33a7818d1c01528dd94a80787a47125d9b663133e8ed05df877afc080802a388

Analysis

max time kernel
160s
max time network
229s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fcb3849415a3007855daacec26f01cbd.html
Size

68KB
MD5

fcb3849415a3007855daacec26f01cbd
SHA1

4a825fa24df22116d4b77831f129d86be0e4f17f
SHA256

33a7818d1c01528dd94a80787a47125d9b663133e8ed05df877afc080802a388
SHA512

588886ae00498e7b9f84e62f10314361bc347ccb61c0007c28432ad2b34a220dfbc77b3857c0167a646a1b6ce2d488c5c774b634ea0b075174f57f6c405f371c
SSDEEP

1536:lIRIOITIwIgIJKZgNDPIwIGI5IyJ7SGIRIOITIwIgIiKZgNDqIwIGI5IEJ7S01Jf:l1JMOFcouBhU80

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409449009"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ae83772d35da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000008468ecb146e74b4202bc70d69be71b794bb2384263ecc6e041dbccc6ec93b52c000000000e800000000200002000000074f18e9e73ebff9a9347b4ece462bdb6319cb651bc7dde1da467cb5410952a559000000010e94303c290336d63146b310a79a21d41da025293cfac8c891f413e6041f124cc4ab22aa519d271bf98add62370e292890a0e1bbf606f033f8053be610d43785fcb494ac0d557823a48a9dc8c13f2aa40199e9b62dbf49459127fc7cf0c997aeb6fc214b59c66309c704725cc06b7d443da29f91c67dea6a0267ac3888c59b900818c9b88649a78d4522f5dd012b4c14000000091127b15661627f537efbdb387298224d914c1d4e7ef19186f4a281c4409e514314523f316967bd52685bd9662de08df966b87fd3f2ebd5595df448414041baa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B911090-A120-11EE-97A9-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000db3bacb98fa78788eb575b19b3212555675ab30d0befd4550c0105bd99b70a53000000000e800000000200002000000070e2641b16387373d8244da58f34f7362c7830365944a7c43f28b785df44bb1e200000007cacd194e94ca0a739faf082246c95d1e6bb0f2b334260dbb130dd12d58045b9400000002f6672b3309f54a5e3188797c56b848a30f009e866744e420f38dbf491e51fff9fb21b4a2a62583374e0dbbfa9bb10eed009c5e92d68aef4b1587541e89e6ea8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3068	2952	iexplore.exe	30
PID 2952 wrote to memory of 3068	2952	iexplore.exe	30
PID 2952 wrote to memory of 3068	2952	iexplore.exe	30
PID 2952 wrote to memory of 3068	2952	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcb3849415a3007855daacec26f01cbd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11255551c183cfaa4fd3562fa3be738a

SHA1
0b95b858dae0cf41a8ca2b32022f8d8ea10904f3

SHA256
037b312e1a7fae9f19ee724b90e55ae948801780cef9d007693668454ca83a3b

SHA512
347adf638cc65de0b7fae6c631289b55d20cddf1aeeb9cbae8a52e737601bccfafab4145e81e1e7827e3a8dece33ba48391a5f4b83dfdff5bfa07473500cca90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
174421e5f290ddeea56e8957c84872d1

SHA1
9bea9e66f2b00a4436b12acb938142cb8258e99f

SHA256
26f1c8a71f36c249fde0b649e6659529b06f05ce67111b14ba6e049f67638d27

SHA512
2fe2f508b04a95e06fa79d5843191cc1ced59837711c065d2c60296c4246adbbc383e73999297981a8a8327ca8a5861eff16ce7c9b706dd06835ad32fe0abac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e544200f551b1224b956dd3df9ab8ae

SHA1
93cfcd0ae1c3c96ebd425129c2294040500ba793

SHA256
5c7025f876ccff9c943686fd2047f7897ead9f579606cfa68edc4ba0d6d33ffc

SHA512
b63dcc3456c0e3a8e9e8df3c95c6a1551a77c833d46a0a4ea091c7b91c979403eddb849eaaed6d327d7cac6800741f1d6fd0a1b8351770e7f3ff335f4417a544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a2b24f1de2c7da3aec1265c5b6c9aa

SHA1
41e5e6668eba31e684cc5961614770f377e662d8

SHA256
5a7a9a7b90d30d43383d721cca8f725be8ddabed19691ef6a50f91feabc9e03d

SHA512
5ba45f482d957d3809e9296ab95c9a816cd9c79670d5cc8150e4dda924fa866203332aff85a392b26a6bf061820cf45563ab537d9f89c471425e77b9f34dea52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c2c3058c315c0a0429c9f2bb3457a9f

SHA1
76b0d766fee0c96f6808708c83c7d5605cd1c3c7

SHA256
6733ca79127615a3fb8825e652b0bf19ebe620d18ea86af696d32ad6cd84931a

SHA512
6dfdf152a5d4108227262e73f11c02532e251e558e99e9861dbbed0cd4ff4049063d5023b709e8a1bdf8e4e1af1ab655cafc33b1e25614cc0cf33488d6a8d973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1bd7f824d7d51a4d17a2473a5930ac1

SHA1
ab0ab1ffe680c8ebd02ea56d92412383ac798155

SHA256
81783d84dd49234a6993f0908d19a7e13758f6daf590b0f68f8f9ad1ee3f56dc

SHA512
5a22f7b81ee701d2b0c5de24afe45c2c09a1a9858bf502b0fa0acc984e467e8a966b6b741dadc7406120650824dd2bb38b464717a018256228d2b3656dd1207e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c46669935ff002f57dca6a25f5751f6e

SHA1
1e565802bd341c2395fffd7bc368d4a6f6b202c7

SHA256
6ebf4370e0da7d0606063ab6183488fb4a8e0acf92bac255556fa8d2520712a9

SHA512
4126f3c0b5506350ef4b46bcb8495572fd9fbe0f4ee93c9a5f5df75ee5338cfaa3989dbc908905fed506ca34f90ae276bf470644591c918e748f3bd93c902c15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
233dd5009a528097b5d644d163d51cb1

SHA1
cff71f8d4ce85c4d62e017efc2c9bcd0dce88c21

SHA256
581462aab3edcf68066a81926fc4e83348e3588965e4cb3491ecea5799e7f4bf

SHA512
c0c0fba08ed9f51bc292e2ec565f97edff71b29e40db001be2f4b70c8d991354407c09d71a357f0733d7b7424e58f5c2d95d04114af273011632e5e44565d886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d852926763fa4f72d08bb7548ece6db0

SHA1
0cf90bb1f7eeb716a246b7b56d4dff682ef067f0

SHA256
060dfd74a99dcb69f843d7285c8319de88c596051c53700b35e29074ae477198

SHA512
cb5d1d3038182f1424f3d46c04bf5ad57369ea5ef4e876e54a6b1b2e4ca08ca1327bc4f42a65b0260b3ce8e6812d054f4165574c495728cb97d12987d792271d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4443ef9de085b979f56134b0ee05529f

SHA1
b8ade437f46be1db56eeb5c97331834b6b295725

SHA256
b9441011a7c484705c7db3fd6eaea7b8d45c33c9e6f718b3c00d1a470e01ca0a

SHA512
9753c0e4e274e09c1240a8758b186c9ecd6a8459728a30bb4badaad36bf6356c59774f33269b747580b9523afc717d042db46d9f5a8ad58eb4898b4825e7445e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a5782494fc6a4e9d3a5fa237e33ca7

SHA1
864613cf236a3301724691401265767602246b89

SHA256
26f539682088c23df806a2bd78d73785907df4093de0b153de7e439952cab7ad

SHA512
40b6f21cef64e2a466ba2b2c3549b17c970cbcdfd32f2911577db927b14696c43dad4a4d96f28cc9ff0d9f7cb9ec63de484f9da5b573a51e7dbf6b490c449682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a2ed5eedce1da7f218deb997d80a60f

SHA1
e29904cddc07590db4eaaf74579de5b2fcfa5854

SHA256
9bdc734dea73cd6748eb6816e8551288c644a9a6c7877f4885bed98ff6966542

SHA512
a064443c8ee299ad8ed7661c492d37b8a3666ca445e8c9d93412e7201971a8dc0c821e6d355d49ba6828aec101540846f646c74b1862aa96ad942b87e530e68a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88673a2afab7546efadff80027e9d26c

SHA1
735e59216ff450d56e641b464e52a8ed873a77da

SHA256
e748cf36b5c448ba36b9de5a1a46e4b5a0a0df4be47a987b58a658f370f885c6

SHA512
0bdc559ced1f721822e60850104db5557e893ab1a3cdd1bbe4616f208fb99bff3b95d887a2afe4849ec410ddf183c7afc47c8c44ba6a8ca397de9e26dfa91510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28c550c68d0d514e551e51c63a8ac3ef

SHA1
66b175dd1a0434b750bebcc30c5b680c8125f22e

SHA256
c69ccf8a501a229c438698d6a23f3a806dd8ee78805e6f10f10ceb6f2d33b193

SHA512
47f3de9f51383c2fd73fdade3e2c18b346883de3b4ede06df1d3a8f38c9e55a6b316540efec6e03f33ff4687be2246b61ae0862c9884935fdefd3a377c835700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C7F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C81.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit