71c54664a29ca63457f186dda0ed64bfa75afd7fee55e5395cf575b349d492cf

Analysis

max time kernel
135s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cc6aff8478504a5d049f1cbb465f0ef.html
Size

3KB
MD5

4cc6aff8478504a5d049f1cbb465f0ef
SHA1

b0b63a9bda36d8a0aeca56a0967a44959afee7c3
SHA256

71c54664a29ca63457f186dda0ed64bfa75afd7fee55e5395cf575b349d492cf
SHA512

da232548cf758b8eb73acc0f9de6e0aa22ce78dc34633a707cf94668c57a1c853f12e215163f981ecff3bb8c12c0afe36da46129042f8f91e5b5dcc82f996251

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1680A141-A970-11EE-994C-464D43A133DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005d93153d1034579e84808fe974d7ddbc319fd8f9fb85449bebe2672ab7191b7d000000000e8000000002000020000000e7ad291488f11f4efdcd9e002b2f0851f098f5ca2a4d59d34cc3b471974d04ec2000000004f3c7d9a2864234529962f9d80caebd21a54ef3fce9dccf9ed7c57e9ce9506d400000007c5f114e7600f448992a8bca378228731cbd1315473011584835555d6cc417e9c3f1d10b1cdeb6a08a670d325d72d11bd8631b43f76ed9d2818e1f18bf0c54a7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004c80a7944c7e421a38c60bbba036cc2b565f52b35c5cbf398b2b7e589d1d3989000000000e8000000002000020000000c90aea891439cd3c32152663ae886be249c261a784fb72f0ae3a67054d63be7390000000ff8ba902ba841ee055eb602c4816e05797a20348446f54f259d0a08b9fef3cec93d4aabdb9720bb9572a6352423eb61b16aae194b3d42d1f2b08db6802b727dcb098340579f290790c945ebf4844ac919868c5481aea7616fdf478a31a1f7da8d617ba86cf2058adb5db8e6fccfb8167f4365a925d3103a7d0e6a0d5747e7949d19f08759390318697bb3ebbb6f3113d4000000001fa97043ca8a03cef8ecb8479a91b106a4c079c430b0f4d90bf8769075d3fe004aa90f131dc49c4443da6d72076aecd3ca573a9120c5e5653e4fe4961f13b76	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410362814"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709051ef7c3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1188	iexplore.exe
1188	iexplore.exe
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1144	1188	iexplore.exe	28
PID 1188 wrote to memory of 1144	1188	iexplore.exe	28
PID 1188 wrote to memory of 1144	1188	iexplore.exe	28
PID 1188 wrote to memory of 1144	1188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4cc6aff8478504a5d049f1cbb465f0ef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86da6a511afe3234f7c7ffab2c9c035b

SHA1
1c89a85a96e6f14377414589960595165d88f387

SHA256
c30dd9a38db8400229078f642cfed08b02cd5399b61b2fc09047e4f6f260ba7e

SHA512
6126b0e05b910272b509775f862ff8f7ecbbd7de140e41fae374db78384ccffd4d39705e468981521968d37806a799822040c3c2e0c15553a26dc53cabac17dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa9f9a18edf81c678d336e79a39cbd9d

SHA1
8e1404af1acfdd4a1e54b3e414dc502d33e05f7c

SHA256
d7a6787eb482e1480e1b38c892c062af246ea6bcd1dec0ec581b9e49c24653b6

SHA512
4d1e37ca569209dcf2b3e66fc5ac27cc63dba76a26ee2e3cd30f8c0194873ff23497a3b7ad460edb43c45fb84be60735c7157e36e4d022a4a6dd6742a6366ae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7622d79981b1f816acf0a60e9d23c363

SHA1
fa0116b6c532af46524487ae435d5fc45f3ed49e

SHA256
cbdc9b764cd0dd1487316bf71c03cfaf3d94b0685c4c91dc654cfc462c767e27

SHA512
191d26bbcb0bb6dbd06b5c9485a1a4369c331fb8652ed1042b7ecb837b9e267b372327f850f0f716d6edda3a968f6efc28da4ff487678da93b269a81d7a97b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03dcfae2e388158a25fec1792293681c

SHA1
7cbc2cc3ab347234181529614465b03a7ed1b308

SHA256
a13bc49d0d6d695e02c8ea57b51a0304300d85616c6864086abca47f217c095c

SHA512
a0adf68aebd6c449e580904ed5282c2a38f30f04caa024b7e134a8b3fa0757d5c6520a18a2d8c10024f430e86fd78cf073849f4b6c222eedf14d52e85918341e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e9f42ab7bd90955af00376bfd60db3b

SHA1
5f432e6a3f5eb8f04c1ece86a2d297eb3a790201

SHA256
1c87f7adb86eb1be47313b683cea0848e84d5376f6a87210c793867ea8ee400b

SHA512
fac9d28e66a5476fcc1d74e338af86a213d36ef63d608ef26fc41535b2627bb1def1201cdd805c425367a615c58ce02555a48680d24dcf588d723d9066b0a820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72a3d39af66baca91e74db32df488eb8

SHA1
7210a8e21120d130f158683df9c1374c66c96279

SHA256
bf33f073944e3c31bc888e5e2a7ac72a38988379e99f6c70c401b0936384f68d

SHA512
1be888bc8711765f070f51b770ce47930b8530a53a36ed2b6785c0d8118363f6583085f76e431433b6ac9fd5b09da405f41fbdd44a05d06b56846425d8a92cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6592bc947939188ae04e830fe7011af6

SHA1
6b2107e2f4d915d1d296f086f591c7603c897a7c

SHA256
c70f1f6cd1413339491c6b8301232013f921efdd0e57c10cb35a7c581e99e732

SHA512
9dba544f934d1cacbe97a2fc71897b4b3e31974644d28fc42ddbe9df577e4cc2aa40791ffaac48a7e17f910261db8c76871b6379eaef52046fe2c4a4ef086c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22b9fdb7ac7f007a67a23d81f5897cf5

SHA1
0b0a1db76f76bbd3b2cd2943c92c43604d1aec0f

SHA256
3e9142a0322e7081404f38274c338e1f366a627c69b0fdbbe45e92cfc7f05440

SHA512
530aece09f61c68726c5977f3c10532e326aba552e804f89ad0983b5a45741a00de6a35da329ada53aed296a77e73f6f2fe134aaf3971dc0928a16109993c4dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17f774507e871b9bda2160064348f53b

SHA1
e6e5fc24cb161aab424272efbfc88aa4ee22f4ce

SHA256
7585b4806b7a3510fa1655b4f6f6943636be314b7d8674c3c4058d414577c908

SHA512
21486128a99175911991c5fddcd029ec371b862182035743b68a8a072e5c32f041df5dd319fd0d4b2238aebc5f7cba66289fe5b021a049f3c3ce6d951383347a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71bc01ae35743c629a6026af04890dfd

SHA1
04b10e96fcfb0aee314670334d83c7cb9a302019

SHA256
b34529224b4fbc5f83b950313cda5f9eddcbefb94986bf002783c80f570991af

SHA512
c80f62f4db6529e41577dab036b057643141ef734a0d67c15a50e68225547e0fc7736a06d692456ebce9393fd401786fb9080a16b40f4ea8fe1995687604c4aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0d07204a1c39eac6a52be7efe73494e

SHA1
43ad0a935f7c289a262d42dbdc34af264d3dc60c

SHA256
3726a28863d7c6b0656638bc3cb7f80e062d60dd76e3bdd8fd19f723cfcfd67b

SHA512
558a4091e84ca12e3de158504e1e33094e86c7d8b5942be02401ebf5aa8a57190ccde6f83216b8861bbbbcbbc33fc2f7aef89b2e44d9ece6ada546c469d3a4f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc527e3f42f6666cd3fecec331cc4db

SHA1
cdbced078445dfb4fb766d1547a3431dad05f3ed

SHA256
239f6ec748837482d2eebd15275889aecb97948d9a7b47e37372b0298a1a7df3

SHA512
ce9ed015f2f13ea23e1f7ddab3ee8f6922f122b48f94b112c7ebb542bfa175eb3cf894a0d100865c07569f22b1292015761dc7a58a13e1e748da32db12bbcba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bc53422c98e8eb344e4f90b4342e537

SHA1
b511c00110e5000199873e3d5ebe3b21ae857177

SHA256
16f3dbda26b54e2cce1bac61d09cbe032f7d138b25847cd3e98b4df46301e816

SHA512
21da3fd3b1959375da47b01dc579b3da608a5fa60b7ab0259bb1514fa911c4dee3ef330e0f479b1f58c287ff8b05d43a9fbcfcefbc02819cf4991380bfd3c415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c669e1a38a4e2870f0043b48deff2508

SHA1
217ad508f6997bcf5a3253f80224a7202972bd89

SHA256
e71d44d2e25aad18b202943557805a4c257b5a089967834ba27752c05a4175d3

SHA512
ccb0f9d1f939e0d28768b8b007bb463e777ad92b52a85781a30c4b8ef644a44caf1df64184f51fafdc719774a2bdd29ff57fba72239c5035b582947ea1340621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f829838092c8a18ef8460c2f9e31b00

SHA1
87dc125d7ef3b09aa831b5d5a47eaf1dde8b90cf

SHA256
7fe41f5773090630bf00145400821a31fe06afe865405f2ac96ffa1b11f92d83

SHA512
342c3eb7f261dab510d79aef75d7ab63033afa3f52af67f9fdab161090803e40847d2adc66f125f2c500e5fd3b0b23df4f49e32cd4235436db5f91ca101bef21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CFF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D40.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit