c98df2895e6241935b0f880782cb8c6b88913035f592d3531850087ea8f26725

Analysis

max time kernel
137s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdc13af0ac5024b0c2d8d0e3705ae6bb.html
Size

314KB
MD5

fdc13af0ac5024b0c2d8d0e3705ae6bb
SHA1

4fddf5b8cc61d6a389e6507f217c19dbf93475ee
SHA256

c98df2895e6241935b0f880782cb8c6b88913035f592d3531850087ea8f26725
SHA512

f22d3462eef0e98f6acbe733f72c41d7b3f622b7ceab7b09966156aa6118860c4c4b29ef48cb6c7de08eb649ce43290f213925c79407ec88f549c89ba6ddc191
SSDEEP

3072:JJWwys5uBZg+WJhIczPdYA78jrz9SdSVkw5OTgGT8eF4dZQ/i/Hc+TIPQeXEJFfm:Gwy3QJhNJSWw2JT8QuZQKE+TI4eXE/K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000070f082c737c4ca8ae3ce667f89ff2e1968b7d844c98ed1912db1a45a3ee2a900000000000e8000000002000020000000efa36f781c6a13ad457b1088ccfb6ed2986a79892cc0640d4e71876fd3eee4d590000000ae35cbc7f027ebf6b246181a612d3daf45f58c1294aacab85799db1877298683db50eca42c06229713660fddcf2e5f5039c921bde175e5b1b42d702adbf6d6d9c090d5d2620e44b3c4c52d7280536c7be668e1fe7eff3f5e68190973a90690468054345da551117f3a7560445abf55532a9e5ca063b65a80dec16e7c45c8a5496dc22ea082f4bee61728dd7886121cd94000000029745cc2ac31d55fbb3a1c6abbb0c8dc1e2203e3ade6c60394ceeed849729dff29df4f6f47654c3a054e535db1229d68f38a026391112e2869bc223e66653974	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0de447d4943da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411000420"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007448baa97a14f13ea9c79c1b9bb260fdf47f74f5a6d5b6499970146fec01fdb6000000000e80000000020000200000006d488211ccc2fe64f2a647b3186ba983399a78b546fa0154e41194340a0a301e200000002a8753911bda8ede1974cb633202d6474dcd0f20b2c10a9594766b2daf19a8b940000000c4b72076164e9a0aa7ed8f42699dd1a2f4a96506877c0c3414c9c51b151c0db63cce704b1f1204893d3423b6c827476543986358cc0822a5ed2f7606f5efc3c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2EA4A11-AF3C-11EE-87FB-DED0D00124D2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2404	2212	iexplore.exe	28
PID 2212 wrote to memory of 2404	2212	iexplore.exe	28
PID 2212 wrote to memory of 2404	2212	iexplore.exe	28
PID 2212 wrote to memory of 2404	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fdc13af0ac5024b0c2d8d0e3705ae6bb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e674bc665a11529e4783839db85c094a

SHA1
b1a0180de861dab202d812d81dfa66dc0daa0527

SHA256
43578aa6822c619b5b590d9fa1936043a3f644d494b71fd28b2485a08e2cc47c

SHA512
fe9d59bf8a1f6fc61c9925d84cc32607c15dea49b36359a900579478d69e4688558673e564098b20d00002f48aef5b152f7f3a3263e93a8100ac5610450278af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
827769bcacc7f6c2bfd134d35a4fcda3

SHA1
30a21c66e967b6ea4fb8f7c4c37341e5fdb0765b

SHA256
6f8224988e5b262e9ab91630702ee0246aa303ce7493a0c1ef92444c0e0c6ceb

SHA512
27be1df38606647205cd1ab56072be8247d8d43371a3e91da2d51262b43ebb0211ce194f3802ce6127963e9338bab33deed114286361075b34bbcabe7b12eb34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67b9b533018318ef4b70730612e9f01e

SHA1
31b5ab52b416c6302c9abb72653550baf145bdc3

SHA256
7f892f7419902fc5535190caf0cf2a410549073786d09a554b1f300aee92c8bb

SHA512
789e73492ddc108035524b12bedaa46537c7720298dd93b2584720acb8ec917926bffed23537a0cceef2470f4ad0bea78ff3d33a2496f3e5c989d49d7fa73d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4d00005e1eddb7d7daece3a789f53d5

SHA1
d47a6c7c9501d97b0c0983f12457c61e766298d7

SHA256
2a2f5dfabd5a7a16b576884525391e389a6cccba445d21937450ebba4d7190e6

SHA512
0838d9b2567da04c4178dee29fe4382a08df78e058126a11ecfe33bdabf282762036df83c0b8713dbf32b746d38a3a9153e1ca7c09ff8ee6da63935bb8c1e206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46e23cfb22c33dc8c8217a4c2f1fcb36

SHA1
544692fb38c75e7eaeea044f9192d9f371b6860f

SHA256
29f745196edc6571f87cd3a6a3b4b483afd2c89d18670c6b89b07874fe432423

SHA512
5aea089856674e5b86ee03f7213cc874a897df97267c15d01ef34f5bb763554bc64029bd682f1d280d46ab5ff5ac0fd9812bf926b655eee076f5c97d53541bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53d785a98ba7536572cb50c9e00e5f02

SHA1
2464750ea4671f0aa1965011f8694ab2b2d8df37

SHA256
c28d1ea5f06d1571533c7d5950889071ae7ab718f47818991f796357bda6a579

SHA512
40272fed3bcad7cbd17c36847bc80ba93b1bc09bc2d743ec2ce883469ad5d8318b246eb5f83f3b2eaf4436fb4133bc5ab3286ee95ffe075b62c03975241ddffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb398b5f1b2f99f8f0c2ac008edb4b5

SHA1
195646ba8600849e728f8587b5219a457a05dd43

SHA256
5f7ae1f9b369209861e5ea5509409b5d47935d585c5aa853b62fa07a5c527cdb

SHA512
bcc4f1970feb3c4ec30a55bb6bb3d77e99c7192cbdfeba44ad7bbb13e440097e2ca98d265ab545254f6e9370b80bd0584e7cbc1d57c1d0d8c6b548cde38594aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6001.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit