c3aec66d99b8a33036d9718ce277e441b02f52b684712abacea21aa4069881f7

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35447a943b8996f508109a14b892ffce.html
Size

2KB
MD5

35447a943b8996f508109a14b892ffce
SHA1

db9b36199915fb026bca0f3be0f10708f84f84f5
SHA256

c3aec66d99b8a33036d9718ce277e441b02f52b684712abacea21aa4069881f7
SHA512

3e761bcd986cc0aeb816f30e650e5fe2c5b3d45f6c7fad5b9803d8efacdd4a245e47c58716a6c4d6ededabea5ffc1a150bebbde98e14d27f784997ce844aebe2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000003ba7090f6b86f4e97b32144847b5388994a4a0f0bc16fab070a7b5b440cc1277000000000e800000000200002000000070491edcb051d276697d2a64ff13413e2153119842a2e4ba58ffb78dc1506bce90000000c5b1e1ac909e27681cf0940d8bf9f2565170bf95eed7980ce9386976ca8b036f06c299800c2f3184ead6f620ec647793718189af96b3cd97aa743b716c64f4193d6a120aba4111a63b11982f8cd1b79f321572d8c0a5a6a313463d6860ae00919267f21fc76b91ac110a4849b269229bf395a023ed3f58d521c849acdff503f3a99d026937a502c133a24a651079a0954000000048eba772be64a3e7a4c2500754c53bce552b482f255104617a16c4f356d27211ab06455c053dea6dc8f45f6a76fa292b94b5556b291a03c56e87287361000d9f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409991364"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{412E1761-A60F-11EE-8CE9-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a55960e3514967ab41ed40ed73e10be8978d3bffe540a56bf85b67d63f440536000000000e8000000002000020000000d018b6f0346681038d065127eb27d1ff3d15640e355ed500e8712e8e7b4e045d200000001a977dfb6df14002cc4ddfb6470cb61aa8d89cbda2d78c2acb458da168e8916d4000000011c8042db9943745fd1c4ba8bef2762294cbb84279fa8e8341a8332623a756abd5f881b4d95c182ebd0fce8e9cd9c6caf8cfa7aabb08e23a3c280138cdceef73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bb503c1c3ada01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2208	1960	iexplore.exe	28
PID 1960 wrote to memory of 2208	1960	iexplore.exe	28
PID 1960 wrote to memory of 2208	1960	iexplore.exe	28
PID 1960 wrote to memory of 2208	1960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35447a943b8996f508109a14b892ffce.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0990e33cfb6e97440c4d638686bb31ce

SHA1
afb609f897a84247cc659cb8f747f1689e9fd935

SHA256
f7d4acfa13f67350822b3371199ce71c56de6d35fca007e4351d62120eb7cbdf

SHA512
f53d71a466adc10b4242b40983c63c2f0328b8af39ebe74c9bc6dcd9c131318201bbe85fe49a23e493bfc9e9111d3d340dc9c91ca9c84940bfb2c629f2e60365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a4708455ce423571bad8e16f24b6ce3

SHA1
d36cd2948e907ba5a205870f3e4c8e02b4a3c8fb

SHA256
603ed8ca1dd43b4980eed2c62d3ae9930b34755d0650a39b9813a11df1e6ae8b

SHA512
0f98079fffe89e7638ec0e5fcbd59254b77cc4c859c16540916891884b5341e888e6fae6c5afe91f69e4df79e2007302133192c0f2b15f4b86b0fe298cbdf802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdce4ff9d8838bc804ba0006c4fa897c

SHA1
07b95f8a9ee6a39767c3affb4c68b26b9aace4ea

SHA256
f28caad384eb25b3aabaa2fe854eb3c30610c755f13824b67b3211bb149d00f8

SHA512
6869987a7b74b809fe4daa3281329d3130383f3751e7bdef0a7a03b2224f62bd583df494969822f8d34f2a37ed9a0cd7d0c701df4fd828d88252e21ee840ed99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d16469f6c6a85525e61c65b6af0b60

SHA1
4d621b1bb8102b81435111078cb151b3883838a7

SHA256
751b16680a73c927a467f67c5f3ef243dec7becdd6691454c381506f5669459c

SHA512
df3ddd28e010ddb4f31922a0d0809bd82e20a8cd7e1316e1a44c5f8b70b3f9d05b7cf722404fd2e1d7d31612759dbb2a6caa92331a3dd1be6b10ccd459a689ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12d83a3d42e7d0cd5d061ca9c097e37d

SHA1
1a7b7afa4593bca83a9ffcb26e647d76e99caf3b

SHA256
307933e7c3cd772d68bbe3abf1a4c17ffff893a61a208887237bd7c3637b6867

SHA512
99414614588fc2d288ab9511b60f40291f25da37e160b13999074f1e28e76a08578e6e08ef233f1f35ee28e1dbb0de653343d79ce23b90c1f37da5ec3b068596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32d7d3df29b65562d39d64e6a4c54e78

SHA1
80463dfb98a6a175982c3de40af921779a82eb87

SHA256
da04c3e917d1d2dc69dad76bf2183d03a4e64835a87ead081f349a08b638115d

SHA512
9f0ef7070f55d50498cd7a79e613f217e45c6a9f95dbfcf9f831d9bb29d6c83e3425efba3ac54a7a93b48f68aea42baf9c095abee9ecd8d4553122f82d94218f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea75a063a183a00df14e358206389c8a

SHA1
7f265995fbbdc61e4225c2f95a918b69920eb594

SHA256
d86e445d17dc04ba231eb69b0546db3d03d03c82c36325a5f86cf5c136afa16f

SHA512
b75c660aeb91522ccba65e00270d5dc46a2136d70a3abd2096124818aedeb44442ee87795c56809658612bacde972bce922235b4b97e3a055b98ed3b6ddc63ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
432c7d03b57ffbe3ca704f79a484d0fa

SHA1
43fc35f62ba1495655bf24e4fb2ccf9b704c46f3

SHA256
f4187d7ae2ce986f9f03427f613890f4ae43693977ee8737992b7133de828209

SHA512
773cdd819143d5b299058efb79f3c292ad742aa6dce8fa33b6d29b98c2b898d2a8187879dc5de9fc6fb1fec9db420ceae95766cc7053f0a5f0c8cd4f97c75924

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18DF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar196F.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit