fdba60156d53660379ef547924c58fed68d4a073d048fd83dfc14cb771c29f82

Analysis

max time kernel
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

257649df39a72390c34119337e997f74.html
Size

2KB
MD5

257649df39a72390c34119337e997f74
SHA1

0b42ab5f9ecc62ba1680aeb7c528599debd8867c
SHA256

fdba60156d53660379ef547924c58fed68d4a073d048fd83dfc14cb771c29f82
SHA512

27f203d30b7ebb3578fae9bd5e995c783cb8d6cac7d8fa496440dd1f8ada60101a2c315885d0e96b2745eebd5cfbd4e87481b90c85b1b13f7619867c52974fcf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410603694"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF5ACB31-ABA0-11EE-BD3E-4EA2EAC189B7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000004e93771065b0dd336061f50aa003a5e684aba7dd85257f412e62bfe925d5b2a1000000000e8000000002000020000000eb74d94336f53e95ac1dcff834c09a73ef5e2db991c4d11860b6aa20ef302f322000000081aa5d70b34be414fa8b9c109baac65858f22ac19e0a6854f1e933f95114ba7e4000000001c00247ddb51182d998078d8a81cc45f336133c99dc0bcb0769482957e9a286d30d10df9e12717117db6cd41a678eca084764ea4a077ac9e4d3bf53ba47b215	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108cc2c3ad3fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000000bd0bc2a275bed9c8d0a8a5e1e191c1684829c92a8dd814ac9c964144a202515000000000e800000000200002000000060ee461537c6ef2a01235bdd295f0917dd31c0cd80e14018f3cfa3dcbf791dfa90000000b4bdf3f922989d41930fe114b72980fd01e5f2677b138b1e08035f79724425810e21232129b31ecf0036f1eeaac182aa27258686e1094ce8f7dde24ef1a6ebbc7b4d26d9f64f10287dbda6243611eed4631d1ece3c436ffd38058068de54d04ea1627cb4f4079ba5849e9696691e16ccabd80af9babf55e3614f4634dc4211b710f9bda2d1088c483475dee6224db4bc4000000061da343b502c75d18410770e7c5450d45f9b10231360a336ec5d78fadeb3f4f30e072ce5e8b7ef6c6b82da07bb4536145eed79aba18c2d8896722c60186499d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3020	2948	iexplore.exe	26
PID 2948 wrote to memory of 3020	2948	iexplore.exe	26
PID 2948 wrote to memory of 3020	2948	iexplore.exe	26
PID 2948 wrote to memory of 3020	2948	iexplore.exe	26

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\257649df39a72390c34119337e997f74.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0b88db29c0c95385b4698a0e97a52ca8

SHA1
eda8cc394a866a8b1a0f91a84a574ead74e79670

SHA256
06aa04f9ff2c36714da09a9b621fb9b1e6bcbcae7a1f58b856e812fe9ea0f785

SHA512
2705cf45a325efa630df901b6ffe698c406d0ef162970b7c2e0cae04243642b43a8b2434dec0e776f4cd2b8008c996d23527bbe5736ad8c2266a05b9570d1980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
475ebe23a57e095175e9f996a8d7083d

SHA1
6384fa4fb1470421af50450cfcb566a395f91a03

SHA256
e5314d485e18bcd8c6df1b91fc7f1a2750c3060a2a9bd706b0b274d7ede8e138

SHA512
b28f846c383619480abde91860a677199c08fb0c5d533208b086ece6cdff14232a279a0632a03be481efbda5317b2a2d8e49fc0c878990503579201f5dd2d84f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8993c66bfd5c73ca0f56480b541ab59

SHA1
eb2ca0129c21a5c9629f0b1764766232b03db5ca

SHA256
e36d0d43067a783f2992856f139bb83eaadce3c752d7819e6aa5031de9ccf9be

SHA512
a27ad62e47b79b3be7d503e30b7986699df980ffc5711f94d110cd76d93b8f2b80fe4425524c5c88668697c8e409e8fb6941b672bd8f152bf61f2c71fa04ed32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e5cb8f075a55440e8eefe8fc9a28da2

SHA1
6355fd6ac37696532bc1f7be09992f82c9b70117

SHA256
c9ccca7e0f09977110cce6ab4ebe34a8a67923d70ae34b791b1e1272e0a03b04

SHA512
29b08b57acc3de8616ca38dca62bfe8f4b9ddf4cc67c229f47a98c5861ed3c052a09c6d5c1db0e41626c232fdac5cf618ac4817709cc21d2ea95729854f9d813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3be9c1021b4516cd827da310f304119

SHA1
03040ab036ce1b14c72a00b1b23c63442b6e25a4

SHA256
b537b2a2401ffbfb912fb411f4ee8aeec3149741b55c2e9ca4cb436f00a02767

SHA512
69df73d8a650ffad812be35805e7a56f6f6628aea4696a55ab5a8d437348588582d0c1883cf491e8fe69466c1fea733fc74a6a1aa02ca2cfcab3e6484a45a23d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb7444eba4dbed640dc643e448d375d

SHA1
aa528f7e9f21dfe203c728e570fdd832b733aa2f

SHA256
d0f9feb7b8e9c77d7546b37dfba57b4f70c506f8f9ece3ccdc323756d5682a6c

SHA512
1223c8e420889aa0429a25d90f63d8d73e91fb8760501d5f7dcc44b10697e6aaf4e475394aa2fc6e30f26220a1d283b7ff711398dd842eef6a3c884cec48e28a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac20d4594bbaf4675364a0b4d71b05b9

SHA1
0be78fdfed9bd01aee20daf7424ea911676217e8

SHA256
540da0c6b071d5365a30e3a9c0b7ce9eadb342f3982e0d765f45b651283aad09

SHA512
3198cb54afeeffe178c8593c4efb73ef9a5aeb4302569eb928f87237681e84db9d63f3f1eb48b4ef8bf9e399561e9ff28b8f98b689e7df2a1f6fddd2d9cfdb47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b84c8b184dc8f7d9916074290022fb36

SHA1
4b0bf748a9cf63909af242a6ab858697c612475b

SHA256
ab66ebdbe2f2be42b5cdbf19cbb6e0037951e482742dc2ef7c8801d3ae60f836

SHA512
54c2b5616306f8f3a5d25101568539c9f4489abe54670cd2b152b0b8ee9905b253eb06f44bbf52e6b0321cf30157f8be01f8685fd2bde7593e4d56bb15a5af2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9883cfe452c92f366ec2aca777ebc365

SHA1
01934c808ec72b5c943cd8aee31a4a174ae76ca5

SHA256
115e0517457ae36ba16f7a9137d0ca5a0ea34acaa15452fb698b790cc7247f61

SHA512
5cf1024012ac6b9731fb115ec3e02e7d0177e93868711fe1cc8ae8e4993394c71d5f0c9aff8692557bf45be9dda17a6303282a306fb58908fdf151c5d58402b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar876E.tmp

Filesize
45KB

MD5
cae17bc9c5d74e0e1142b20a7889efdb

SHA1
cfea5f7d29a7dad0a1a25daf18a0cd4cb79cac86

SHA256
4d74c7d252b593f92d04a5538ff5688a4ec720ab664ac723512fbcfa3f5ab691

SHA512
42ba66aa767f8a15ce38f9e72990fe41e4fb2d7266e4334be0bcb7db7ac7eb38e7f3b424bb4fc5583197257e9fefc11ab19285f0881a054f338463fefb483dfd

Download Submit