ac904e871af728501d02ebd7a1778335bfc4d3da45c03bf6e68a4079a4e24c31

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c1cb17e0c61d715bd36781668b86417.html
Size

2KB
MD5

5c1cb17e0c61d715bd36781668b86417
SHA1

5808a9aca8a20299dc642791fa3639169024684c
SHA256

ac904e871af728501d02ebd7a1778335bfc4d3da45c03bf6e68a4079a4e24c31
SHA512

73545a1ffcf406485e79d315f0d5d3bb6a1e260cd10bb303aff8b5872422a0e4739997a31a7b7155f7a31a60192c36cf0aa2bdfd2c1eb637bf6cc5a2d5fce100

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8B1AD11-A161-11EE-88A2-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409477106"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b06105563fabd8014a15c16679aaa7f5689674e34b3bc8c5d682c6c1c162a893000000000e800000000200002000000078ffbe1266216388f189306a3a7dba3d8093dd87d40968c9e36d730a04d6c34020000000ec48b1335fbce4801ec7f64bcaee52ba24e9b0529a4b7b17c4245462ecaec4c7400000002a26570ec9af200ebe1ace9395bc76bc662ada16c3ce831af5bc115851f71c9e46c8aa75170706124bc8a97e80354116f5bf1f88ff7641a8ed428183c7b1dcea	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000020afa3d80c91f2d87d75d125fa71d61fad9c977b1a3af3eeb6dda6683f25fa12000000000e8000000002000020000000fcad781c792b117e85352ffe7596573ce8c03c9480ecb98de80f9b234d60790090000000f77dbfe1c45d99d2f6e9f65ddcb7ff775285517083e802a864b88e5d1f56c7b03dc8d890aba42b79e8b7456ddab4441d32dffc63a61ad399ee6206f3cb067225dcd2945fd16a426983b7c2fd31ffbcec89320846d77466ea4484cf79038f17cce235530dc012d11c0a043edd3b1dd397323b9e57569dfb448e612f1ec79e9d3af32b5d4676040695459fcdb22a281a4a400000002a13ca530457c2a63e4e7cc0240d3a88225dbae41733baa2d5e722cb9782c7ebc467b169020a7fc6ff6db47b4d0385a3179414cf4b176f00611098bb183f0390	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a310bd6e35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2888	3012	iexplore.exe	23
PID 3012 wrote to memory of 2888	3012	iexplore.exe	23
PID 3012 wrote to memory of 2888	3012	iexplore.exe	23
PID 3012 wrote to memory of 2888	3012	iexplore.exe	23

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c1cb17e0c61d715bd36781668b86417.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85a33a2a1f7a4a0105f61cca2c63ba70

SHA1
6f8b47a9e6d7a5b1c76319a398ec5d40a768fcff

SHA256
6b811f0669142ec40f7119cf52fd38fc4cdd006f9d53da61a64a8d71a3073f8f

SHA512
c912e002e11f4473fb8df67725fae975d6db97b4c3ac887b13a8f2fa5f5fac9d4741a2e3b164b652411d0a7412eb36493fb61526f2bb5abf0ce8db7275e994b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a5d385f7216f3d3f2b0af361b80a944

SHA1
a302e5fa2ab7911b599be5271faab0f671b7bb86

SHA256
26fcbee1bfddb6ab95df396ed420218d202dcb269e62f051332b712e7a49c9c5

SHA512
2c5be088d2f310b98db5de3ec224441c03861ba3d52be76d7559dcb89d15280c1e7fbfd3dcf6f5e00920427d308b79bd0718956f98a577097e5efe05bc9f2898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cde056b20940359e91d110649bc28b06

SHA1
beab0e9e7167963152076404803a387a5cfc1009

SHA256
2dda22c78121ac14fe33ab68366ca46bbe1ec5e3db2ea6da40e5ab425cdaec0e

SHA512
55fda300ed7aead61605a60c0b6da57fb79c6fc5298136cfd4d476dbb01c8b37dcea9dd29fc9e5a45dfed7c8bd3205837fb8fbb27a5dc3ae74be77969261d7dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75914d5a79e8e692479082bd5a8fa210

SHA1
344d67ff4e082e7b6e9b942c595756645fff9296

SHA256
379645351d737d7078856d074db0f796638ffc06f11cb46e6efadfd556f62fdd

SHA512
7851986d3ec2a222328d17be5e047a520d0eba0c08b5a8b2843e154cd4e51777c5421de329ee7c58e0349df82f5749ea537b3688dae7dfccce9ce31a70dbe416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d1994557abef8ba5b7ea71080352d8e

SHA1
0b5565de290ccc9f469756f8939654cf5e1b58e2

SHA256
042d836bff2641e19af77919f591a8e37cbdd3b8e35fc38702c0849527274f4a

SHA512
126fbe84184552329d75b744f236083963eed50463531b850e955df1edd3179dcd2647ff948aeb9e860f4b00c02285d33cb6748cc76f10305636306b6339b245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a99cde335ed8144348c6cda5b125c875

SHA1
a689297b8fedc81fc711ceecd9c01767eaaad238

SHA256
6ec492e568fc65037221ad65299ebbbfd399e318be60344a2723b90668ed622e

SHA512
5f3b4affe7d7a41350514c43175a628dd4f6fff62fb1a81c89f93af17d12db1a0bf043978695d1141bcdae76fab94fb5efdd50e0d1dd9ab20aea1b37f783dbf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be48bed92d8c62f1a3d6405031a633d8

SHA1
e16d4ef5f73b59034c2ab1b685408fdc56d5e687

SHA256
9723764843b7fceed7cb61dfdb2fb2c02535dad1a847575d6732f2ded7306169

SHA512
54c0af24c695cd707611aa271f24b33db34727182dabe266690aa3308d8e796c1a86eb4396f679c5c5e84ab797c39acff8e0d45c50c0817394f634ea05186481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e37a0c642727b148db379a51e38f3119

SHA1
1cfac5cb5a7440fa28a4d10d1229374e25052de9

SHA256
9523969ce9b27c26f423016956e9e2676b1d81c65f946537906bbcdb42b4e202

SHA512
da7329662c4ced5d5ebd449c1f29c248cf12ea65b2c00ce13acc70ee86a7e4123ec3c2a53516e4b175fd3d716f6b3883e374047195c335b69dbd945ed0e5e944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a5de27ad3ab93561bd1d6ea91e26f70

SHA1
9ee8b57cd0023c993adecc2eaeedf1f93c7960c1

SHA256
4c781746cf0f5f99a8ee18ed3f5a018f6756a6a8a0293d29f19550b169ab6be0

SHA512
0d22101f8322ab3459a0f9fd0d482fb95ff94b84bb48c1de534eb12d5a88293370a50c98ccd8f5d64037992c37c6c5a8b7f78bd929432058c63868c5d1679a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acb0ccf0bebec8d2b2e611c77d3e3148

SHA1
46ab31ebf3cd77f26d05b09ead0de265be2cba95

SHA256
28f4368deb3576d83b2b5dde42bdd7aa89cad483360957ea135d3786f8346c0a

SHA512
28d13747ac6703f6e1c09694e98cec8deef8678d5806d9313136b6102c5e35012e495b27609c231509e31dee13d39ca48b0cd46f8195df9a4f70a206d9747942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27584e39939df10287ff3926026349f5

SHA1
8b794b6d4d2501109861d0e05d4727374c148ed3

SHA256
00634e8bce98989bab621cfdffffd17d073973c9320680f06a3b7dd85a45b15f

SHA512
8fe167f5e954a2056202bd5c44bf4a96aa3660704cb08d0c2f5100ce151ed955b513687cc5f6613e7a829d781a6ba6a406d354a44815b40b900cd0f12e5188ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6942cd13960607365ea340cefb0f72f7

SHA1
492a613bc8d063b6f4619b0a9e1ca653933c869d

SHA256
0cdd84f48fda1e5de64d690e380c51a5679f19d3a062e001e5f8d2b9b9a7bb68

SHA512
668372951c26b0d9744c96329c2659a0e0f0048a3cc0563e84f2bdd92a5bafa7412c10ec6606a014c9c25844499d09a0013b694e2a6a5930b7f83361a1e49040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb2967081d9f1c8268d40efa5f4976b0

SHA1
c7ef5a92477fa4811514ba52e9bf055a3b3418b9

SHA256
ce687c094ae7a31650ab413726b0f217b2f755b6f5f507baac5980dce406942b

SHA512
7283c2384bbbba54d397fbd74eb3233af54f4fb014bfee35af4aa1599c26aae64ccde5c6477d65a0a7fdea07ae270528ebb898887572c495286a52878f0ddb35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21B7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21C9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit