fc096c55e733a3ff75b2b2edb9f4836a02866fb1e52bb8d8d7e284654660192a

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/IntegratedOffer-Pickle.html
Size

4KB
MD5

de86492c97e8d6a1fb60760c7a539a25
SHA1

848a17f2882e46f38164cc23ad7183fe670c5c77
SHA256

11c73ab6112a853e0930dc971f1fdf1be961a01132e5517c4069c7b31fb31d62
SHA512

ed3cc509e8935f5a0edcf613de31f6bfaea988368ff9634ca8e2e888937aa2f2c37d97ba33eaa3a61a25882c9ee30a52aff216cb642403eb685dce9bb82daf08
SSDEEP

48:Z4YnnBZJOnQFFfG9mEDe9DR9vAyB/CTE5AeApzVLVoBskL7/C023xPb:HJOnQ3ewEe39v9dyE5jSzZCBsk4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C52B271-4787-11EF-A74E-76B5B9884319} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205990e193dbda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427744951"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000febb4e4acc5eb4cd43f938c47bd867436ef19c4a02f6473447c7781d68e1f61b000000000e8000000002000020000000e7ba85b0b1d014f807cd234a7c53e0cbd17eb4714bf91afd35af91f1f5856ecb9000000081cdd9ab4df585e3cadc3f49cb242a0f9f8cc41ac5f79e5d7e7d9d65c0632aaa21dd20bba984df14d305b649aa423738ea0b6324c0d9c7980364bebf135249848ea81e8b903b7deed12e769a32f244c97d216225d5146f0b986751d1786150de51fb194d7d67ed3cb0c824de3c32ce4ca7aa0e3d8f2238e4033122e8c5ec146d3427367b650c705b0936380c475e86cf40000000124b37aaba6c4673d15d2144701be83a02906fb32d7b7aa556a2a67c0fb34409d70943cae974b2017b11d17a2dc6c3f89a2a1c31d52cd20d683d2f01772096da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000009dee88fb0efae757257d3bbcbde0d1ea651c1dc13f88ada0bf6be20bd223652a000000000e800000000200002000000037badb5fecc643f57c844084a0b9cb28f2d6ffd0e668b1dfb152d57c2d5772102000000062c0c2c54befd5729bc84b5bdfe368bdfb7498c63076ced34d38dbe74bba5d8140000000848c3efc723b293f5d2efe2e7e90f89fb9c4bd819b8e9214a8e4b620b1918e54bb21fd67fb68e2c4b68eb145058d1c9b338c8ff7a4947afe1959685591e167e3	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2832	2928	iexplore.exe	29
PID 2928 wrote to memory of 2832	2928	iexplore.exe	29
PID 2928 wrote to memory of 2832	2928	iexplore.exe	29
PID 2928 wrote to memory of 2832	2928	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IntegratedOffer-Pickle.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dbb075734f5f98c6ac24f0778312b22

SHA1
e3070fe4babd06254e006b9ee285c25752baa6fc

SHA256
2842775a1bde9b92ed0da97701816593ed113e5248dbc697a44e289579f387fb

SHA512
8900657edf36fac1e80acbf8e74b2673895ad024eadf09ac382d2346453ff5b92350e1b206576a8710a189225d9f1e2440de169c084f8d70efd8ce4a6c488bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd4da5ca3513302397efe0592ddd61d6

SHA1
5c7e258ce3e7d723267b605fa76f6fb7fb05f53d

SHA256
0a3854d57935b07e31a079456dd123152763107efaf9039518829b9c52e97651

SHA512
9bd02d2488d8697aa6d5482f0a9b25dc0aafc2b6aed94202ddeab98fb5f5eb98168d54f50cbd07640bbd3989d56cd78d2a51d9cd46bdf97289c8046f36377844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a22f2289a03fa03de0875885ef76a6f9

SHA1
7bbc38783b101087f5518a74d1d59d4a9b8b7f9b

SHA256
7039be03adc596d0dc3a5ad1a42418b565f5358bedb3d035005674b42ebdcae3

SHA512
ae11349b8676a1bb6af827954f06584b1b3f6be9618a4c3eb57af024bfa3edb0620974e7d54e2689e4cd1b24cf0f7364261554b931fe52a83709f39c3ea437e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c586f21d433d4484f41f62a1ee76dabc

SHA1
d8841c1099f25952a6524f27bea40d2a9b2a4cf6

SHA256
38dced47731b8a4214dd484347cb12907aa7093dbf441bed78759972c59d69c7

SHA512
3e983f2bc21a14ee7cdfe5459a3b93f540176d8c23def402d067b04da6e22d3f78f464925f58ad7da2114b15df145fe7b86eb4560927032b0ba72d0a96aa0429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9709f88349f98e5c90d2bf019a4b909e

SHA1
3df5a000bb64a3fe4b16292637922def1a81f7ac

SHA256
e52e8633e4057275a7bd3bf5fa1f38c687fdf327c55aa9f98e5f3e71e6a54fd4

SHA512
361baad118df81eb477ab3cbad5fa45dc4da680ca637593e508f08fc2b95aea46d0d869d750fbc9592a687a00499ccbf8a40ed1cab144807d095e8795bcf00e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7daa20563aaa39ec6a90b09f92bfac94

SHA1
7e5e17b0922f57f4af21ec22e9b6cff0d99df6d8

SHA256
a1394a6fc46f8355f4ef2cc8086e17c75b1cf67e0bb58c2b3081893448cb46a6

SHA512
48368da6149ab328ee3fda6b903f5ad1e3383c195b49fa8f9162ea09f6989b50f0de254f9a793382fce6c548be6874e4e900e517af97dc6056ebe9193d15e02f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82d2892028e38d4be95ed36446ed52fb

SHA1
1dbc02114cbe6d46105a93f5d2d4b15f73c9fcb0

SHA256
fd2943b01c1c05beea909ca433f48dc769f96b2ded115a1c27fac6e56e905b07

SHA512
337a07a595092d5bc39d8e1865c0511c2be73aaf2666e13e8848a4b6e4b222ce48e798ea2ca529a9b2a7b1cc8e1c7eb641ede4e68768dce68541f0f2e7f53eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7956816af3ed820da33040b626b89215

SHA1
412f46128578aedc32d8714d9f17042d298ffb06

SHA256
ea49741fe0d675a1e2fe9ed0df894586451b996a42b9e068bedd08002b43b74a

SHA512
9fe461c3cf403bd4d1f757a3f4e30e846ecbf32c8d2452d7f0d1b44ffd6e7885a608a17b4da4ff2f2c16c92c1ccc142fc5a1bfd02b0139b05b55a313cb970957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce697b0d1c346d607bad199c48706d9

SHA1
caed94afc9b9413df875aae6d727999e2cd81f92

SHA256
b2c9e4377be7b11bcd9e710c394ad389ebd90ab55739da2be19bbfb31b7a1897

SHA512
e04023695f019d85f19ddfa946313b8990da6ca5391ffa65be09c838b29c961c60e264fcfa1ce82021964a707312c92ea0520486f7db7aa08a4bf58b80f46b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62410270b7975099cc1f7c5f0870b0b2

SHA1
9eeadfabe0171e8467adb32a4438f285bb78cd87

SHA256
c5c015313cb05ca29efeebce0e68ab6194e6d4f53397caec36188f9ac581ed2a

SHA512
5e73299e7ddb81139e949014809271df9fe4f71d13a2daf84fbfcae9cb602dcb217c09373cab310e9921e4a73bbd1ceddb7a15fc378b7c495ad6bc887a1dc3b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
675de879ab16c91260aafbda8130c762

SHA1
934f41a967715c8de5c78d3ba0008db059e8aed6

SHA256
cfd62d09c41dd14c05549a0cf37e464c495271a09313ec0bc93cf7aa9554e5be

SHA512
2aa0a79fb151ee553541d0f0192a420c49e9e1e1c0da976176652298e205db7ccd184782df0991cc0451c821e78912ac81b3f370027e3fa9d108d9664fb40095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24397c348d549d8b74d3b96647299815

SHA1
39fe10b6d66cdb71118d9b1e43816e46e49076f9

SHA256
d5faf7c9a0d3c9ebead0ee9629b8087d7f559ab01125f2f786bda305016cd082

SHA512
65f169cf078865ee518bd1df4c3181cb16395ad4073359d16573cc9e58bc053510beba4f19cba8ec446e78a3c09fef75e592d25c72334f0065ed16242b98d48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a0a763b427002af51930b215f9e22ba

SHA1
aca9c5ad82924b5e0632046b2494d303b1e10943

SHA256
d56cda7210d153980772a574ea1be6f2c9c824dcf232641425aeb48310d5fd35

SHA512
9042a6a17dfcd47a238e0b9d1b123e09b670e680aaa6f1fd9a3050ca596a626d0b42700f55de33e826537fd77f3af422903e826dc5266c90c6b44816044f8f34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bb967b41f91f19594157c1462b8e288

SHA1
162896a2b68e9805430c1d589bb370f1f5dfb873

SHA256
3b8f9f616a48f1c40ccaef6283530fe7157fba896e65ae7c0b3041b613c6492b

SHA512
2a72e6e1cecc14d41e71911e98e1381b7a316174093ecdad421a5cec23db7fa04a6e8f13a3a3801ba48226650bba1d6cdc03e37ecd17fec3bcb71caa3705cb3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
885dce34aac14f66378024a711137b59

SHA1
77026cb993d4cba0d1db3ffc904ec0f749d4ab84

SHA256
f057a55b4691ed736c982178b617e346d36acf958d585315c21d8445fb9b22e3

SHA512
5316df69ae4c6dc647f93e1b7201fbfe644855b20df76674a409037b09cea860575b621e50bfa94cb5754aa619342fc8d08c9674f0df060bed550b224f1f38fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b348e6e1954c94642d6dff9d442f025

SHA1
551a380313f5b6a0e87bacba5a71d2b64869eafc

SHA256
71ff2b4ff8778a2089b38e3a6b9b45922a43739c7e4f60ff6cfbdfe0b51253bd

SHA512
ff329c21cb3826242fe9cd11699f69f06a01d448fb5e7f75973c8e3752756cfad97aac2b33d9bbe5a8dbd659bef382d2689d119dd6dec3c7cdea57da41b9308b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4500699ea4651ff9077a99a5c7b93519

SHA1
81d1c4d1e73f233c7938754adf25f7739c0f8089

SHA256
3c9782d2826729c3065d040131838f31e7d37bc79bce0626b7765d8884c6e4e6

SHA512
519f27850a7179e43efd03d52aa03f2a82302afcbbec350fb6bffd1245e230f67c9f42f8bef56bf266a28e95c012b0b99959b16963b024f353b4aec5352aadce

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD7A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit