6c1d6929959dcd10b216f62109b2018634e03252b4e734405ac046c7c250f396

Analysis

max time kernel
142s
max time network
176s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c1d6bbea8a52f08b66efb1d41bb0768.html
Size

2KB
MD5

1c1d6bbea8a52f08b66efb1d41bb0768
SHA1

e2cdbfbad7117e30b6080fa9e4fe893c416d8c5e
SHA256

6c1d6929959dcd10b216f62109b2018634e03252b4e734405ac046c7c250f396
SHA512

cadc2455e0d6b06b2a4868675198f886623e12fec13ce20c81787096c184254f2ec06b718c34d9826e10294fa5f54cd09bdffbda0f8bf7637588361ee794b8fa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f93126779e6eba4dbd70749f487ada4f5010e7581743cb183d1a5e0735a10b33000000000e80000000020000200000009a4780aa64a05e8dc4d09b87594829364d1b7bfd496f8fee0c80cc66c9907728200000009698a21881bb17fd204a6baf063eef939eb31b815de3a8a1cb337525bc8b9f0040000000b7aa09044da81b11a8334478d784769e894a66dee1d353f8af0f69942b5484e3891e6c74a0a3b9bbdc9f5e72acda0e1d31daa4dfbdd9605cd4b6781e5f7b0448	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410510882"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40445fa9d53eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f5a09df2f0b90b5776bc197c55e9623cf4e60aa1ef0e6a05f039f5c6446bb9fb000000000e80000000020000200000002c1ae8d4d36f2129a82536aac47d1b2ea5cd11ae0f9cdf902c1532f4c20a216590000000a5c686c31ff9b28d9f32d53d1dbb210f665fad6996be53ea4c4898489e0d4c980c7b15e7e0421a4a784b710201fd285c01a41ea89e8765932c99b73a18cf3e7be72fa4f7b901c23a9ef035d342d92639c6188946760b74ef806b0d6492372a96bdccdb2d550ead15788ccd2bb4bc77896753916336a22a6b9892b2154b939043b2430b326929b7a76e9d28dfbe652cb6400000005c4532eb7679e8b30f74d1689351f9bbbbf20a1c4b38e9a45efc69fa02c1d4dc78eb2b1505f7c46cfb1d45fc7f0357a5c8151d732d8bb4a2f08ec09e203aaa8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4A9D890-AAC8-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1056	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1788	iexplore.exe
1788	iexplore.exe
1056	IEXPLORE.EXE
1056	IEXPLORE.EXE
1056	IEXPLORE.EXE
1056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1056	1788	iexplore.exe	30
PID 1788 wrote to memory of 1056	1788	iexplore.exe	30
PID 1788 wrote to memory of 1056	1788	iexplore.exe	30
PID 1788 wrote to memory of 1056	1788	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c1d6bbea8a52f08b66efb1d41bb0768.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1788 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c517dc6297bde6bf785f0ee54cb5061

SHA1
8400e4b862406268953178a3e9c0770525ba3155

SHA256
8e34ef0dc34c430afb71499c9e7c8eea033500c4723479e8cd5639951c850f99

SHA512
1b661db13827b627ab1d49cf658a1a61bf78f058b78d95c1cd7ee9a691615620e9605d571eb7cbf1a76d05434da842eb1fbd20798224b5ea8f8c0727be7c91b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a64a13718628663ca0b2b9c5c33ee850

SHA1
e2576d07c1e752442a07129be2f224e4e3368cd1

SHA256
67323a025abdb4f4f1401fdf40e9611e661e156eede528730ac1dedf2195b7fd

SHA512
a6ea4bb62d272795e4f684b0b3b60bd75214a7db047bde7fff679b82a81cff953c06cacdbd1aa987b4c2f40ca802d07abc278eeebd7e2229efbf5e6f5e6a50db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c31c797d50cc76d88bdd35984dcbe90b

SHA1
eaa707a01018f271cddb527b8cb5023d07b1b5cc

SHA256
ca0bb64cab56c4bda89e61398a67fceb3a4f20f50a50eac383c658a382fae590

SHA512
f90e39834223fc55e9f65709823e343f0a342f8df8eb7f016f658bdb0d9c5646a72a95a5c612e81c2f739fd323efe7478d7d0fb3f43d346af071db7f963ca5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd7df1078a8ef5c555fe8aac53f8eacc

SHA1
b40627cb5c01c66dd6c4705989ac3390b36b2e3a

SHA256
0aeb35506297b52499d08a6d9e8041ebf08f40c3fc75286950dbf51a9a1290a6

SHA512
6f7ac61139a35894cc38945bc1b921d53fa28122801bc19f54712beacb45d13e3e49f90f0996f66447634cfbf60bfecffe4a639bcb5f93d71663939a42882388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
248e8bc11c350cc75dda47e136ce3b28

SHA1
3a827147d541c69e82b7a8e2489fe2ce882e96e5

SHA256
f8df5b7d6f8c547f1dd05538ffe49336c358770eb699607d4b9313ad5fcb6f10

SHA512
cefe1e314e6e9512e5c1b4e8cb4a58b937bae79bfb2e1e5c2b4624fff5d5fc3be928afd4c1dabe4d72360a6f6dbb4e95846ebc741e48495782f3b7653c6689da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65814cb397ef1423c93a7357cb104a88

SHA1
9213cfa03f6e4cc0f3006d649692571374502163

SHA256
c6421430013a495501bde67ff208469d81111dab20a38464a45dabe0b9a8d081

SHA512
762f3f6653924bc3ad17fe89557b68d698fe4efc73c7624783e728738a89bf6a71b855cb04cb35e89608b480ee8f5ac18e275244d6414c7b356b59dd8c5a8914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb94c70e9ace24814a63537e3b7d7cce

SHA1
5bde3fe54d9b9278bdda98d09e90645fa4993b94

SHA256
d92b5df8851da5cce652ac2cfe567527edc127b728b858de0409b60686ebf430

SHA512
971c24c505630655b465d4777b1d9732e2c3d71f7a371500c6aef12cf205f92f2c45144ff19dbac0dfca435653c550e620250d6732671a2779dd4bee42c55be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28179ad2ea3423702f61c50dd7fc7a90

SHA1
37f9c4760b17ec792003639a1851274f9a809876

SHA256
925b8773bf51ac78e94d508591992667919b9f4ee8c87f7548a16f13d019ab66

SHA512
f058076edee70da6a6d50828f7d70d8799d905892fe455e0bca739b4f1534cee6203e01fed5cbb4f37f42fc15f52fc1513e7aa239ce246ab012bd9212888aa14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31f38fa4a41b6e0e27d078f1dd2a064e

SHA1
5c1eb00e6dceba369dcc917719b27bef2f6c55dc

SHA256
6fa9b24d5468131d8546570fa6d773f2d2d4d932c1aab04c83a15d42fe500fbf

SHA512
c7346e4906e42789aed183459df73a3fae449e34b18a73a224b244d4a0001ec9c6fd987f45c5f4c7d259a514ce1467d29ed573d4a160ecd714bc929896bd9346

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC371.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD12A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit