304bd5d65852f74e3029074b315aa2ab93b369045610544811148b678871376f

Analysis

max time kernel
0s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc5cbb1dd49da07e34ff1df7bdeb798e.html
Size

601B
MD5

dc5cbb1dd49da07e34ff1df7bdeb798e
SHA1

35c8fe77fdb02874d1ae7f811bdfd655c0d69fec
SHA256

304bd5d65852f74e3029074b315aa2ab93b369045610544811148b678871376f
SHA512

755c54798eae4c1c6fff24efb32bd90aebd4e0fc9682b31e94104bd6a1083adfabe291b58cbe2a0e892dae0f5cf4dff3487700c5fc6a8c4af73ef20ce79a0886

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BA0C601-A107-11EE-AD90-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2520	2216	iexplore.exe	18
PID 2216 wrote to memory of 2520	2216	iexplore.exe	18
PID 2216 wrote to memory of 2520	2216	iexplore.exe	18
PID 2216 wrote to memory of 2520	2216	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc5cbb1dd49da07e34ff1df7bdeb798e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ede7f1b817db8371530a65f51f16ab9

SHA1
fdc565ed3f93171deb95674cd9d08fdfb2b1cfe8

SHA256
72e2146fa831e8df278dd706baf2927137c760293b4614e712f1490182da040c

SHA512
d9302f27f2c1772c199c52b9e786dbc5ece49a367d2ca109ebff622927d96e8dd958631bb7aca8d8f121b8c94ade09333d157755c14e3ce16bde582ebc497a4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7056e1684a41cea54cc61242be3df5d6

SHA1
983248fcd621def3ec78016d1f49821ba5ade4c2

SHA256
aefc5fde8609cd7752f7924f31ce6403b33a6c4dce20808721333ce6b194806f

SHA512
26cfaaaaaf596fd52dc6c161028497b699c92fb6a9fa8bd3eb543e5891b683f634efcd8612b503acd4516870fb1fb09019f4632052bd3564586d6779edf63232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe6a89d11c57fd907a37f3f865c366b8

SHA1
2ed284c764720a2f48e32df5f650c8232022d1d4

SHA256
1067dc5dfcd4beaa6b61bff25ee79a7daf98d1125e46e5baedf5c55a0c8b4044

SHA512
51632eb1351a1c6fa9d14efe1072bbe2878c81c6f4b1ccf2463aaa47190807a98b0558029c2cff6b04c81e0cb3e3cf328b13f3a91b2caac30eda09febae457f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be1e9afd23b2ac7e769561a63a7f8585

SHA1
98429ed7c120258510d41d38c8b29ea032dd6482

SHA256
83b98791c04e36059ec0ea7cd6b1e8c04eb09495aabe387d74a743e5ab63b65a

SHA512
ec9bf4659db5b5f76cd125fc38fd0bd30e994ee7900f175d91b9f43323dc539f855319fb8779472c698d4eb53fc300f9f2aa262bf6a7ea097342f1e631991770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
003aeed5a565db31077f088a2b0c56ad

SHA1
7fc4089fb3f384e34bdebabdd5bd448fe5a56067

SHA256
39aade519aae76fea9ec83942e51f3128dda158c75e51d4c9e32e48ee60c8107

SHA512
ecab6f8dd59427174b19866b85947f4c5530510398d4c9ca2e1bd4bd8abb68c9053fdfcd47d7c4b1d85588d4fdd553d2920cb5892bf8efb7af9cecf77fdac6c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e025d1a92e81fb0c27baed13d8aded0f

SHA1
8a0fcc2b7412d2d91ffe1b1a917da36c4864c322

SHA256
d353b34dc7ed41be7873faa308dda38c8fe28bd2c8ceca12306ffa88f53fba3b

SHA512
c473b42d60462d0a77a8e2e9b959ce87c0e391d038900bd463d950b76f8e12ff906cbf45a560e69c48f0e85f931129f3c828b6aa910df4c0a63391c23821fbd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec04a5e62b7b8ff349a0f5d3cdb7af17

SHA1
e23bb0614a4240bcde790f1611af826e99abf841

SHA256
48cef2a734875005c14661d8ab9ee906d5cfea24fcbb7cdbbe6700c377f2922d

SHA512
70e390bffc2e4e906a3b136ba4c1d9db28b4734e259ecac9ff4c7be0c80f182cbc3a101fd8058bad80629c9da9c235f36129a0a2d4748e77586fce19b6b7820b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a612f3a961d8242b124d517082fede9

SHA1
f240a9006ae90df2ed76fcb25c40bf30bbe6c6b1

SHA256
a644b6b424bf5e9740790c581bbe7e2e54e5c689fe49ad323d500b10ec17fa72

SHA512
9cda5542f8e3c8d9c6d3d2b4d1744a86fae6bbb1fd1dc0ac6ca01fe77c2bc698de33666ca050c127cc82481ccc99956fce11cb4dbb4031cd92a3ed85eb3e935a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46344512603d4a1c90e095be33389078

SHA1
c67fde7c3292d0d8896b38bc5aec1aa7d1cc7f7f

SHA256
a01385c7624dfd623be44f4f6206dbf99534975f66fbe48d224125f03141e0d4

SHA512
62eec074a946feb35f91ee8319d084213c95d64633ee7e9eb4675703e4dc20c219331f5fcada54de73573232e93600b102f0a6f80dd26ecdf33036df610dc2e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
786a2502e532d923cefb881ba1009440

SHA1
f076e921efbc15011643cbc07df00e8db154c4a3

SHA256
b4cd008119840b5da7f8c1a3129b7fb2fad0aca253d29e5f849a153bd5ff6a21

SHA512
300831505149cd6a001299d609abfec71442e3c68070f0b02a894850a901a3d3e7f427e2f7b66c59ecf9c2c532cd54d79bbfed12f35be7d0d12e08c4a9bea1ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa42eaa0241d6b3505783c5c768ef3ca

SHA1
e3c064b8220e756d3b37b9f6a1c4fccc1f1473c7

SHA256
6f05217d8ee1766f67006289e071bdc2d6dadc965e70044810a7c3bdd72a06a6

SHA512
622405482fa4dcec4b4f836e4c3c34a63c96cb89d970d7c9b7818330ab478937558dfaec0ad014342b15094ce1e866e88b082988894f12cf07e80eb4a4f9a227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65eb3d1fbb1f172af3508dd4574e7087

SHA1
c434ebe350cb7a1fc3f111613cb9c0ade490dd12

SHA256
ad3eae0d45dabe359dde0fdb5ebafcf63cf20526132753e8e8fcee66107c0153

SHA512
aa40e2222b21975969547e9d985c4db87f49b37eee9376225fa1ebc6a76b1346205fa27241b7ebd4690e3ee45fd20398e5e51020b503acd6b5e8ad498fd4f1e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc01d4117a996c9000b35e59547d4252

SHA1
d600ac8c69b0c05450c346ccec7187b6c50547e7

SHA256
9f50b6c1048a5ecf571573b044f8ccff81f7f2c4fd4462cfe15a1e5ca13ca5cc

SHA512
dbe0ecc554a638dc5b816446573502de873958123fc2e13a9c95091028762f9a01f12541ac23c498c8fdd9c44da57dea705788ddb416dbf7245dbff6b36b005a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e336e5915834292df42070a8db4a237f

SHA1
639c4dd0b03877be40cceb20d0da2f0c60f3b366

SHA256
00be8a90fd3f2c0f6f00bc7bc56ff379fac105e31b40fd2f733358ad30511dc1

SHA512
1ba2a4728c23b7ab7efede39517184163c9514671c8f20d8147d31bcefc56ddd8c9738dd2aa31f1df42ed67fc8909e25b9276158c8cb63075ee02066e06263fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99ef540fffefca1e63d657558f41c5e6

SHA1
017eaf8e118797f9b75a8328b5f2a5c5b7760c1f

SHA256
418cb294e133ad84551c16530de56aa92b415d5169908ce45c5439ea73516687

SHA512
561f04783637712331c85b33c069f5626d633bdc6e3e70c084a8d740227e21f06a62847a8cf60b56752abc1e8f8aeff82bc6536056d130efbb492c5dd9fb72c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2676.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2706.tmp

Filesize
52KB

MD5
196514ae53547d7d00269bc965a53df3

SHA1
9af8f9828b4b898ca51c910688b24b724003d4f9

SHA256
31bb8aa420359d26deba38f6df874e10beaafab686f6d4adf7529d4804a2656d

SHA512
f66832049e82f75d118d99fc7b2343a002481aa9c986bc18a6bedec30b346a7abd69bb0ffff1f84d56f8a30fe85787f8dd8dd44192399e004228bf97e9478fde

Download Submit