a69a2155df2720b6b8025e14cc3ef3ca2773bc0a5c7886b8589ad9f2d22f72f3

Analysis

max time kernel
137s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdc4e4d9d7a876c732b50d7e192c82cf.html
Size

601B
MD5

cdc4e4d9d7a876c732b50d7e192c82cf
SHA1

cd6f7ccfe2463bcc2defebaea50887ee0d412b82
SHA256

a69a2155df2720b6b8025e14cc3ef3ca2773bc0a5c7886b8589ad9f2d22f72f3
SHA512

e36adc472d5bf51eee529dfe9d51943c38cde890109f10a1d0c3f3bbff31ec44746af992d96d3be8f8d68570ee402b4de0931dcbe479804b5f5c7d2b83d94d89

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000055ec6a029579befb5c287b7bc01114ede70308e11376455fd01b97769d6ad9d3000000000e8000000002000020000000a6687305f3b55472734afccd25c8a9c4649ad5cb8cf35c68493e92b32be4d12790000000ed222562f82c02c34aaf87ff29081c1c47ff3ca21b0ac80013355c07c640ee34dfb33f6241f85c24d92be53122a4676bc2489eb238c386fe97db2a525fa7bea31730d591e7c1df593358fc229686378d2129acccd505043dd9859a338d4301ab4ec6e97cf9d19005af480440bc09a672a2845dc6df3ff47f173acf0f5aaa53f264a9a91d51bad5336d1d5ebcbb02f5f0400000003859c54d7226361e8c8683a1a0e8c01aec36b3dab435d7c25d9cad9925c6845fb5000c9f7c364602158093ec8d85750517d379f86cd4d9e74963e3b090636d44	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE7DA621-A1FD-11EE-84F1-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409544013"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b6db740a36da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000556db5ae24f7bb9817a61566ed928bfdcd5b5261ff782ee532d38a464956cbd1000000000e80000000020000200000006715d242682612f2c1cbfa28afa3d9904d68e8375e3ea943e680ddc05854a32a2000000007910378d734825bdaa924fb2775dde7de7caa228bbf4e26a410ddae0d1c4a5440000000ab9acda9bc816bdf7792bdaeced06ec38c3c3173d2510112a545f58f8f4a593f062fdc3dc8ae784b62fe59c42b95739f86ee54cdbdf052cd79fd44e08f85b60e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2700	3028	iexplore.exe	28
PID 3028 wrote to memory of 2700	3028	iexplore.exe	28
PID 3028 wrote to memory of 2700	3028	iexplore.exe	28
PID 3028 wrote to memory of 2700	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cdc4e4d9d7a876c732b50d7e192c82cf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8b1eaf107f402a9e8efdfb20b8c9230

SHA1
d0514dd9cd8a87767f41ecf05c9fe5638dc4b9c2

SHA256
d95a56e029c51d884b11d3392bcb57c09ef98f71ff9d0ed9547a95a1545bba25

SHA512
6f0b0f5608af9a243eb15dcff3d94bc81cca45e3aeabdb7ff076c6da5b7bc2a5f5273c5c09feec78e2bad62e0b29b8c577cfb5760203a6b7ab1afcea0cd89b2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a121ad77dff03d355eddf1702c445805

SHA1
89fc30b291255542319be9b19455687a2b3aeefd

SHA256
d85366e5a707d32ffc8d6e57867fb8beb7a3be928c6f451de00577d3359c05cc

SHA512
fa2628e93dbf41c3bd03329fb18cd58e2379b718f0db286308e9aef85ce3db1bf0aa72949d0eb82c8faa16a49f61e11450e9a5f3f117a5c3b53ecfe0a5d1be90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83c143c6ab1551df5f450a4d045c331a

SHA1
c1f234e58d9434f707f669ee5dc13e89c36b9c56

SHA256
45c83724757017c6b707af6c48eac4eee2c20bf693baa853fa443d2089f350c9

SHA512
ec387680d1a502c00682d11c3dc50faf7face2223c90065de72976e051b014e02eb03c9071b783eab8084c6e97dde8409c1fa69dbf411724043112bb6337e7b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2276f1fa97f7d3b92dc155ef84167a8f

SHA1
1993a0a6668d37f1ee16d48e13bd896797cbca37

SHA256
9a9be8523e0f9c89bc2fb84e423e6cf5a7c681a6176c2de984e5e87e5381ab0c

SHA512
1e2052833e98b44cd6261626b160cfc856c8a4e72f5db6b668eaa9a0daa7c677456ef823e93592d1c7fb8f59b735de81ebb09e3559e1f142d1ac894ba0415dd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd180c54043cd516d611dbf3405e1789

SHA1
f8971701518e17a58ccd89ed7585b441f0da01bc

SHA256
e1d986ba6554663b0ef3c793f606af184f22f8efad2d1393cfbf10815d52e188

SHA512
a58f29800bba2590634905102ffb7614b1080cdef43d05d9cf3a247928ae930baf02ebd08c83f3c911a843cc95ffe441783195d4f8b4da88be96a36f8e736a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
219a24221f1fc7c678d6c1886a079fe8

SHA1
b84506d1977cb89b08ee7b10cfcaf5a3f18048c9

SHA256
8c4f31fd49f62940fe2f21db9ffe9f9ec61b9ba3d41502707c50a82559b8b95c

SHA512
75778000d96c0660612e2a8fa28f16df408fe372408d05944529700280dea6ec05257de81d5a0d7980e3cb51e1bccaf1ec4a45bc805d7986728f38f40a1e376b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ab608696660dfcd8b455323fe44c335

SHA1
348577f9ef4460f365fcab103bf362b524e9da16

SHA256
619d7a0c22ed80531f3e6b1fcca43982c9eba2972922c3ec97aa27cf32cc6e60

SHA512
c964815a2888600d2a376625140fe1b0ba7a6aa990ebadc03cbfc7025f0626dbcdfa4e5cb1c4c3add3f0fb6401a5c1f07278f2d192a50cbb81a058e248c11a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab5b13629792cee0cc65f4206a4a3e87

SHA1
f9fcd179f2a21625e57dc7aadfe5295765b523c3

SHA256
b7b9d36cc795f6e5ec81900742198bcd4314600a580206a3544564f8d85900b0

SHA512
cd7629968b358b071a77fe9f64e7561af09fa40b7584a2739863b0179608890e63e957ebaaa82b5786e2760e97dc095458b175deaf379352afb348cb4c7fe51c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb1876a64249998d8df728a192d5bf21

SHA1
eb47ea874a4a3ff89a352c019ea32d88bb7e4bc9

SHA256
0baa65fac70bad6dba19cd32108b2b95a1515d8f01125d874431240e58ce7e7a

SHA512
8c9458d006d98761e69ead5e6e3a243e4b61c94dd5634b5c82dc80ba9b3d606545bfe7c7f2510eba762213295908a697e1ada4d65e275299783fb27ac5ef275e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b4a96d6ff43742f5eb0cf91289abf0b

SHA1
f6b1ea587e4918cc0c696c979b787f1fde12e0f9

SHA256
3ed66ef8ef4d62ec7e4cbc8d23912c9470c2a2c31f7eb89173894c60d3497021

SHA512
d59c8eec00cfa31aef1fd4ba152343af3794fcfec04df6d63d926377629ecba3887b0572bd9786a62b9bf76c4fdd1c7885d020522eceb3232e6d853ada624696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
232ca7b1cfe5bcc2e65b096ac7a1fd4b

SHA1
8b96cd0dd40e249f1344e73268e6b3911e388853

SHA256
944ae444f79c9b25d8310b8fc63b5513e272375a128107ce1765f93551884f97

SHA512
9bac8818066792d98ca4dccbb92436c82fcbbaaff34067a8f420054b2ca8c6ea64bdf4b5b14dfa7d3a19024914299a4786a5f83ac0b19d30b2a7936a9bcf02af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
911f881d2a622cde27195fba037e51d2

SHA1
afd868ec93aef2b5522b38a064d0ba15315ecb34

SHA256
bc82cd91340e118dc5f6850f654f91bb6959f36cc204d327073956d9e2aded72

SHA512
721b48c642b7b2e3b68d688c5d57b68c54ebcf6c3bf14bb6277ffdad99416e1bdc68e11e546325a7021d27fa0f52a73d9e2b10a93fad38fc8573d4a18db0a517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8380eb378f8c493eca65974720a0668a

SHA1
0b878e37ea4e0ddc0cf1ad732eadb3b540ae4fc3

SHA256
6ed88d28cfa05d439190c6d0bfce52078e90ab2d309b51065f90d3ccfb6d1f52

SHA512
a208bb4b4d8bf8d073c64322c1b1094648be0e7c74c6f9eb456f31a3cc29e16cae5a6ab042648d6af2f0d9135a2e5ba38087c3765245fbbb92a2647bd3acbd9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c984000cb6ab278560addc2c3d136165

SHA1
5c0da15c9eee2bac0b1866da3ab846a2cd2ea6c7

SHA256
cf42f8721a9117c4fdb8c7fcb2bf0787c93801c36f704fd28e6c44e27230c1c2

SHA512
beb5450284d09ee95b8c85c1b1dcc665e30833ed70e2c4a8f44522eb74d5c2d10f93d19fd94f6ebef1365a391423cc53c4ad779bbdbcf9609245e04b7d82a01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5623297762c10a200a1bdf25a3202c2

SHA1
ba82dda2e236869f958229d0c223b99c0c142c21

SHA256
a4d12de157ff3de68b15b2e4010c53951367366250fbe8d7219cd1a76d9b2293

SHA512
5ecbba39a8ee3f0ebb26f7780509741699892196339db7f7f906c6f10e849e1f8d60a4eee9b1cf9694a380bc8a6f43796b8258ec958e5be2a9f6d5c24a56e929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cae8fb24d19bc62b1a7bb58ec079100

SHA1
01dbb182ae1b0b8d5d7769992404efb13871a42d

SHA256
2fa64b9262040bad60cfe9e90e7e91819eeb74f82bb70701ea96b5e9cd15b4fb

SHA512
8655af0c28c8d79e906b599f6008c62f78c6ad46972dbc18c3356df2297d027660ee0a666fff0d74b5c13f84c9740a84aba1e5553e54d4938b3f2a553dd06887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F1C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F5D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit