4fa70bd1d6163b785d5f4bdb771f44ea5620cc750dcaa8ed484beabc345e6dc1

Analysis

max time kernel
65s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa87ec41da06631bd665070dfc84476c.html
Size

4KB
MD5

fa87ec41da06631bd665070dfc84476c
SHA1

7ed0fc919ae9ef8565491659bb0373849b27148d
SHA256

4fa70bd1d6163b785d5f4bdb771f44ea5620cc750dcaa8ed484beabc345e6dc1
SHA512

1c582adbf724f84dcd37928bbff16f5bdeae80f310120f090574e90b76b633ff5cd9099b29325c08ecdb575a92204a8082d713b0fd46719d05b1f578bbdb406c
SSDEEP

96:rf9seakGiwLsvfpFFOxUErgpvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIaRvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000005e2fdc5e1bf810c8a3640c7c19ae6d3af6deeec45138a9f0a1a1dfb5ac2a44b3000000000e80000000020000200000001e10e31ed020d6433702fbf87922f0a39caaf360e2d99f2079d75319d332fa6990000000af65d018ecc810a818c80c9bd37e92c366016fc2265c6e149ab624fe6efd1e9d0724c1ba0b31353ca513c8ab8dfe37262040f0c40f5c47d200d2051a4baa0f4e156fe708bac996fd71d6c75d6a45f2b59f8102f3001205d1f75ec84c4ad4f037594baa627fafed399aa7ea6a1f7ce3576abf8c0b05b0e1329c5690796eb9f741900f2ecbac0732bf52b4899dbc7b243940000000168aacefc800bdfd552afcc5941bcd7715ceacab03e7b84dc3e13927f4a3d88db3c5a3d0e866b53208397b076a9196a4dbebb54cbb389783eb1e7eda266d73bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CE277C1-A11E-11EE-87B3-6E1D43634CD3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000821d1bf258a92cd70b5313cbdf95e033d8ee9b0dc2cf3fe7f16e00af71daa159000000000e80000000020000200000007a3b39e0370a298e4a9efadaca9c2595d547469cf6395c2a1818bb6752eb834b200000009bc2baaee8d3de80ffd65df056a297329820ce395ab7062a4a63d4129954a60640000000ce708ca3b28316a04672984053376a32a85be43c109498cfb2e8b9d31fa06ff662696d48a545d4588c13a5f5713289e1eb47b1b06c27aa6132db7ecd01f8023f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600d4c412b35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1580	2216	iexplore.exe	15
PID 2216 wrote to memory of 1580	2216	iexplore.exe	15
PID 2216 wrote to memory of 1580	2216	iexplore.exe	15
PID 2216 wrote to memory of 1580	2216	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa87ec41da06631bd665070dfc84476c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3259ec1e7fcc9f876f5a433a47077992

SHA1
b60e6345b87beb05ecfea26eadac41969fa76a22

SHA256
5e1e71035d6e76db00d6f1f070235508790c3cc13a7411cfb06a35f3683caa61

SHA512
25cfa4f403bbe128338a3be8e269567222dd80438d306a51ced16eab7fa17778673fe9e7e1f17e52ce33f49a4027b7362d738d60bdbc1bfe346a80a2c1cf69dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bacac8643575d1329c93bc3cc54daf00

SHA1
5930c76c99af9850c228e5af6bd328c3c5513987

SHA256
4070f6670306b507386c154609330016843c6d8dce87e4dd1372b24c8903b9aa

SHA512
0d022fe6bc6d52937c019d261424ad3fb8c7b20977bdd6b1d07f88cc3c18bcf259b843125c6fa197c27a95db672784a4487e7fe849c4b6df3c99496e84df3a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1d266eb1237c287ed326cf3b4031fae

SHA1
2d26628683b52c2ddec1c2e3f14270875df1bef4

SHA256
f7df200a79402560fb98ac52590a0a2e6364bbc85aaf2a4f981010d303fb231a

SHA512
3876083ca9b9f6058374f08d73bd212099b5193d3c862231a4e909a9293c33ee598d015d4ca79958906a159700f227dd89a01746984ad14730383df2c7cd8289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790b36b790f348d307956dd06884893e

SHA1
93487a7f7802884d9dc2390359b8550dc50ec717

SHA256
53431a7677be962a5d2ae2fbcf2905cc2c25efcfd7a8736df741cbdfd91275ff

SHA512
f8c8d1efed8ba4ec3e6534fd85ea54d30137fef62fca723f785d14b95ad8d66aab62595120099b06c9b3451b9d5dac96377bcc03927f0119e04e6019dc1cfbd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a0e8edbb85d8aaef6dcda1e5bfaff22

SHA1
f75bc52cf53902e6f3151abd07d70d126b4d83f4

SHA256
05e0c5873d14aad9e373604f879dcc94065c819c223a3ff14458093c864e365f

SHA512
416cda92ad7a340eef5e322d7dbd933c1216d92074e8084d0fcb034923e93829432a4b1df733bc66edc5be3813134ec15bc7a35aae503a240e423f3998fe17a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cba1b37e25b8aeac40cd7a9ad13061e8

SHA1
ab8fedf61b41fdcf2c80288af8d708a8160cbc6c

SHA256
b532cbb3b3186af945e5f9b78fc93b17f9fe468ec6b133bfa40064c1c0e0454a

SHA512
a2cd9508cb59153b60c30f4df691314478ce8e11cf520ed5ebbdae803e9dfa2e5e7ae37652bfede36a121aded5aaf80e329981be420a09867de3417774f16bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06bb6aaf044173d40364bbd066cd5b25

SHA1
76c490744647a25e1d16b0fdbf19569de069c381

SHA256
1dc358fccc39e61b1e1eb8c49a4eb0b1a7762de7d8dd4d67a41da92b2fe46960

SHA512
12f1ab375c18074c8b66b43f0f6a2b3fe558a43aa921c51852ff915bd9518122fefd58e1c79f1ea690879a2543eb12f62f10aced22592525bfb7e47d4c24318b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa4bdb0952546f9911b9f28e41159bfb

SHA1
60a3274e0b0e1b310e16fcd6b3fefcd227704651

SHA256
601d6fad410c3b71ef6881d61a40cd0b679fcdc242807496811e911a92fb0f9a

SHA512
d3b53646b36c7a8b8f3f21330982c11bb58386fb7c651193e6753fa4a31b6b8e9abd65e54988f677a130b9a2b4e8f5125256374f38dc590d091b9531e1d74642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
41cb82f416813b723d7d885a689c1dff

SHA1
136f4787e9726af3abb38616feb8ed21f8ad7c33

SHA256
56704afbdca5157688c778d0757c5ecae9fad5fccf70b90304051f0f21c08d45

SHA512
1304e73459e730309a081038cc2775e648c28c023c1799bb34dc77d96cecf91ff8029a6d92791e8fbd9fcf7f145256ac6a0d24bd47c351334d8d8e3395197c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar415A.tmp

Filesize
103KB

MD5
be5eac7440cb93168ddc71fa8db50e2b

SHA1
cb2aa9cc80492bebcf6a1295b62296a9fec9e20c

SHA256
2a0cdaf06ae9ae3fc806396a4e40b77c48f1c72cb3aeb77f2b9d0bee4953a97e

SHA512
dc4afd7a856184f46749a2171e7e2b77dc2f76b81c620c7b9236a751d16875585515c09a2f34a54aa93db15d4a519d2b2b0fc7920afa5a39f5f92383d132f503

Download Submit