ecd0f63971d60cd74e2bd25837c75c1055fd24ec4feec439d4b34e703bde48b5

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cda93192c5361c220a1d4b71e41e066.html
Size

14KB
MD5

2cda93192c5361c220a1d4b71e41e066
SHA1

97ef8f7282e4229a7b6ac0958d61adfe303bc94d
SHA256

ecd0f63971d60cd74e2bd25837c75c1055fd24ec4feec439d4b34e703bde48b5
SHA512

984cf85b34d9646dc3f19480285b8f52411fa7bb581d5dadb94ef83fa7452cfb0191b017c7b4a905454b0396457bad30d8feae973afd6fa5c654105e50c080ee
SSDEEP

192:zHNPyRLpwWB+2UVkI5kInwM8+YCJYyb6M8Hm7y/xq:zuwWolVkI5XngE6M8Hm7y/xq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409753516"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b3b94df237da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{782C8571-A3E5-11EE-ACBB-46FAA8558A22} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000017796d6c22d57219533cf192d33a7cf8916ee885474484ad4b6463660d465ff7000000000e800000000200002000000024aac05c8e7979df0cd623f3627822c1e5b6b72c72e04def4c8d80bdfc857aae2000000003eac7f14977c2d1dabcdb54c4911628aea1ed0b14c0295c0f5d67440fa521e540000000dba4b63411d052b6439e6fe6b642ea54f1aaf09a681debe5e362df5fd7078b25892f7f1499209621c715fdf96f32ea114945a9edf71c39dc868e5bb7025ed95c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006cc44448016bf1681166d79ca849abaa38f202f3110dccf257170437af79acf6000000000e8000000002000020000000e08a08b48e1e2d02cb262cba155e075fa2337377b7fafbb0422e33a61c2095a59000000061874b10161c28e7d6fad7e68e6af8586712ab0513167a80d1710dcae1c9542072aa412c347a70a61081a8577013d6000844190c5f7247529f22ee42c54ec617d9a8c6e2e3c41b9b3e6576b7d9a1c20ca1fe0f0bc03042dc5fdff4c8bbc8a82e00dad84207cf0c0cde60655f8b73a38b275a51dba3b52d09de8b9b24d6d7dbb92cf272ed722ca64c058db47d0c9ad7fd400000001e2fbd5a1a8c62071b665e6ff59ccf09779156ed2254576c5bc0362cca67d070019826e57c54e0ee3c1441b5383f763c3f4f04b7073b001a29a84d50eb990639	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2312	2056	iexplore.exe	28
PID 2056 wrote to memory of 2312	2056	iexplore.exe	28
PID 2056 wrote to memory of 2312	2056	iexplore.exe	28
PID 2056 wrote to memory of 2312	2056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cda93192c5361c220a1d4b71e41e066.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aa4404129307c653752287a3770f17d

SHA1
da045b6303dd421e5f025219d500fb0af5ace811

SHA256
2c4a6425fd4aebd8f4ed263c6310ba1cd6b38d01617ecee36291c3d7dc54ea10

SHA512
24e4f344214cccd15c98edf167ed58cacc7071897160cea473e523e262b81d5bdc7030c483c28e1724728a091a2b18e408ccd1dc0f8978282d151e21ee30d20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d4c446ce05136e96532200f7ad1433

SHA1
4fbf6c8906deb7e81bc973d599fdf6eff832d886

SHA256
3dd541af06afdbbba2d51bbfd6f92ccfbee468b92af5899f8237be22508d1aba

SHA512
a2dbaac01594c83403ac2fa40ab68be93a87a3f8a2741f0d1e297f216231d6d797d20e6de30c0fda3c5ca194e516316d5ef75edd8ea4f9ae2f416596e6a3f6ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
936b3477da39e7c158d65e6f63117790

SHA1
386324bd492f4ad91ec9b6345ca9d63b10c6f3f2

SHA256
ee335aa3664d9360ab0e564575a6074ddf908ccf58a4e0eee9b83017adedca3a

SHA512
ecc86d4a6d673ec7e8100c6cc3bbbcc715a4e39e0748c9300df36eeb26c7ebac90235640f820e545e0834ea6d8ca352711b074fc9285998fb87981212efbfb4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12fe84a0974c1784887720749f685727

SHA1
885a3ef5e48a9c56143d1e07907ae8f1def65855

SHA256
b81ec7ba5647f93788888b303645bc06dfbec7a750888a2dd007c485aca838ea

SHA512
a49581f3247aa78a35dbf01d0e9072099c69950c340020631af49caaa7e7aba56e8ac13b934acd50dafb22badbd498a6bb5c162574e57ea6052c2fef3afb9c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff762c0cdba8e59a89e481d241c30b27

SHA1
96aabf82cca9c3177b020670c50eb6e482079124

SHA256
d68fca19a4ab3be2188c09c3627c6e086c4e1524f2e4206ceab31de4c10dab5f

SHA512
2cfd25baf67ce51d1a0a45cbd075aff3e1af6f06f44ee4988e3035573b95a34c60a116ebb27fba5eb5ab579121d011ffc59c6ce806d8699e60a707259c32dc25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8824a8e795286d66463b23385cc6dfc6

SHA1
b5cf1545ae87607e21229b4fdfcaf9ca13620eef

SHA256
643d5557c0dcb85643aa5274b11ff1eb7ca3ee37c84568604ce7b7a4df6880c7

SHA512
457415ef9f8a6bd458c437115d1f09fba6bdc823a67d65241533157800b5d43d5de475166df41e601b29743c0d88888538b6eb2c9926ee7738a55a5071497c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bd951ee16ea65cbc3385845e7ad0719

SHA1
80acbdc730601348fa7a5ca6086bf804ca60dbef

SHA256
be89e01fa418b8cf56c937afc79bf9882baa37ff2bda8283b6bc5377a53b516e

SHA512
bab727a7ed53dde60b99a2863eb0d3f0cbf1e7248791577661182d2e5b2d2fb0b5bd7628af9320a6673e69751cd55a466ecf6f79729e9e48404a0e6ac24dc41c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3853ce11d50bd31c74814bbda866ae8f

SHA1
5cf2cefcd778db622394ed632efcf2265509af82

SHA256
bdbd840e8be36a8a559031142a806b8772634e890ff3657de38b383a8782a697

SHA512
76a3767ec76138a1c9fb77cd642f445835b6bc8995ca6e099c7ba374868ec084d1cdc73e5f99fc6695f5aa7c8c83f2ae60d80cf0519e63fa6354ca25dff3b368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e7223f8840cf2c88e941c1f2a20255d

SHA1
2a4039c47a7256a34b74703cc9e9ab213682f863

SHA256
bef13aa577998c10482cb23bceb37b1f70081ec31f83e4651b734b352b7e3d80

SHA512
b7440ce46cbe5ef3c599eead8f69fb18eea13dee996f19b8dd58bb2a1ec366ce3ef1016fd2d77cc646a575c739edb09995c3c78cbd5c6084c770381902c411be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0855573d7e580850305f74eebc0a1b07

SHA1
84bce6405e73b86601270ff08046f8f6b4a61b4c

SHA256
44ba4dba2f81b2a9c06dbb1d0caa0ed8dc0926066e121b7f2be68d47fbe910a1

SHA512
8d048fef4e511e8052ef6c181aefcda7abb616fbaf4b0bd7d547ec66d4a8202575f1d5e410443cd8e261134700c14c6ab291f0e1a0bf8d9779f69092cea7853b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da99a9eefc782eae6020e8ec26df9f30

SHA1
ad1d7b083f8538a02de255dae964b0fa24f1c940

SHA256
aa453b5c3fb4d9df6151e38ec0403c5e79c5d1afacbf1e7ebbd47af37b2f331e

SHA512
25ad2c6b233ded6ccb68d433bf10a886060ccb37e97ce4b4e77c3d06217ddb9346b40cd10b5f19398a85fa349f8996f687516ed88c718602bd9a3ae7d9d84920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd4f56d1f5986776235c5a15c8e5da1

SHA1
abb4e7473cc957f9cdf40328d043a89acfe0943d

SHA256
396faa70220384f646502120efd672ff27749bccb28e57cde1faccf7aad96f97

SHA512
73e19190fe94d369a81b84f8deb7b433064ab773bc93c54bfd2280c3e8d2b3124d2d621f8ed04e2e61c1707a3e69ea99d2aaa6117581fa4db54c393e1badc817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8701b45a274cba83794423d6da98332

SHA1
565fd400df2d5387e7c24b43e2ebe00dd7478071

SHA256
25d0b9ada51d75c14c1331e811557b237e15df3731c68af0a370000813256b5b

SHA512
b4fbc177eaec1545e0af39c7fe9d6959d26e5d83642f31f16c5cecc3b2e77039dac2d8bf6c7872f03137a5cc51f6ed0b2bbadeb285adcd6b7202987f7d593241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b297ce1dfbe69206f4811bdb4764d2

SHA1
8f848eea3d9c2c1a56e00cfc2d489f135b6ec712

SHA256
dfd1dfbe0faf321102b6bf6178b4b7b26546b575b513a438ce370aa00a8a7bc1

SHA512
84748f870a6b843442affeb1a736ac39812acfaf1fa6cac71f82f4e10f619327834c94f3682a589a3b637219b1b7ba6ba30b6eb92311f5ce1dde6f2779fa4d13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5739940c213052f4208d2588b58bc4ab

SHA1
df706812f1f2975d44cc9036054a350bad270b7b

SHA256
5b4f91774d1c00236463b4837e9bea13b8d7e86aeef864f234dc876a2cc8f72c

SHA512
ddc18766ffb7133965a3a102bc44fe599918652a3d2227a415ff8cec324f9fef3e74bfd61332b1997e3cd54f5af93af1f53888318c6735b06a05e5519d49e5d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75a49f1aa8bce8894bad5a8fff54f3a7

SHA1
7cc69d4705da863f22c3a6ea0e22c68ad97e27c6

SHA256
d8987c53d6fa2fb5c688d01c863a0d397e6b820a903dac4046df3f6222b8cb7b

SHA512
eb3f46a8475f47eec92de68007b4b492d91f59c3e7038b8522af19c577ae89b8eb823f3ea90c5ef69cd609d1a4b7d96938d9d9ce5ffc78bdb76eb964b788408c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD32.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE02.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit