cd976a3749ff473b9ff6bdec30572e65edbb9abac7daaf731a3b538d75c0a8cd

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc3c83fe9c7803daef5f97f0e1da079e.html
Size

2KB
MD5

cc3c83fe9c7803daef5f97f0e1da079e
SHA1

6aacf70cacf2a71ce460f7933cd1a7caeea74ee3
SHA256

cd976a3749ff473b9ff6bdec30572e65edbb9abac7daaf731a3b538d75c0a8cd
SHA512

ca7c89c2b88d5b014c1c8a13797936c0451cb582a3c686dc38070df8fdbfdddb0b293d7c1f6e1ec1db836c8b1314f1cb24544ae3e8dcdb2a6f0b2acdbbad6763

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0dee9530735da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000076d793509a4d246e8af7d42fd69b2d6fe7a6813b5194fa4098288eca9120b699000000000e80000000020000200000000103284319d57b12b60baf499589c32930a89f63694a89090181db43bff59f49900000000bcb02848409f6f2ef6a00ae2d7ab139c3cee2816b1c9c7639d404314ceffaf42f78494ced98e8f81fbc7101ca9d75750d032abc0ac143669a131d0b0fefd35bb68d79ea4f68610030fcd65bbb80586d0171cdcbe889907539ce77e9c578fdcf4fa74134c38db79bcc50ccd1b035093bcefc4e8081844d8ed4c4ab08585c67094ea21fe825dfeb93836c0c6c3f12e5f940000000aae6df22c205fef8ced0dd870842bae7adf22e545326bae585ea0c00be1985418bf7551610d5b55a3b5cd7b7b8d666858cf023429f78da0747af782c5683b2af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E9B86B1-A0FA-11EE-8C17-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007c3980641f802f4599efe92c7035841430d59de9970a6062b63679afb1465fda000000000e80000000020000200000009dcc270f6b49e03fd259632329a7ba2cb891c917fbfbfe5f2919fbc4baa700ea200000001537063689cee6bf91b03857d47efb02d6af096be50850ba453aa708e378535e400000006f1314a7388de5303aa27858a8091c6e1c5703f8ad9e546c8654f45ae80ce48a86e9b865a4954f1529b9c82ddba778df0686f6a706a434362696a8e8e81a95b3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409432693"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
760	iexplore.exe
760	iexplore.exe
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1956	760	iexplore.exe	28
PID 760 wrote to memory of 1956	760	iexplore.exe	28
PID 760 wrote to memory of 1956	760	iexplore.exe	28
PID 760 wrote to memory of 1956	760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cc3c83fe9c7803daef5f97f0e1da079e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41cb083210f3482be26ee6dd238bebb7

SHA1
8922ee95007fed9b4df861df085c2857e9663271

SHA256
d0a875ae37f2d070794ddc1541ef437d1d544563f90674f94d6fce629fde1f7d

SHA512
260c96a996bcd2058c8e639350b4859517774067ea8044632e998cc3d51e5fe51034cce95d9bd986f5a927d9b67bd1c7c2250163be543beed729dad81173d785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f34d526daa27de42d9c66dab163d085

SHA1
830c4f6c3df15d0d9ee23a65e3cef8328ae9ffd4

SHA256
5703cec6f95478169d6540bab6173ceb56c76aaa133c2c7a497e476f7f3923aa

SHA512
b6bcea350a8e7f6182ddd4560d654c28cc10fdfa5536ce3623a6d760767e2fad92f94d5e66f357803290f7d502412889eb6b87e1fc8cd0c09a0e7ebac3bb24e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fc61f52db0addf5175dc29f65f3265c

SHA1
36119b208654e4d0766fedffc8bfca492c8493de

SHA256
3023b63f2f0ca840eda508e1ffc3b339b40ac7bed5718c2004ac0ac8957ea7da

SHA512
7e6ce658d15d8e2986722429d2590680616dc37043d030e33cb4e69d063fbab063490e6b71dbb36d33dd891194a9e0364b82e17bcdb2713b4c4db729df8e9859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cdc6c00533f2f8d3079f33e547e82bf

SHA1
1b406d02daa8659de77a5427d46a0dfd0fdd8a27

SHA256
7c2ae89fde5f2600006e642f7d8f08dfc02d307046e7d115da3cf6e26fccc843

SHA512
0b049a52af8e1d59dd2c9521ad6728ad57dbb25e0a3c4b372823db438e5346ab32ea6b3d339070876317ba2047e0b644214ce9b621725152d63e550aaeeb00b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e584e4f488f4a7d12977e12a700283d7

SHA1
534523cdaca3306fe7c5637efed65370516afaab

SHA256
48d4500f50ac06c2846f0fde089dd3bfd0dbd790ffe0d25b4f9988c834eb75e4

SHA512
54df42f1323aafe2868c2348462e1ae18afe02afc177a506578ce481537d317f16d24593dd38f3669182fe9a3b8b00830e8456a01596ef9083a9c9195b04e15c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5399c86da2b9018e6d449feec2dabd2b

SHA1
1aff78d245a3ce029d76241115a8789e2b14ee84

SHA256
d228a5645e07c934c1b40e2e274a26bb48fe7471142c615b498523b4527035ad

SHA512
a4e42da52562bf21d65592bdda4d23c02df7b2244d8e0559815fcb0601de1e54b62757272dd6db7a59b54ef033e987f127cdcfe842c74e0eaa296cc9b4177a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59bb9ece050ee5aca935316b614d7af2

SHA1
80b8b9d274c1f258a4df2f3ae63fa502a1bc0b52

SHA256
641387c857a1c7cbb1ac8ce718495467113c1ae78fb991bec0a9ba996bc3d0e1

SHA512
27b0f48778b1e10b7c55d3a8d73beb76103a3060bb35d2ffd181a4a07a708a9eef55344f4302e88418c1d6275d8b977f520402f3e3be9ae5902d43135c0686e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba243b3e2a0faf645d9bdb4de8edd3c

SHA1
913c2fca8edd3683909afa60e4dcef862fbd082a

SHA256
7a37c2c602c90b5fee7479cfe6f9f2e0e35bbfaee6e37afa9ea874031b2757b3

SHA512
730f4d0b7f54411fb7ed3d14fc32355fe89c6e6bfa0bd1c5dec66a8e1aa32ead99abfaba5547041f30f1e46902ca015c9aaa75adb9fc162e8ec7e5fb69932704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a37f6aded37398f22a8ea4452e359c2

SHA1
01817614bc6267355e47495a651e75c48a67d6e1

SHA256
96d40f76884f2f4c34d6cabeea4482f8eda3fd852cce0d804a0a407e03ea7635

SHA512
d39f3b352b6c9ed6cfc5068b7a73a56965784ab308e5f89c8df33590636e6e78be9923988264a0cabdfaefc47c08a45cb388263c0b1983de0b3b8db8740f0e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
045553c26b82ffc3f8a67104bf493221

SHA1
4a06f20215dfac0bcfb02871243b6aa90373c0f4

SHA256
1cc3d395fefb9900d23b39375ccbb4c5c941174ece588a3295302241c7a15a36

SHA512
44b1bd4faa5ae205bab5bc95f422e63316fa8a8c0e8604fb3115c914c1e43cf023d8a5bdfa34a52d740f879fd77d6c240da988ae33385acf0568a114e214e8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ffd03cab5bb26788f8535a3a8146631

SHA1
63ad0dc03f67a0ed7fe39732c71b5852da5b4f17

SHA256
d175ce126073e676efffda9d6b8a8ccf5597fd82bbcd6f2c87a52797c87c589a

SHA512
3569a3bb46abe72409d68a2b11e195615aa595d438c6a5c124de747d309be5b7c49219db6bb2415d0db6423604184d5ab0b5b0428e6b84712082b7bb9bd96f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82baaf39001f571a3c6054ce2d9a9259

SHA1
0965787a9c124b69ee376966cc754dc2a5a590eb

SHA256
db384ba078572ca1b54e65e8cb75c26b73087d428e1a0fd5777ae3b18379f9a1

SHA512
1a6d16bca6c1221bc4051efeda82fdbd7d1eaa214da0b954617bb43d57979cada272a86537737c330366493bd83e3c493b3c771649643d4be35c8bd3e6e5dcc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83fe00191207c79935c10cf8b7d2db95

SHA1
5118ce14c922f090c6c748252438a7679b25b53d

SHA256
be22d9c2a360d39bbd1937ba8b18d70620981e1d2c3f71aff510a4c3c2a30ac3

SHA512
c3dc8a9d3e70c23b68532ecdfcbf8b972cc4f3cac61e2d575014fd0070e693ec6e6228d79a13dc68668a73ec494bc28e524379b2d6a0032c67bf0d9471eff4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcc808ff5d5bd64fb11415bb14494198

SHA1
5c1e71565fb2ccface48b085636a5cf8762c61bc

SHA256
d1130a3e2b9ec8aecfc4a4273d74861782bd94bac05bb55249ffd9523dc13158

SHA512
6ae9ff4f0af2a12e69978a7ebefc64cd831d1208846d0064a7d23657e3bff8ceccbfaaa39b9c7f65516e5a79ce0e50bb233f5b0635239133a4c7f9ad9eba8a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9254.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9513.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit