be0af4715cacb4a4fc538e98cbafa1ea616e18c699ee7c83abeccf434fdd1c8c

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc9ac494603195a510ba69392bb0c6fa.html
Size

570B
MD5

fc9ac494603195a510ba69392bb0c6fa
SHA1

b1f3a930b5e9331b4d8f9a9e9533e1c778be41e4
SHA256

be0af4715cacb4a4fc538e98cbafa1ea616e18c699ee7c83abeccf434fdd1c8c
SHA512

579b7ee9684d3e5f0516867c1f9b164a2d9b56e63ee74932dc863c51274729e6f235b107ff767a02edf30ebd4a139cab032fb8cefd530f1f53dfd6aedf83008f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A75E6651-A238-11EE-A00E-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000cdb585e68a388abcbc8471a74b11fc2235e6835a85d9344b7661fe97fc147f1c000000000e80000000020000200000009d20dad7e5a8faa3058da0569c0ff2c9675e80e102422819ab91734a37c3fcfb20000000350dfffc6f645068970d00aa12487d88be568c587253ee9f048704c09f3289eb400000000fe4a2d3372be874b797dd53d15a3fb6323241f2b1dfc3955cdcb660b8e3907599c4a0752ef38da9a40eb884bfe1572ced038ff175314e5eb96fdab8024fe775	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409569339"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b085fc7f4536da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000537a9ab07a7e8e18d9fab39f8b954f0a5b63075af395cfa14e66748509c842a9000000000e800000000200002000000020d34f03a71b7d88b76cf2eac034708b4fb38bd133c61dcaf9dd3fcd58211d4e900000007ab8a31f9bf7279721341eecf2758b7b63f33d9d0af97d8c36cd12280ad2d7f5106127adf8b3364d5c459be9aa9ac184279a304ff2095740e43422b6df9630fed02b2c5d4767a8a5028521f27fa07fa746ff010ce9e46aca3e87e93183e8c82e76a6326817677cb3242f7bd5bfa73353010cd19fd0cb61a8791690fade1978904abe6313d6f1b2a417ac44888c0a3765400000003b6cd816006c5cc82fbcf9eb3d85398dc460d27a32eaf0b2dac0429c36f618a4963d13704e1ffa11615fc7fd1ef4c9a282869cac2a321b0dce4c10c200b3a09d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2404	3028	iexplore.exe	28
PID 3028 wrote to memory of 2404	3028	iexplore.exe	28
PID 3028 wrote to memory of 2404	3028	iexplore.exe	28
PID 3028 wrote to memory of 2404	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc9ac494603195a510ba69392bb0c6fa.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbd65546b6e5a2083cd9aeaa1294413e

SHA1
3690964db5d9b60d6f0257fdad66a2f9033095de

SHA256
e043bf9dd03db662624c00cbe12469882ef7a0332f189cace1d6d861fe3ce637

SHA512
71dd437e86c5bc4d4b28c8a8d4db06a7a5b5ee344de83f583ba66930d14acec5ba748016b2a234a6b2e001b415718dde5df9787bf3fb314a43190c0532f1ca79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca1287edfab588aadf2319d3a64d22d2

SHA1
be8a5a3d61bfa20ec9a13c442a47b43bce3a1830

SHA256
401a673d3d7191bf80caf13c788a41d6759e37e431e3ce646914fba2e6caaa4c

SHA512
b4998882667301ab79efaef4c4fe0091b7376fd1c452e44dba03f3fdf05bcd6fee6035e24426b90c7e83359e9b7e773b032e219109b89b0de19700b87b935559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b074a8f65674808108549665a0370edc

SHA1
686d80c80e879befde757876e3a4f6f80310a091

SHA256
6da0060eb7494baa1814ec296a3ef03046c1048bb470da115aa124ee6479e2d3

SHA512
d4e4ba17d145b0c7c77f998dce61a0da71b6413c93c528fbef6a760a1d91ddb12e330a9f341a944b61c1370fc7c22aa2250e8e233ba09cda16fe3549e6a1aa4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
493f889c1b97a7dab5c0d2167bfb3a4b

SHA1
cade547d42a8a69678407486e48704d66b7357b4

SHA256
6478005cbdd8082b4ba802cbc2a3df2a3903e60f21b572642225abd40501308f

SHA512
d9ffab240e4cc485e6f8c091d46bdb63e1bf61da4ed557f0ef2a579a563d1d3e6fff4d37ef0509fb260272d07295e9b1d08833f70b1b45e2f86804078873c193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89955fd4ca5f86f9653865532ac53a3c

SHA1
0b95d172fd7bcc59ae1879c3cba5703d2415bbd8

SHA256
026ae5280cfc7de3ab3e1a217002b62a86385541f529b14f2d99637fec6f618f

SHA512
4fefffabe35304009960e7e175fbe20e0ee30da8a8640eeb4d43bcdbea205eba9b34c8319cb68e386b87d194be7737c6f53a571c8c935630e5ca35d754ffaabb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
346d4edb87d70867ffb53d09a3dcff64

SHA1
0e0f0956a4a90f49f62ce45e751d0f224d6dc478

SHA256
20f4d8535be9cf78ab899b6f93458cc90085679c39d6908f52e26e7c18113242

SHA512
4b2c2a267656d870b7c30f2c0a410b30561c0d08adbde02662d80efc73d842d26335572c15aa4ac1c26be1a0f524f43ef2bc63b8de3370efd3e4a46e73ac5010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3ab0674bf10d7f7c84fc9ef979b2b08

SHA1
0142cfc37dea3f0c14b8e7d886ea5f940db3724b

SHA256
4650b17f478bb6563419ece59f479df93bffecee23035839df45eb8f8e4250cb

SHA512
94a61c3bd2dff4aff469b1b5e6734670e88f85369fba75ba33c63b968a59978386e4eb01d3219722996c6d0da01f7d981c6ad454ef7252dcdf5972b3978650ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e40a543b7bc9f915787d0042b1600d1e

SHA1
eb131c26702759717420ad5ae66d331d708562d2

SHA256
1c8091d78a698d58b6800ee7e1a5724b701b84dc982b490e5bf9cfb228428ca3

SHA512
f551163fd65d051e58da476687521d9b2332bb0bb36670d533e32b98d87c79f0b1f9366aa5e2b1e138e49658838c1581f9a7f2757d6f589ffeacfbe7da356e0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1585f4cc11ad23c0b67afde1fe4f708

SHA1
b686ae623924447e2d94052f4f26111dcb9b36dd

SHA256
462cd6543a49d820d8bc4a7550f2730775179801ffe650663ec65b81942811dc

SHA512
45e66a61045eed05c385c9b6e3d8722972900e59d733d2f698b331107760171981c678dfe713af43d3d08140e58d076bc89f7eaa11d1562a423028c98d4f1a5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e334c3205428faaf9f0eec203b9bc0da

SHA1
d96b21e92422bde33a4849cfc2f4521360712390

SHA256
54d1c16e6998ab826808e0ad480933ec536a7033018eefca5f8cfc89255c5a1b

SHA512
47f0dcf438efa7ceb98c04cc4c3035ad42b0c0334d40482554d21c6b754bc45607b2aee171e8875f31d4a03876bc19dc7324072b677598c02a0aeb76ac5a0e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8afa95d3c575e242302dc3ed4c9adf65

SHA1
322a95b6f1d92ac701b6ee2f8b6a1deee564dddb

SHA256
268a7a5bf0c9911f47b2093f54469b57673feb4904be20a86de88ce90f3232a8

SHA512
ea92bb0ec618eeb8767ed22bcb5c24c736570e9a21f21f2ffd9c379acc71f8c4646f70bcf4855dca60471849cd9b68199f31dad0bb60b9a98cc4143f3e850993

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5811.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5881.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit