049d126f460e9a27aecea6b8f8584c3203672139358e3942cb90a3770466d5e8

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c4355f0104a44fd890df7c2aba0e3f5.html
Size

33KB
MD5

2c4355f0104a44fd890df7c2aba0e3f5
SHA1

b694b32f1fa787c161ed53fe3fa87ca32b3673e3
SHA256

049d126f460e9a27aecea6b8f8584c3203672139358e3942cb90a3770466d5e8
SHA512

f0d9883aba634420ace7872a98cc2dc1764d76cc2d1dfb1fddce1746b665e27435006b3228b63abd63f986a5d7792a2a02ea098ff0128fd9dbfc41f0a222ef76
SSDEEP

768:EfLzMGRNr6+38kxEAHosfQ28mAS6PEco2JD5:Ef9hxE3sfQ28mAS6P62J5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f49e73cf00f96835e7e78336c0df175fd09a397526251372815c5b257adf07a1000000000e800000000200002000000020b2161fccb29970931046cdc60254b70e6914876496197c89fad33faac9890e20000000fb329d049d911bd1276f03d1bb6ce2a92f2d25e84b948b8b7b54b73777b0fd20400000009fe0ac3a97aa93ca65add2e9f12b081d8c0c7f63e1e289ef5b8d0308c35b995374d34b08f343e500d201d609092d4b4828e7d9efbacb939aa9074200a211d134	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C318011-AC08-11EE-B7E3-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410648008"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000005bc1c9bea2da4080ecceae9ba74353ba7104a0623fc690c47015723f5867051b000000000e8000000002000020000000306f269c37fdd3b56a694f9fc61a4392e365f73fd270b201852c6994d23fec4c90000000bddef3e76072cf42ac79571d9ddc8e1348b68a4890f9eb8bb822ca95374610bbcc5e9646d7e1a895394031bd6b7200ef4f51b07e025c7ca1b2a074e8630c5d76171d1c23096e8224a87e31298bd19b4b7d0ef8de1cdcee8d57ee73494aa7c51a138ecdf270d1096e5a6e6e13fd268719481e42d552ba0c767d75089c903d93bb717f203866b7b734b1e883578421aab140000000c6fc56ed78a2a78e60f72c0b8dbee0d5c11ca10408612089ed6487e8e592da7d82a803bec306c3ddd92d0714d4062a13508ec66236b38b913e0ad6e4057cb18c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fddf041540da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2668	2112	iexplore.exe	28
PID 2112 wrote to memory of 2668	2112	iexplore.exe	28
PID 2112 wrote to memory of 2668	2112	iexplore.exe	28
PID 2112 wrote to memory of 2668	2112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c4355f0104a44fd890df7c2aba0e3f5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea360d9cc2690aab11ad615c5801a9b6

SHA1
8e85d8dc9fcacafbec3dafe6390cf9945a181b38

SHA256
eb48461692822fecf19594b634ae797c9e578cd7b0a31ff3677074ae6fb64c42

SHA512
d58c0dd8568d24f610b70dd76017eb40b19341d1ac35286ebdce95c53fdb8eb22bea310d238752126ecc40fcde2826c80b9d904dde409267009ee6459e4b3a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da80430c883b52c34996f4d11b3c75f6

SHA1
581ba2b0f627e4b8a6dbe66cff3cabbfb7089dbe

SHA256
730f85ad358fc4ab295ceb5931870680c149bb152c06100b18fa672b89ba078d

SHA512
d7c687bf340d9d1784bbc518a9f1626e7b0feccb32f91a9fef0da36a8aff4c86fe3421d3b57b05e92843b820bc7fb9764a2dcd8122044235620483282ad8ebfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e410170627acbc28d39b6e80a07a33fd

SHA1
ff2d648546e4499b7fbf71edcfafac97547dd4d6

SHA256
9d02fc36f10f1a2641b2dd4ee11a44731a4ef47505c8c21c31bf1fecdade41bf

SHA512
cbbbb79a97df40a72950f2ccb195bd9f593a1eb7262106a0deb365b6f8db75a9f0d5a854f4a3b0edc05a5acaf818cab7e999341dc62b8f729ed9e55d66e8ca53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd22bbaa5b2103591212aabbb5cfab9

SHA1
e13f25aaaf3dc0530f3bc913c371b6c8f12f0cea

SHA256
04eeb101bf1cda892dcceec06e9756d6f20bd2cf56d1e8a5cebd676fc7a018be

SHA512
7c84b315017c5c88a7a719b7108d82606e12c8f457c4ecb73a64b1d92f6c1afb792c2a6511c5c97f63f6a4aea61ed2e9d3904be0ec0565ec94721b9ca16a4a54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08e003d4054be9babe411a71ebe99fdc

SHA1
7b8f1fe52ab8fed4c4dc0e9ddabce9864bed444d

SHA256
1a2ea990fa9daddf1d7c9a5d086e0c4af4dfb6caf4dd1f510b11c52e20ca2898

SHA512
e61cdaab4d22cabc991f041fcc6ac05c6c58b3956e3fb1112275e4921a99f5c33ac071ad3c65bc2b9f4afdd2881d8fde83e780a3b8c6ff592009bec1eb3cb0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c2e21d7fb2b839d8e7d9f2004205ede

SHA1
146e010f414b155c0e0e4463224d1cab2a45d58c

SHA256
dd349940b01caf6875c12fe41c4f47bf36d62c50936cd8589d3e00445861b623

SHA512
a867b3ab70de238c0fad0fc844a5fa410d5adbaff1b3262e3bb3cb0f36e298148c2d26578e748ac216f53618dab3eb933bacbe2497b06de6da1797cae97c90b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ed349f9cc69679be2cc822f231e12e7

SHA1
1de95931ed0d67ad95c14f29776be5bb367f0178

SHA256
8a172869650309f768c908337af412ad3b51511334e918c3ffcceab166276a9c

SHA512
eb89f03dca9bd2a54f0874d13f44b50d9405153b7a46cc780577c2c1dbd6cffc821e21e3f1508a8536cfc405186e1f2e692f0059f42e556988178a3c13fb7d4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6a7c844512feeecbb33c360e6f8a48

SHA1
d3c767f68a4897424d5781813295405778959c84

SHA256
8670d6629f360efc3a2689e592ca65947725c07565058605638f830350cee8d3

SHA512
8f1c8a47feb14a5c6f8c5c06a11ba80cae74932d0a4bc97bbfe460998b0a9e52c5f0eb3ac48180dc664901bb7c63eb9ca63394794e23e09e853bf3041375acc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab43f6512d1c89552cdcc529da7f7f3

SHA1
936af2e2f28c271e13891ab773bea89d6a52fba1

SHA256
e88552c444b368bf656568d2133a5e397e02dcf8577127b163aa18ac423bf2c7

SHA512
540871418b4af36d3f04ba269116d1a91db6e1fc96c4d2943d082d1ea80bbaf7a2d9a541249c5861f7a7e1979147e53e58a3bf8e657adfceb70eacf707e2bece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eec5990d3a9cdf335d497d1cee35645

SHA1
06c10b66b9647e42e844a3beb74900cd859fc2d4

SHA256
532fe997721fa1078f74a9d5e86bb46f4d53f315d2398d8bc9182566ab4a1c7d

SHA512
5767295f6eb5595ad667d771c212fc54fd5cc90711a7ed70177dbf9dd8d8d81955e33ab024260ac00bb12d920876a0106d934d9da6468af606432c2fdb6a7f67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD43.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit