0379084ffb12bb0346f82623a040fb64e2ded4c57cdc687ccefd2e3d683c5e40

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

P6xmB.html
Size

1KB
MD5

59706075c44348c3e15025b3baacf506
SHA1

a9919f0a81ec421f136740b53bf0aed60fcfa95f
SHA256

0379084ffb12bb0346f82623a040fb64e2ded4c57cdc687ccefd2e3d683c5e40
SHA512

661db060572439070613d4decf961197787380853e85e7e75fb21562ee099c4ffdbb22421ce432243b98cfa3220a6c85d26adc96019b171af43e0e0de33b9d0d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F09BA251-36C7-11EF-B97B-5630532AF2EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425903651"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2416	2220	iexplore.exe	28
PID 2220 wrote to memory of 2416	2220	iexplore.exe	28
PID 2220 wrote to memory of 2416	2220	iexplore.exe	28
PID 2220 wrote to memory of 2416	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\P6xmB.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fd96145a7f09b711458ed01251fa139

SHA1
17aafe1c4c67345d6aa5cb3f7dd494642548c3f6

SHA256
7d07c8c6388bf3535b4e1532c33292238b9baa653b285490708aa59715616936

SHA512
3cfe5a1f83c43cc3257be63d6680da12fb24598205adab39f9a9477d68b8a47bc2905895f7413f05bfab1d0c069be751cc2d4b44c562b9c0dd315e59baccdbff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48ba6864ff0d042f737977d0596dc2ec

SHA1
4ed2d4db7a0e6946fc418c6e2b7acb2898f1ee8b

SHA256
11d7f7a2ffe6f00ee34df900e4588e31b68ca291c3a460b7849f0b3b430afb0f

SHA512
c12205740fd56396349f6a95abfa57c13c617fbad0645e577ff3db250eea2368c8f5d2647b0749f22ed0f8264eba2900e06264662b88c61a674f6dc11382dc77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d5a6198cfa1d35d68ba15ff77839b8f

SHA1
72ffbdbc7461251bb5193449bd22f272b67b8bbd

SHA256
df8c7e8f408273f3227ca6107e7b27713dc49a9e1673973dd49699c3e383888e

SHA512
7f95542234a87f64930f3730b3d3a6630a1e6b540c35fafbdc400e71b960af9ef1509c65df2e19eca412df82cd57737297001f0fa60267978e4fbf13dd61d645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73a54f6b140652eb09f6ddfbd08dc62f

SHA1
faee5151b4dbf3a5d1cfa9bce34330f1d8406894

SHA256
7432c0bed3a9b419cee58d16119aa363467b436feedf55b871caba0b57a59e72

SHA512
34d8a37c3e553894a85c705030bb8c1b0bd9fee937c85a6bdd182f015c2df764a6c62fc3962f4ec08bc2825e22dddd886d37a119d2d7079c6f91f76410cfcad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
472d5efdf493244151622c72cb0db060

SHA1
21f50b07ec70c7c839177d5e4014e7f1a376fd04

SHA256
3bd50b9b08c3617cf9f7294bb1107547580c08bd1da9d0b5f3f9b046747e29d7

SHA512
20bb5d6f90ba2572cda93ae900a662370a5e71d638a3ab4b65465fc97021b79aed54246f8e20060f09480f1c3b37505a8c602da6bf96eee6146bd5085ef7f0a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2271d111e825abc2f7c376877017d9c2

SHA1
c9525d7eef820050c21bdf487f4eb8b229829146

SHA256
bd4d0577c79e11a133cc9972c90a87799d18cac57de8263c8b5e55dfebc289d2

SHA512
516e28347b1afb9abde1a748d6803eed76f8bd2719fa068a679326781ca33ccd747d2a59b975fab742e284eda8caed3827d03f9eb96057e1dd2f172c942c9030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d08d99d151623bf8b136e814d81ad15

SHA1
30e7d98c11d2bcc25191ee6ad2fce0c0648489b8

SHA256
455a5a7c84ebc49ce361a20b2404f3e7ddf85d4260d5a486a8ae8f19b2be514f

SHA512
6a39fe777499932a682c182a69b1003067b48ba10f9c0de68afddc8ec7ab4cfb32ff73cb33f827681ac29d3cf4c80214149e2bfe5b1b7341c971ded72b86475a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
229685cc8f100084a35686061a95f986

SHA1
722bb47161f04afe84f886191f74a7ef75bda56d

SHA256
eb2a1693012ee9bf916c2fcc44c2dd872b3c8c142b0519328b72f62b06b413ca

SHA512
a3785c21472ecb1a29bddd62488dbd34f08f58ddf1f98826bb94e2bf27303cefea6e85b53a2ebaa14922079e232ec58161c9ccfde9d18f3b25ca884f90596dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e1dfe082dbfd6669e0ea2a32a7c0aa0

SHA1
3d53885a542f532681a1564d09ac1a3bac6536da

SHA256
44285c0e36ecb9582a501f0e511ca80d1510ca34d7a54efcffe09e8547d94d9e

SHA512
c5f63d2c7c9512d7df8c12da1043d9c072bb527ec674cf28f18dc3cb2b3b38218f7c8cce311c58753f88fee7a77deb76c4824b7b7bfadf5fd67753d0b68170c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B46.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C28.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit