e0e5191eb9d3b9f3add6dbf79706e7b9848883b9ad5773aab5150418622e3208

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcab7bd455d0d688c8b4590c20ed707a.html
Size

22KB
MD5

fcab7bd455d0d688c8b4590c20ed707a
SHA1

6b79002c8a2f8a1a0cb676bd9a6f2d44ea2bc5e8
SHA256

e0e5191eb9d3b9f3add6dbf79706e7b9848883b9ad5773aab5150418622e3208
SHA512

248d5c461f329aa34b1df754e64317a9df4e9c78b0e619debdcfdce9bd3b5d000c5c23164a756d83037f91c7b8a0cc0c22de6fc29c6b0a56601eb1375cbf18e7
SSDEEP

384:7IRIOITIwIgIEKZgNDfIwIGI5InJ7S4uzIRIOITIwIgIfKZgNDfIwIGI5IVJ7SGd:7IRIOITIwIgIEKZgNDfIwIGI5InJ7SfO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410999072"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ffe32b93822ae516043ed80581828a82a302fc31a7e2256b3d87b0814d25cc08000000000e80000000020000200000008a7b476862364079f50e1690f59f9610ee68218edca649b350ec5b16e3a8b249900000003f3586275b603925880bbdc6365f1e9ce8e17f415487c3a4bee5a86a4a4819f56113e3b5aac887cdc9e96a7994539fad8e476475b1d7a13ad72c6cfacfdf8ed505a3e0bc5406a1c69f245af8f5ebee529dde7c10551bf4070b5ae27b9e84841196e42a4c59023dc34b57fd33a7533e527c50c3b195a0567c756966e0b34529fe043f2e64ff7064fbacf2ef519abdac3140000000a75d6f411a47bded838e3ca225c64f8febb62744a3e7729815737801522e3b5aa3f55458180b02bbc896a0eb9279aa630f02a197c91751a8f4027b6b64ed768f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000076f3690f79b44fe95d4a38ccfada8c0b463551535afc6871450805b88d3a0ed9000000000e8000000002000020000000c12e50e27b2563779f7248339b98456ce272048e1dcafa3c733faff13470541e20000000eac96d0e59f823c1864d2baedd85065175142accbe1de5eb844352fa6643d7b94000000076d9eceec9a293b0b3b8bfd7cde995581d08295b255d5ba093b4291620dfb66884417999c3f16a412bef74c87fbd456183e10c42e08d1c8b8011cd7b1a774619	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ea345a4643da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82282DE1-AF39-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2524	iexplore.exe
2524	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2356	2524	iexplore.exe	16
PID 2524 wrote to memory of 2356	2524	iexplore.exe	16
PID 2524 wrote to memory of 2356	2524	iexplore.exe	16
PID 2524 wrote to memory of 2356	2524	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcab7bd455d0d688c8b4590c20ed707a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0835ce32ea9eea143b614b4f77472481

SHA1
0d6c51cfd1c0844e22cf922170eb3225b2de2637

SHA256
875197430d6b3ca3ad549d186aee1924bf1ac3e332a4c0dadff85ff793902112

SHA512
4245255bf406b7a55d4b358593be70a8cf04aaea539a3492fd28b45b7c75f0192c6517582ec5aa7d32af274aaa50e10ec04dff0bf18d640746927fec62877837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe61cc320a56ca0b7e4efc5af54f3e41

SHA1
f1f94ad227aacee2c167daffc01f448550df64c2

SHA256
df2137439bd2fb4ea78a56a9ed28ea4f8cb0e08d2eac8094b35b1178ecb88a79

SHA512
ea1adfbc3385b1f3292ea4938de04e37f98d9c5c5b5fa2ba83f0b6ffb30ca0c370b0d4cb325caa6805ee3ed8380160f67c79442f817dcd6c0a551b057133f378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba3670fde2d3add8f276a4e06262a7ec

SHA1
d4ecc6eb12199c73fbbdd3762940ee4f89f7ec89

SHA256
9b233296486fac42c987c9f7c12834b80310288c635ebbacc78db455177e1bc1

SHA512
dd64bfa7ca6d7f442a63085fe263f0aed1f76454d2329469792d18b913da1ad337fae4c82f0c4b2f3c905e3c9a0cd20f59892735327eb9f3ec6d64db36f0be04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f2ac74b5c05da1b8774beb6fb3cb99

SHA1
162a335d615e70cba1849939b3c975bd870a2166

SHA256
9625cc7a0b1867b349c346eefca5f8c647c04631221cb8148321686e52669a55

SHA512
e5beffc176e1baee9442149c192f67a76843a899dfc7ae5744dd558e6150174d930ffa978a151eac09626fd3f715e97f36f5bc73a5d6206a008072a8c56b9c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77c61c31ecb02f989aef1a72b2e9a500

SHA1
a71fe83a4209196dda019a5195f2b21da0eb53b6

SHA256
96056a7cf06c3f01743634421aedd77640fd1f47de7e03cbfd9ac94c66ffb5ad

SHA512
7d3e5586c2f759607c0dd0ca96971a9cb69e0cbb572abbf1bd421ed89e1ed0507545244efbde7342800071aad4ec3517c69e3cbbe2dfd4130700be3b962e18ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcf89caa4e43bb5cb33fa5cc5e55e434

SHA1
ea9c2bbf20ff61503b425b3dfffcfb0ec159c4a5

SHA256
53d0d37b3dbb00877c30c27747e415e1c0d055dbb5a81ac73aa40bb53c02ac18

SHA512
f0bda7bb91f45210af955f68de9a8bbebb56b84c320466d47da37e54133092eddb3179020cc42fce0ba8f5693156d481993ad92c911b7139aa58dd43468e03e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3bb3ffe0a98860bc319e4e16f904e4d

SHA1
01db5aae1ca37692b1e41a509f3d71817fd1c7b7

SHA256
7ad01ca789d8c8180747934377597a078044ce2a91e99f937ce0d0e97efe531e

SHA512
2a922ab73da4c1900f89b92d8a38c455b4cc3ebe3ce800b6fc934d9ae7c53dad55d9cb476e9fc513a51fff9b5f7100f68f4973f26e3dd345f7f30db1c8425ef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35e3f8638aab461986576ca04037852d

SHA1
caa3fc903e4e90d959a3f134ec7c8f5f3162b35a

SHA256
5050829b3442fa454a509a046dd4a0d137bb569ec98dc6bbbe572cca7ed69140

SHA512
7048a30efe669e3a95e070a5a5fd493d1969fae89cd8b3c27ae5271a29e9a87f83b65cedf9bafdf464095cad3b732b53af414367955a41891dd79ffb1bf94f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
884ba0c9baa32d994dbfa5ed2d928944

SHA1
a69e8abc34aa916f82dc01b1feb4d7efd9c0d460

SHA256
2f21a68ae59e76a0cb0d64ec3311c6b8e63dfd88fde057918da6257c3522df3e

SHA512
2435d4d4b77aa184f7bf4bd86fdd2c4e354e56ae9843e449d575b599c61b692f1b4aa7286089bf656da0b0c997550d531d1699b96a9d70c10e9f712a14aec0fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90a7f92e09b59d9627468fe9c151290

SHA1
4a45010fd6696a6d114cf40846de9e253f46b15d

SHA256
c85f039664026af90fde4c523f73db256eb5c6c698a43cbaee5d93d338a0f843

SHA512
2cae3a54ab9d48f5fb506dbfd8c23a39b41194f3fb4052b536f0beaf4a43c4f6327258e6ab069936132a635cfa3e22a796ed847649f6bcaa96c8ac48e5650daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804888f00981ac8473856d9b7eab758c

SHA1
64708e61d63ff0d8607d0c709c14a4ce94bddb60

SHA256
678c849f751b59d989750c11b3b47869514a312e32c099ad75aef665a8271ca5

SHA512
83947ea6450f599c6a86ba377a6cc3d8e5e521cd6d4a9733580b0a4acf458ee57dd2048cd3a972a06fb5daccf028faaa4a1073611ad7749a0dd3f1a0737c753b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ecdb5630b52cf8d5ee43593aacad815

SHA1
f43dd1bfc2955c0f08062e0c931f9952151c1463

SHA256
2b16bf71a8e599b531fe4201a9bb79c2d0008a995ec06158f8587ac65f697afe

SHA512
c936f3ca1262a89d115bf0dd13f2caa5d9009ebd7ff755463a6d6c6af0a2a93f740aab3bd9ac438586723c620d0121842a4612a3ec7e2cd234f648d160df3f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eccdd55728216c2bfc112a1a61aaa64

SHA1
7c2c311fc58cf404ff11c815f8b5cff336b9ad74

SHA256
ea35cd3c8e4956f3280decbf475fc439fdd19cb4d36796bbffe9fff3eae99683

SHA512
b54c872ee61e8432ae455a737305567f9f5c95f375c489f87442643451d3a334bce235c36442dfb4d643ef348fcc7d7ae0c860bae7d972f42cd7f17d60bcc8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6babfd9533880660eeec41bc26942015

SHA1
4a2b5b649de3369982e25ad6a43c71b0a8b8c4b9

SHA256
ac1076a9d3898c840bed652cf9cb50f41c32980a72a7bf616c26993cece0d248

SHA512
e42681e5259435d4be27bfe3e8bb143d8ac54ca097b258cecbf96415c8ea329cdf6adbf722e4d44e2c6ab8208c4997cbad303ea2d6da58e0fefac886f30aed48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00795b2468e97ead7ca68396c3dafd9c

SHA1
5fe0b39c36141ca5c123ff80f4162c3d71f68913

SHA256
a56ec9d0055ba571a32aeadffdcfaf729f8dbdc0826421c21966a7b20e997c44

SHA512
bc32b1b748f7693323cb0e982829882d08d65a8a5ffb5efe64b041316252ddb2d88ca52151531b6badf649074d8851b57e1471946b8f0fbbb3e0e36b4b10142a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd8ebb267238d31efec1b16fc62b8506

SHA1
b60fa8ec77b167d5c2806809995ba3c842594c90

SHA256
5295024683867511b542dc8c949e48d4c6e8b050fdaaf9dfcd0980eddfd0f43a

SHA512
b33dc87a5fe83b1edcb2144f0f1888217bb8975b62ae4923b00ad25953e017f6a0498207ab03daebc33d1eaa84141309b0aec0533df3c7fbbc63cd9b208f2467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdfd1003b4e5c07aeb3b73792b363b51

SHA1
0774fcb9e74b8cf2241a1433ab49805455078dcb

SHA256
663b65e3074a39cb82dd5a688552d26fe24cc7a2462ad0d048cbb8e7ad59a9e2

SHA512
62e600554827aec94bb50fbd335bbb9d4f50b457c175d1e05dd80d5bdb691b7ffbf5dfdcacce692c4dc715e0c2c1fdacdb5912517b6f845f889e9d5db673a7f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7189.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar737F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit