7c1345f7c8b73d58546c65224a9b966f1f108ba3f1a29a987b5504477f153adc

Analysis

max time kernel
26s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

API.html
Size

300B
MD5

cd6a01fa88fe9f5c3cb6ab47aa8d84c1
SHA1

c471560205a93a62327b496d056a07ed61899543
SHA256

7c1345f7c8b73d58546c65224a9b966f1f108ba3f1a29a987b5504477f153adc
SHA512

b675969c4d3f33a65a0907a075bb008ab96beeb13df309563148f89f6d21fda68ee19a1b3843e9c3ab39af99594f3303051563f46d8cb1696fb3aeab7ae6353d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA795961-2422-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28
PID 2036 wrote to memory of 2696	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\API.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b353623238118a6c0dc4eedb0c08a764

SHA1
4da36860342394ed70b49d9ff9f17455d176458b

SHA256
a58939a0c1c9031bb41d4c2cc338648e05fc08b819c372351bae5c433434316a

SHA512
0f6bc5472bd47d4950bb6b087cf7a9ba1e436f7923fb1dec100abbd34db8a03efd5c1f089a27edf1e0ac7e129b345a89aa3eb5f4d48e97dc5566f532d5322db8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da97471c97bd043774b10b8eecb2297d

SHA1
125f47295ce8a5bc612b8404d7ecc3495996d005

SHA256
93bf5a59e8db138bbb38160d861fce8e46e297b58069cc1ae2aef37de4f63c61

SHA512
d1cae56674268f1f27531f6f925de2e5cf5d8dc1b9bb7542f472d085053dfef5bfd1381209f626eab57e949285fd35742130ff74f18dac52cbc5f4b3cd3b917c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
343f695a4c03c6e3e3e6aedfc8c482fc

SHA1
1e1aa5c538fa27be6c958dfdfd13c2e3035807cd

SHA256
c93c4b6d5703d94e9c630449e4f96982ec7781f50bc0c93590e87e1748098d16

SHA512
2edfb9f224ded3229812b3cab78d50beacd2508d3a3fa540bf5e6ffc2ed50a32ab349672706b9d3a39dfd6135cb2634b17bd21cacca2e9af4a843aa6540e86f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
017a9e3fd1aa05c25c6410ac892b8ed7

SHA1
98272de90426ade1f6331982cd2f2f3b68e8826a

SHA256
7662272ddae5fe47747df8a846b720e45cd1d52ffa933cd0271cb18c3b62050c

SHA512
352666d4252d16409a1b16736ba64b6b6d87c5ad61a944d2f50a70345b82a7c5f6700a70518a1557c05db5df506154d4fcbb44fe9802ea754c9399445fdd4c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c735fe9505fe1235afa25b5cbb81a7ba

SHA1
f1af91f7672f1306c603aacc936f39ff68fd2fda

SHA256
25ae562db3ade6747b598893833ddb446b8a8c9626db992340e7740472a3867a

SHA512
9d93b2796d62dee3cafb5f3f315491e41e85f9ccfcf88b771cc81bb308049c3935305c25183695c22a4f4d5fdd2bbf90bc41e48cb959f5e7c7ab058dc129a473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b9adb73578c336b9fb58a92ffce2894

SHA1
a507b08f46f0a63fbe1727baddb33e55aef8ad3c

SHA256
5adf6333c418d45025711b51875d3d272bba4e5995abcbfbd70c83561db9ae54

SHA512
52b777231b28855e09b8632dcfd41647b96014aa73d501157093b4c2e657f247a42e95fc89b0b48909d186cae1b7d00d4f0c512d3d0348a97e6e117ff099c0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0469d24a3572b1542678a840b3aca31

SHA1
fcd23ef4ba51843a15487ae169e9b8fac49614c6

SHA256
a50ef5f2c4e3e2d083580af3c1aa37b64ac215abdaba60166449f8b159d7b48d

SHA512
5017bcabab46b1dba395f49650f8e1743c4fa0ee5569c85d7db97338a9b6ed072e95b599f36cff475248ad04c3d377994bce916279bd6ec7dd330ff43178ba47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c7560c3fcd10c5c187ae43e635363e3

SHA1
c354b3f6f8b69419eedf44391f8a3511e03d8671

SHA256
dc61e43d1bfae5f3a98a52a69a03a87f49b6db298273b2faa3e11427237522ff

SHA512
7291f1a9583128054a41d171bd54e9ba61a47ff8da54dd7ac98fa53294945f792f44927db307605665478debe5086ccbdb4f0cbe05800d7230154c1405fdf11e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ababa5abd6304212f0254e49135f1a3

SHA1
f479e753305d393bf88f5f6748a6cd29ac4ff094

SHA256
3be589e43e6bafb864344ff4be4772d0702c045d4e47a8a31a6fb1e551600fde

SHA512
a675bb69bbe01d37842f73dc502681d5d3d6329e2b25f14e885f78278539637585f64f3d65dcc6d21e12652b4647468fc817956fde97dc4967bd74c01efb9fc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D2B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E0D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit