0b7da7a2d102473abd3feb74bd967f1446287817359dcdc778f1f1668335e4bd

Analysis

max time kernel
118s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc3c11ea8fa29b91c25d573bf7685133.html
Size

570B
MD5

fc3c11ea8fa29b91c25d573bf7685133
SHA1

d46984d8f02839f4295da129499f5abb7be59576
SHA256

0b7da7a2d102473abd3feb74bd967f1446287817359dcdc778f1f1668335e4bd
SHA512

f2e8e229d01512ac40011a86cf7788cd40632f5c27bf017b8fa65a3b197d9ef52d2fdf3c3bf04516cd6096e8190359b0a5e30c9096ff2b211c6592eb1877d6fe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ab2e52bbde1fbbb20d337d759ca61c48e83fd64996be86db56ac2d33ae98fcdf000000000e80000000020000200000005a4041d402e097d0b46da42415c5087187d54403dd4630279d4a7c5baa4da36120000000081429d185f78b00eb9500141a65cbe7955fe9c814f3532d100108462164d48640000000453aa3619e2b5f47157186ed62b80d28448ff099d14b9c37b73a8ade2441e8ac18c3b433bdf51ce63c4bd73033c1a839a83da2d7072d04eb9695179eedf41f31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70720e902c35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409448686"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000be458089790b86e3feadf99cee6b922a65028e54c7acb60c099ba9b82f66e34000000000e8000000002000020000000701b906855183d8bdda6fae07b6bc95734f3f509af007a449a0dffdcef31e57a900000006936b102aaa7352995b7cfc27fd5c4f77338148aa2103cddf0fb6fd4122eb9d6cbd43ca755b14178008215b78eadcf9a5ab748e2c7686c0f496ecb973f4c3d7d1fd7df3be432d45d0444f392c3c12d937e788c5d647fbcf0793057eb49b1a74df7840ad1a3c06480bdda00e7f70e126686f511bc149518305e03c363236e6b57032ec2d605903bc265b9b62c6bb78bc840000000e7d54c3e4df334850021cbc5ebf03b1688e52bb554bc94bd511f3a09174c538f30caf05444f470ce6c727ee0fef4d891534f5dcab45d92b7c23ca5e789b4651a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B827DB71-A11F-11EE-A371-5E688C03EF37} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2664	3048	iexplore.exe	28
PID 3048 wrote to memory of 2664	3048	iexplore.exe	28
PID 3048 wrote to memory of 2664	3048	iexplore.exe	28
PID 3048 wrote to memory of 2664	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc3c11ea8fa29b91c25d573bf7685133.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32a6084fc4a62d7a4134e0b1c2fb9cc4

SHA1
2b774e6d6c79b537cad4a737b67b777e62f9906e

SHA256
43823f90afd74289c5ea630b9dd381b15f4bf35d8db9f0f810cb15628a55f4f2

SHA512
2a07e8ddee4095ef9d0e829a4920e9eaa43fe3fc71d515e3441d4e802c8b56fbcd37fc4ee08dc5c3c0c4930359f70a5daa06a6d4779f1713c793b76aa17529d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c96d9cbfc0d444baa39f20cd871810b

SHA1
5a648328f371353845d4dd25f8a587652e5a9958

SHA256
b36149df6459c155c870b7cc8e58b8a94bf7121329e8c000df11c45ba69653ea

SHA512
b8001716bd6ac0b7e0ebb7dec9e339dd2ea95612dcac2eaaf67a11da7b2ed827e4b92c90ce5efd2f7943e68bb364fdc86230888c9214d26fb1099a08e7c24ae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de4fb6d584915dd689804f253b66f3fb

SHA1
f971427523231e26d0d83b3b4259c30a10df0cbd

SHA256
f803a1e0e3c84082e866b86e12dda7bdf6e918474674503751f898faa6b8fd1b

SHA512
9224268674b2bf82c36d01546d55819cc50dc09a25a026042fdef3621f060bd2c160b9e04edc32fa840d9dad3dd71115a37d9efb4f185437c91481be5317d1bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95d68b9f0b38c75d456d8721a99e701d

SHA1
840a4bd8ed1c29ad5266dbe5f8976087806d38b9

SHA256
39931abb4a5033b01b28ee8dcea70298d7e20fc4cde81a6568ccf049191e5ffb

SHA512
d4f9d20323c4cca548474e3dcc2387c4748400161926ae3526aba40f85e61c8aa8597389cb8916ae4f3251695765b451f24387c03e4e16afe2efb45a3726b726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d781f59b1a1edea56a6a312cd1242e3

SHA1
b5aa9f6fe8222a807facba246b00e1bd59c0a885

SHA256
1339e2444b893aeaab8fc62cb15c24e9edfcdce610c69403d26603817d05d4dd

SHA512
a84d57fb8624cf04b81c5b7bad275205e90e19d49bbbb735c0cb42193f720402c1744558b345c43442c50ac91d4450bbb6f689b0aefbc2dda708d2e004e2d0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e88670e73884b3018ec29a0de718e90f

SHA1
221c28a594956759124d446c8bda408911b49aa6

SHA256
cae01a91b5ceb936aba68a03dce42f9c9291b7fb8e2510cc9696e7f7b76d0285

SHA512
0e9624ceb690f5b6d2f073cac02d3e63abbbe4b4c870e4381a32091799dc9abe11d3605a268fa41e65b4ded6f3a19d4053289effabbf07cf366f16fe205fa358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
063e521b1d3fd1dcb3baf14e5dcb6737

SHA1
cea90e96a02ecb4c6b2474d87bce737b5cabf024

SHA256
b2a3f95ec0862ecb2b87a1b6edd04cc54a5ba1487ad44fa3dcb24bd3bdc71695

SHA512
7434e50acb420c1e15596803edf96153f3b2b719591c63a56e980c1e26d1ab1d122657b27dd8ce671d0b94c2d052f26613237adb4fd178ca8b48edae5d0e9778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f103b3e7371eaee0ad227a69e91daaa

SHA1
268f8277372ce21f96911984e6ab183c6dfa8fe5

SHA256
099b8d301cced79728aa06d44b6042070823d70e5f1c357f282f802ae364780d

SHA512
df9e42ab0a726745b9e0f6fb9dabd14c050d501154c9077c1b5695cef1473b43d3e0c76d2d7e8ab32e9da9d64d56599c17eaac5b777051d290c7e8619615cede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d6487c9a60cdde9cf7aa96d9513366c

SHA1
1b4b16d01b59e51a7e3246ceda1bfd9c620318da

SHA256
42056ff92e294c6484535ad8666fc9046bb3f7d5805c1209eaf1d6ff02873524

SHA512
241fc29274f1964af66ada0268098e00e3fa0ef2bfbc60df949543b0683edfda178e30d135b4b22f031bdd47d2f834800b6f8ec7ff402857ff10b7abcb1f7128

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FB7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit