c115f2edc6b037ae7afd6671b980cc38e3e394f084d9dfc2881b5ea69c35bf0be918a287e85256c246d1a5ef4305822426964a1aa9c792fae66519a4733d0569a6a9d978ea49df91e9ce0c85e31380791dee486dda10f6737b31006856f1a0a50e9e877cefbee8130b7996b9017acd9d6d25db5d78e0c9fdd4f040000000be59144e4e2c4d86090356076921209db0a257a10ed55b4d845935fe5946d0c325680f27ad2fb4e05805a312bd3c159256c9cf11f69221217c1283d3762e5bfc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000be765f74e312d8ecc68b6026fe9af4c1ab5d184a24f2bbfb439efa7c44048829000000000e800000000200002000000017f7cfdec39af6cc13b3bffcc8433344d669c474ef53b5caf81dbcd502aebbf3200000009f4479f14a1dbd44d13cd07755cb9c96e91064e4a268f009b353a99af36111d440000000ca0b240d3f75fa9e9e27d4f5b4db1d14930488e743f52968bd9efa13435296fc4b27ba521204b5950e28c5ea3702599bd47bb72faf2a7fa07a2af73a08285255	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3EDC971-0047-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28
PID 2844 wrote to memory of 1652	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\click.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
014a1579f97050bdcbbffceb5aeb0f6e

SHA1
39e75f88e2f5d21142e8f619fd8188bc79f9d85c

SHA256
9bcb0cfc958a2d00347db053ef0abad3e3e97785d23f1a92d45fb8d0282360ee

SHA512
8089c63f1ad8c0104fb90b3a426141995cd0b25a66ac0794c59c70b50ac766fdc943eec3f3f8a5e592653590dcead962c512b2de4fc79c9fbe69dc9a72a2ae44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a55bd6d2a092a4f403fa4fd83295b84b

SHA1
41fcf344afeefa697a8b6a9aabb38e6292bce7a4

SHA256
8b39644d0127fbfab31f35f702cbd12b077226ac1e0665214fa9bcb9efe026fe

SHA512
ecebd4929f0251d4807a5cd42d84a0ba778450d8121feb9886c0cb7e31112a5bf12b72df8a90df0ee543937156a07741a5a110eb130390e819807293a3177d78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23c89b55df6e77622650fd8a2065fa00

SHA1
eee5b7143d90a0c4a7dae997c3731f55b490b6b4

SHA256
205aef3915df6ae1921eda6df3ff266b0850b5c5e701da25aa0d204c9aec13b7

SHA512
297592c819987d585f406ac1a5b74d0a32df4c4b4d086aac5d8e55efc5eed14ea1e4be03c00094645a4447a16fe52245c045fe355e3d787b589854e658ac2477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fca60d101837da9dcc0d43f786b1fd8

SHA1
bdb87b82e2ddb6cf31be7c2c353f68cf850acd0f

SHA256
896aa344ecebe301fd989db97c64f69aebbb2c72bd264cadf863260294400bc1

SHA512
b669af80e2aef439341f90bac0bb6b8303b202aac81b945c2f81d6efb301658e446493990c715e151524d2ecc367b193eb8f5904fb2426f063de31805cc3fa03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35bba3c60850f3d87b459419e3c73cdb

SHA1
4e5ac1f3e20b5164466203780d52249af294eb77

SHA256
348682c4970ff99495c7c80a49e951ccd3d6d0043acff0ba5783ad57bf1b29b8

SHA512
3b903de90a0b2126b5b9551262e3c117572794f539580fd6ac8e07c10fda5ab34b741fa2c4f0ee46a168a7cfe0a630e896a9cf430b97b61ab3994d6a8b2fcd6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac7abf7cb7bb29ec22355c6440c0afdf

SHA1
f8f4d1c3488899fefdab3865cdd8cae5797c82da

SHA256
78339b6da90a034cef54c60c0b7424690a8fa37d0ff55447642b277a42e521ce

SHA512
e5cb80bd183f6fa9abdbe366b56e1575f89ca0fbdc62df6be61a1eae8bbd2991cd72c819b16f8afee5e177242996a6568d018c4d00840328771209d420ccf0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba2a515931e57f64e8dc49aaf54a197f

SHA1
cb04d21c815a5d80c5ff7fb6366d2652e1c9d929

SHA256
24a9ecdf201b8afe22ae2ae3a93371f95b6b1b3732294efeb3c8c6eb5a099ca3

SHA512
f9f7a10afc58d1c15dfcab674ad04a9b60f34c97571376f033895bb1caa9815c1140fbc2e6d09727cec110675c752c85036e00bc7623be202542b9ea87814638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70a51a44db06d8f79248f7ccae576fb9

SHA1
42d194c1319ca3d969a2be8459a1b3cc5f3a641e

SHA256
1fb82fb04266e32cbd66ac44e14d1348c90791e4bfa3f97e1be82b755483b741

SHA512
8cd84656c03ebe67dca0aefdc9c8564b8b67395bf38ab8b848b97be3b26c178fde6cb9ab105e6e9cba404b13a9bd8285eb9714c3f0abe5e114ecd18cb9db7ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bca7e9cf51197a9a97549260bb79ca8

SHA1
c116432af7f6b26dba49cf3d8dd56d81ae962860

SHA256
6c4e49803ef82e53135ccf533117883ee4bca38ef951879df77a90c3f373f6f0

SHA512
beec17de265a4b2d77c8a0c4f335ae4a2b370346843d1ef0f0c73146168e0d80c001362f8456a833363907084f73f8beb644644d03a53aa5b793c3c298fc383a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33BE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34C1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF41AE2A81E196B3CF.TMP

Filesize
16KB

MD5
7b7a779c6e33f94d09bc8fc26a49d788

SHA1
f3df880b4517aeac0e6b8a5f9a67a3eb9a412939

SHA256
515a08217e97f4c8c24c285b43e7cac8422ea65585a8008fba69e6c12925dd80

SHA512
b28a1157561dd840de6ab7a4bb101f48886f97b941ee0224898ec41e6b8a8a3243d39c3e4d51755421715f9642c85fa1e6b6a1e8992b418d4952e3cf8be28865

Download Submit