349b814f0f25cb99849be0156f8c8431ee7ab94dcb29d78bfb2ed48d05e339c6

Analysis

max time kernel
117s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cbad82b8081725c3c6a8af6edaf06f3.html
Size

5KB
MD5

0cbad82b8081725c3c6a8af6edaf06f3
SHA1

fac74c85f3482e657cae54d2b959b9b654d425b2
SHA256

349b814f0f25cb99849be0156f8c8431ee7ab94dcb29d78bfb2ed48d05e339c6
SHA512

a61d7cf54cb508a3779fd818f876a88d23a0844c119a2ed069dad7280a01903604fb23e1d3fb5b4af0010dd30f46a6aabcc29841e74395e649bd0c2322f8174f
SSDEEP

96:rKkHTeB+xLCJcokBdrRGDf31n2Py0v/l4O1OUO8yOlOUeW5OcO0spi+69FkC58es:rvZxLgzkBxgDN29l4O1OUOjOlOUeW5Ol

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C4ADDE1-A743-11EE-8CD0-DECE4B73D784} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906f4df14f3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000080c20220ffdc34df9aa1fcf11265fcc742c099707df54251061a901b924feedb000000000e80000000020000200000002c3ec8af97babf65937849018ae5b09eac35723b2a86ce6dd3d4e96304e4f3ac9000000049f87f5050a0741ebfe10a6f1af7cf23e9eb4b684e75e4c35aae195c37539f62e9ad30e2ee288e720af07440d8623d2c7adb09d2b9342c49e58816b6af73e13c585d5714fbb92850e3ef5c5000fdccb53ef1c622356acfa9c0f703d90fdd25289dbc233a99adc03304b19d7e39dab0754af0eab7d634220417ea459655d7e5c25bb47fa10a2c1312ffcf4855be0174f940000000b0f663e6a42c036377850123c2c4b11da4ecee4192af44a5eb612b2bbd0e023607899c926134d157667e2d105b26441e6b9b2054739f31bdaebd8fd6f651aa8a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410123592"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000065a0559793a3100604451d288ab8c0ecbcbe531fa3c6ef127dbf29fee80f73eb000000000e800000000200002000000039e233613cc8c6f5894cfffc54baed153c3c1a935080b46ddf64acc3f1ca185920000000d6bac1d8897317d47104c9320006e5b59f7a0dd0371ed7a79826013d9db0058640000000dbd1f457a238a972dbebd7dab7cbaf8c4aae0c98bfaa5d1d5ffb31f6479b051a4cad9d46f4f3e4284ceb6d953f7534fab297ecb54c39a677782a54612af0dfa8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2620	iexplore.exe
2620	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2648	2620	iexplore.exe	28
PID 2620 wrote to memory of 2648	2620	iexplore.exe	28
PID 2620 wrote to memory of 2648	2620	iexplore.exe	28
PID 2620 wrote to memory of 2648	2620	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0cbad82b8081725c3c6a8af6edaf06f3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afd57617a64afd6c33116376ce20e1e2

SHA1
018aee42594c4d5654c88b41d721b60aa030b0df

SHA256
84d8370830dc67ffe07ab05f45b170e857b695f68a43f69e56e62fa5af31b7e3

SHA512
fbe876987432cde233805849a872cbcd8a6b56bf53fdd4315770f489940d020996c5dea17f291ca94584a99abc793cf41b3e04c7cc2208d63a9b5284cf5bb629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bf0a17a30158a2bfce345a74ce3157f

SHA1
c0f1e9352d04d641db26a63f2eae62787414420d

SHA256
98c7a4de937c3414ea29642db18b9bf5bfaaf5ea98af66ecd2d3097dcbf3e494

SHA512
69373b035533e752b9840f83b2656cd9b4b02cd60d3148bb9c2bf393455a64ee0087ce1ab3ee906c0a2500cdc26d0e31b71a2abfed20566792634d3dce5de9cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92e7d5777033790e1b68b160769d2c09

SHA1
6c1284586be4d37d39cae6d6a7051f913daf0d5a

SHA256
f6c7eb27c4b0efd70a85ac1182c43119ae5f7af316c1231a506a02436d04dc3d

SHA512
d2d96b9b06e9ac51f1a4dcb40ad2d6d0c5eb8c9d41d0ef6ae6f4f8acca898a2940f38039a9efb9633ba35278bfce99db8fa3fed4e6c2680f5372f668051f4e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ae8be0b5c76fa7a608ac69a0fe3004

SHA1
f760d874dceba11c7023d520505781ceef0475e3

SHA256
14595586c667fc60f830d4e89b10d3d4fe31e2d7f6ef73369dee4841bb5e409c

SHA512
9ac0af115d18fbbc1a909324fab01031e47127b3dcfa0e32f68fa2d89cb17a8b7bd548365283cc78e65150cf088b89197bdf4c03c6e676d7ecf7575e010b448d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18521686ee72cd6facb2b2960aa99fe1

SHA1
96d219f758f870be10f5a4822322211bc77693be

SHA256
8a3eee248afb3be98d49d10ad5ac8e9f514efb9e60b201b51bfd2b47027cd629

SHA512
1ec98fd744284075c64b5b06dd46e020c31621fe16bf129c18588a861b95ef267efd9eb58cd245473fcc1fea65c198bac161e41b12ba4f06607be98391e75b4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e77debe4fb49c6ef08f69ebea49fa270

SHA1
8e2d671b210c55ffd19a4098fd85ac40f16b00e4

SHA256
f79c2e6ff99eee0b9ac031a60240312bd881cf37169bff33f2ce872dce14bc83

SHA512
dcdbb387f4d1f5fd95cded63362dee28d580beeab288deaa97f0b62e943742ab054d5b26fd0f6aa6af44c99f0b6e3eb9c34765987b82de695f3ec2e06b89b01d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec566af01e970774ceae5b2b3e74ecd

SHA1
83da331c19739fcbe1d619e6b0def0f55042de61

SHA256
bd16083c63ebaa4e1b794c05f84ce8cdcd7befff61cc795851d8b446e656f2bc

SHA512
98187ce173945ce8b04634b2e38706e53657d087f0ca6eb7f53240ce7af720a40511c4c5656b3b67449cf3972b8bba0adbbb9ae7a8fc32500eb6e5769e868e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1aada9dfbd11704ae2540d9ca130b70

SHA1
56b1415ef98ac914b92357f71aa97e78ebc9b2bb

SHA256
22dd7ac36cb231bdfc402bcf2246e658f8eec6ae24e3e88b8c4d45406567965b

SHA512
1fb04da7656283c3b6a9bf68adb6714746037b25039dd322b33f5afa176e59a5f3988049e45963863ba1ba04b50d496de4cbdcbd85eaf77fb69c8752786b9afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F6E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA309.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit