0b50ca0f727fd8a6908794dbc2db3b1e01b447541609654f019ed711b6035038

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc5580401b2f408ded870fc478f39f5f.html
Size

24KB
MD5

fc5580401b2f408ded870fc478f39f5f
SHA1

8a0c36cc0ee3b21107828b81061a81d865ed5c47
SHA256

0b50ca0f727fd8a6908794dbc2db3b1e01b447541609654f019ed711b6035038
SHA512

fe2c2551d689c2d956787efb531f1a5187dfaf31573985ae3683a1569e7322b04a71417dd71381163a53369612f3c45ce220c11e7d8ea855ecb66cbd8c6c0c79
SSDEEP

384:811bnSPxLuPglFD61hlR9OIh6i42MTpbp/sSk:8PbnqVuGFm5R9OIh6irMTpbp/sSk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f382a6a9286abc2bba30fd9c0216948fa77fa2595a82f0ad01b8c382162525a1000000000e80000000020000200000007ba64b04d723864fff10002af03b12a362c07ffe0d7680126e84d782235ac33e2000000010f009bca31a15e86f07ae2e5a4a04d9b44005732a86644fd8465ad43417c4b040000000afd4024c795ea8b6b48df8b47b4130d96b5110e59a46d26f444a66be5cd17bc0181e0a68813446ed0c388293a1969926f5ca7fa9a3ffe12b676c962b4ebdf2a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEA9BC41-AA4B-11EE-AE81-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f092af9b583eda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b5c598bbedbbf2ee350d41e8418b8cd2bcabfba7bd344520067520e0df1267ba000000000e8000000002000020000000c192ec8c362398a9b225e1a0a7663d50700a9f6d6d92832c569ca91b578832c6900000000a6ec0b4c65c151ae0010ac8cc6f4009f8194cf8545e8e6a8e843b918c6a843d19aadc292794695d6f011fbf1079166708628d39ed8e523c78a4fbb137dc0432b49ac8c3d94eec4ed6502f0bfc464d5a0b61d408390023148d8707edfb4be2593ebffde62c6fab7eabb976fbe3ddd6b15256846cd377065776377bdcb94e6eae5026a03f743d7bad0a335fb8a9f15546400000007e13e231bfa238be64f208e975cf9cf7a0e92dab3a1dea2dba8bbb8142982f70c30537ba0908f53ecee283ba37308945c7372a9b11cbcf95212ebc2560fa95fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410457151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1344	2444	iexplore.exe	17
PID 2444 wrote to memory of 1344	2444	iexplore.exe	17
PID 2444 wrote to memory of 1344	2444	iexplore.exe	17
PID 2444 wrote to memory of 1344	2444	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc5580401b2f408ded870fc478f39f5f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d669d38abd37504453dc2ddf348cc0

SHA1
cdac34825224369d7ffc580ee49ed90573f56420

SHA256
885bf02c800987fbd5d7f05c8a8d10fe0d83d590ca88efc19ca368b6b40005d7

SHA512
0757f349f9d52ecdfca31f8af7560938976753bbe6340db8570d43bd4b7bb49e44df1bd778fe1b5748f144a32f4e7f83cdb0abdf68719b1dc565b2f6ea2c36e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f28faea92fbf50566c95dbd0677f93

SHA1
7003b01075143e906bb14227c2cf4402ea79fc1e

SHA256
542e450801e203ce702901fbd435224da6fb63930fcb18ea8ee86458832ccdcc

SHA512
9053ebc1cc2049ed0cf7dbe2d4156b7e1d43b11c20900ba1977b894bb255561a1871fb3549634e0350410ca8de0cb87456af1a102c9ce6143ac281338f3b66a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fe6739107cf597ba19109eacee004df

SHA1
70bb15ae1e672b83cd8cff04cd4c10c27490e91a

SHA256
9d5a7fa9b3f671a07807dee8d7bda598f713ea6ef6282198af2d52f594266ccd

SHA512
703ff82927d262c1af04828246d7d69e0c46e9b24e81ce946fc48ccdc54db040fd7ce1446cd4bc0fe69e2e3e100fc7c2147601e16561c33676a245f4c970664b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ab1ad3048362545e71ec3461e5aa7bf

SHA1
9164bc7dd07d8fe21a5c5e961cadaac45f7e54ba

SHA256
9bec45c12b4245278090f8c71eafb6e4451e8892129c1aeac955561d9435d5e9

SHA512
90665babfb6ab0db35971cd7c6acbd3d5ef798b21e183101ce5fdeb0b3f156357bc86d9f955c2ce27af4c3d26d3cd8d034619ac543417066ac54624fb47bf8e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bce3e7104518c0e3d177587b91ca5196

SHA1
aeed916f1944adfcab37fa953338fb8ca4a9071d

SHA256
c52d04d69feb19a1227fc56f15a1c4a561d2bba4363f40baa4930920e65e48ad

SHA512
3bf1475dc408480f66cd9ec07d4b77c130e9468898fe6caa32f89a20e994aea36c3d60f0e846327ef0dc9ee5d20bbcbf2b145a8ce00ca66fd24e0edce60dac6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
140a69f229411adf7c5d4944c796fdcf

SHA1
51c8606e1eaf17d531f84c90161805323300eb72

SHA256
a7e2f74e0f625f2ebf23c5385cb0b59e042b403a0e33dc942872aa02803532ee

SHA512
ce0a5dfaf4ef0a2a2f9938cc7cc8ec5fb71080c0f2417be2628e25cc957a631d0aa108630bb628a126da9626378531501d8663d7f0767625adb4740a9675f30a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d08ccc21c34ddc59661ce3ab59e485e

SHA1
77494c82ef81b5fcd1d39d8e8052e8e94fb33a8a

SHA256
6172f2b895cd761b1ff04c7dd1b219e9d56a30fc2efee7a8dec863793e326189

SHA512
234d8fce461fb10563fee5186e43270694e8e85b7ffafe5fd4ff3d26a725b0951f6d9143bfaab3bea259c0181c3e0d8e5c583b9632704c3263a23a9ad26523f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58b2da455111369d69273a8a8124a771

SHA1
a0a4250b8db80dfd6bc626582fbcffc13e70f649

SHA256
5dc27ff4604259f86dba302cdf12e32390c2c046a3cb884736b94f10aed8e4ea

SHA512
0d3fa6dde9c6fea99d89b8f211684196ee1cc8c90f82406090fe8148b33f640d50ee573d62c05617e3befc1f38f2caf7f9cdfee0f2fbf73255ea9835f6f5594f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf2eb101949951962acb922deefb88f8

SHA1
86fd1a10b962fd664b1f97e04be03799713738b9

SHA256
38205fa6ae96f07ca535fcbfb2d1e6d5ece37d72d02641cef376a17cc36979f5

SHA512
7969875e54f44341e5ab813fc188594f64957685f90e72c3ec14696fd27eec4bb1d95432b7ad246c636c6f380c60854e2d10c64437264abd280fcb07376d8ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
909fdf463098a55ad22c58ca99fe28eb

SHA1
ddb67096a7acf9fad1608a3255f7efc144bb0e57

SHA256
49a0be2c42d1e1549b7d9f0b52b745770a14d9bb04d52b5f59af457404431855

SHA512
df7f89e512e2f74f8a124de70f159b5e959d6b7f4fad7b769969576bc7f1947669516018a6395565fdb7210ddefc64849d95be48abc5e5a26b3d3462bd749a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab121B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar121D.tmp

Filesize
98KB

MD5
371aef904c2a44b47aeefa7c5bb3312d

SHA1
b1058296c351474166e45ea27423122bb191efc3

SHA256
0836be0716e46b765bc8c79b573e98af6e058dcd5ef6a6f38e29f30b7ad77ad4

SHA512
8a40153454ad5319c7e5c6c5e6d818a483bdb3bd4a7d250359e8d393ff87378a384ff007a80ee9ed76243f83a7db1662f3b0d5c7debfe704fff8e724f7886812

Download Submit