5627b71aaf29484b36060108bc61fd77e8ba3978ae50674fd998b64ff0eab6e7

Analysis

max time kernel
118s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4e331f81c3ffe858f30b7ae0daabfa1.html
Size

70KB
MD5

c4e331f81c3ffe858f30b7ae0daabfa1
SHA1

a658c9a160e34a5fb73166e7f4bec4a29b83b4bd
SHA256

5627b71aaf29484b36060108bc61fd77e8ba3978ae50674fd998b64ff0eab6e7
SHA512

46b466f0a620ed215ad4e663c52f961545219cfc56e7fef979b0ec81b8e6af6d60e324aa56085ea75a92ec224f5233a6d84ade35aa9563afa9564cb30465d0dd
SSDEEP

1536:GIRIOITIwIgIVKZgNDfIwIGI5I6J7SXIRIOITIwIgIMKZgNDfIwIGI5IVJ7SOs1M:i1OpAnZIRI3hBAX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409538562"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000fd7cd9deb7a78a32d05847dd04fb41c1fb004c9243083d4a35177edc73d240bd000000000e8000000002000020000000223f423ee0f4bf02f0e778efede20b9579b4b727f787df0754af1f667c1d5c08200000003c5e3c41b6a7807fe74d05a3e0787f8cfc2d619150213b0b1d778d118bcd9f7440000000140bf0d0d4997444449a691f36ff1e708333f00bbd56f6c3ebd9b1625e59a0b2efbc733e54865f56ed23eb1973df97d1d0516e7554bfe0f08f039d2e27e2112e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F19F9331-A1F0-11EE-AB16-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202357c9fd35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000001757c2fd112753380b6b55da734a320db4bef6606209cb92b401adae4e77fb8c000000000e80000000020000200000008cc6a8625b79e01518c6cd8f3f9ed836b7defb523f1dda5c351fad0b96456439900000002ab11afc29266cdbfadedddb2edd054e8ee8bcd52f1f3ed09d4b5b6d65634148d8ab12534486d6d26545d302e84398ea5689d968ce6698232a919181c15c5b2acb8e366f63c3ed0786474771806ed2c4f36a57d9912653bb922bff748e710a88d370d662372fa695234d9bc19678ea2282b99db6b0ea0594b67eb0becc490c1ecd6621d4c2ca3be8c7c9e701c359124d40000000da3f662c3c66186c895eef4fb2e3cc4b53ac4a83c814e00f84b97dc3b02e15235d2d82e24597c91fa9bae9deb459f735f74c074a3a0ba5b15a61ba27150e537e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2340	2652	iexplore.exe	28
PID 2652 wrote to memory of 2340	2652	iexplore.exe	28
PID 2652 wrote to memory of 2340	2652	iexplore.exe	28
PID 2652 wrote to memory of 2340	2652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4e331f81c3ffe858f30b7ae0daabfa1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b06aac42de32bcca9418fbe4526c7a

SHA1
e22b4ae723d5f33cd56fcee4c8854f3245e67b5c

SHA256
43ab010b4603b79cb825c1782a16ae694944c0b04930757a3e665e36f7fe00f4

SHA512
be6d036444e653fc04ebf6f34515fa9179cab5fd06e1251ca570efc46167e8661b765d3648502cff6871e0208f6f1d7bd3d5965d58130191bd7543850a7a1291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
079b63593abd4742aaba912cb6995efa

SHA1
2c0fc9b85b677c1af892cfc426bee02c6b3e9640

SHA256
79a7a81b8a1cd4767fcd662e57574d00d737e82010fda0c759ecc76cec00cde2

SHA512
1d5964979da82d5d463303e69d8a06f6347764870690d4354cca260df52b0bd2467783e56b49a6c1745b199dd6d838df8f86c23a5ceeb2ae1a43ace254aeb57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4feca313f97699628c51916e77bc0ac

SHA1
cba75c44f0f07d3a6a4f69e9dd8791c6dafccd6b

SHA256
2956e4519372a1ce7a91c55ef884e0b614ec338fbe273e688296dea7cefa9865

SHA512
6ea7dcee95cdc3ef07ab92129c917c7b4b0604830ad5031163374dec55c65f6434970b865dbd17945ff1a0502983a634c45d92b435b44b8ea75a315671d29bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e912103e83d10b395a37e56e29927997

SHA1
74c751c34a35ae28722c613326976b0e1330a5ef

SHA256
09f82be53b9c721f57433b9d97d8f18d3ff9110556d22e6a534d4c99d27a5854

SHA512
4e27216eab7ea5405ed6066b2dc44a62dedd043eefbd184dcb861b2ba90abe0d9efaccd88eb199aa17f09c3deb6c7e09a26ca54fe458179420a338025e03a33e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb343023061bb871158d8b07be91dd9

SHA1
c158871d05bd4bc49f8154fcd77be55a8f735efb

SHA256
6d436e9e6e5474e97b6997c775bab8ed1890e3e8e2bdf434769bc6889a10bc6b

SHA512
0a5665485a1ef2a6c2f69065fe534853fa3d82f5218b2114662a55ee621b25e3585ea06b3485e33706c716e60adbbe8bdbe4e8ee4a67f9a1182b36e52a9532d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd54ce8b3bc1c732766c4931b1384390

SHA1
e39dab37f82c5e0d2e66ca105527596eced25511

SHA256
7b706cc6cc0611e87ce341c4b6e064ed8b0d52d259716f56642372d6d9537ad2

SHA512
d02db1acfeaa610cb0e435deee994ae49e8f5933e90922f3166f8b529988bb17d7de2f35cfe914ceab9fc3be9ca5a4e0a4014ff3a0108c5b67ad47bf746af431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce92d9a2c228f46b71815dce393644b2

SHA1
01812f170c0b73eaa01cc788f9b1938cce985363

SHA256
9e5e7db56b4dc4c6bb5e71eb0475c7710c17027b77157fdbb747ced04b4a6600

SHA512
b0696a293a20cc749b3e0a35f65a6f2d95a9cf92b5661cbe01bcc744f95163e253a65cf7b4288ddbc68b49eb921ecf48df978b60d25c0cb5c39a7a4e2dd3a082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ceb4978a3129714f665177cb1d0a78d

SHA1
9834ddd4a999b89d82a9afd3fc7ccdf928164487

SHA256
459a4554623b12ee9d80e61d750edf9187753a709a1f48f28ca6168e39aae586

SHA512
f1125bbf058f872504ce0a02335affee624bfbc694d90e578ff657e02f5212a3d3ab787bdaab05f718a96e2d984ff99b92e183455533bc9d4e6f841b4e78eaff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83fce5ebd6d6e26d8aa35612ce6dc449

SHA1
9f34a51f72da0b5f15f12b56a25bd98577157de2

SHA256
a1bfa6b1797797efa710aa672e7a9a5c2bd5f4b87c49a68588561ba59b3137e4

SHA512
5f846d62d197e41360b2aa0c3d3c68e013862ac0378794f46774d784ddc7a2717145b45aa1142209afd186c265bcc1d2d0f19e26e7674ff793fe0067ec281f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab74C3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar79A8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit