e0a6e6e71671e63a6f9756320704612f351e62e6ebe43d6d21d4f5c4d11f490e

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c53e70fb2613194da9f9c51089b527a.html
Size

6KB
MD5

2c53e70fb2613194da9f9c51089b527a
SHA1

24f3d2a46fd56f6913bfd9d998f0ae419e0bccab
SHA256

e0a6e6e71671e63a6f9756320704612f351e62e6ebe43d6d21d4f5c4d11f490e
SHA512

0f03c507a87ccff05ff212edb9f4d444bdd355f2015b9a303f37bcea78d3c1d1ef62b657f0fa93fc49b48648a66561fddaed37ffb0f655c20df3eef2d66a0179
SSDEEP

96:uzVs+ux7kKLLY1k9o84d12ef7CSTUoZcEZ7ru7f:csz7kKAYS/jb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000001abde2b37894b86bd0d8514c86541e1fee3120661aad057f21f393ddbb2c7092000000000e80000000020000200000006c26aeb840d5299a927cd9055f11cee8c046cc3c3700ec31dbe3224a159018bb200000005963379e72b6dcfd9c725370eabde07dde0b59592e074405a183e3d97bf26edf400000008e0af92d210a7a2d848c3d0d3015b56aeb38fbcfdd87dbb63da4509231c12d8f69a3c2a458efc67f1900729ea02a1894631c8805b0badc65178f97ae755568ce	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410357301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{440AA1E1-A963-11EE-BA32-F6E8909E8427} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3029ac1b703dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000723315f405f8dd0ae7a1ba196166ad39ae3c8f2fca79306fa39e09367458e7f8000000000e8000000002000020000000dc61bed740951365b5c445cda1f8d2951dff0a8cba566a202bbe11bcc8d994db90000000fc3cdcb12da33cf1c09f13878f614a3294f09f9583b06e8e7b953ea5eb2488e43cf642386b3c2fa203ab0dcea471f43af45fdbeb90c7c90f41fc9dc9e731ecc21f69ee85bbc2c8a7becfbedd60d83d6edd9f0ddd1a1e6d35567c4bd51ebd1effe213c8a9e2d99f24e222ade5c7f03fcc62338d1d64ac79cd8b3327fefb61c9e8a78243f115cf5bb5a075492b6f761a434000000042586f6c98d95cf610d00cb34966dccb1ff9894e855598f3076a7a17f0186f123a178cf7390eac693c196f0851d1ae50f03d477a8bdd9f93fe72894751fb1a8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2424	2244	iexplore.exe	28
PID 2244 wrote to memory of 2424	2244	iexplore.exe	28
PID 2244 wrote to memory of 2424	2244	iexplore.exe	28
PID 2244 wrote to memory of 2424	2244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c53e70fb2613194da9f9c51089b527a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
58e45b336669c92d828cb58a741e5c36

SHA1
29321b631022de235e6455a3e12f38bfb7ccabc9

SHA256
d00cd5736c91c972c2014aac48a286bb878a052b0f86c37381feb1536c0f5382

SHA512
2ce45e9797e3c519a36de64625086c8e982e1597163561bfe1f4a74e43a1bcc7c52f0315865baae166faf0a811a8d5f4c9b808cee8e5fb1a0f255babe20102a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ea66b336ae3d0cae6d15a05b2bf6ec21

SHA1
c7990f67da63f854e2edcdb21eda79393c7cb99d

SHA256
c8bb8b0c6519c2563aa3f79a1a876ad5ee6b13878ab940777392f640422043c3

SHA512
d5c03a3c6b473b8986627fb3123d802831a67afffa1276bfb4e5fa729e977f34987bc7477d9bcfc12285416932482bd1866a18d141a094c66eae496b2f7d071e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
526df6a1daaada5758a512aeb27190f2

SHA1
1e95ba20469bd1bf4230e87903baddaea85ffb8d

SHA256
0b28d02f29d9014c914bd94832a1b2d3e1c5f38b476d8cec9e684c9ee9cfd34e

SHA512
4bd99e5b3c69cee22eb5ced2e6ae7a3eb95d11e6f5831c5f7e77288b92994107c435a5f10b810dce4e0d0a6801522fd8c4fba88e7828a38b1d9b07a5da053075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
085f54f41d035e6f7ef7f00b7d3afab1

SHA1
abe4710038f74b55e72d140dcb72d191c6854665

SHA256
71afa1ad86f8f3a71a831d1562c40171460e11efc669b2d081ca7c410c9fbf2a

SHA512
ee4c0b6d33c8f53889f629ec7cfc25168aa48194103144b53d0e4b58becaaf8568a59740be661de33f3e163ad7e56070f788a2ae0386c536ac2efb8dddda5f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7ab51fd13492bebc4e09ae8e8a4fe43e

SHA1
a94a620e9800620119681828807f9df3c42b94ef

SHA256
0e5c4b0521eb594b8b7e91b76dccd967bae0b3328ea84b086949b3d0bb0abc93

SHA512
ebfa932e4adbf0915df75febc3807d93219e06fef89a131a15be0b0be54c07cba0f3dc29aa04afa52220c8f2db808fab5518f34455408d42c3b638a00d9ee413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0759d30db555dec4c63521ad90d95ac6

SHA1
240a80ab4346610e20244312d4b29b538f758b4c

SHA256
0b058bdab384be4ac38ce064283863742bd77f11130464a9f364bf33b622e346

SHA512
6f727d5954400d07aeb9a22d84d1f248a0cebe66f5af1b28d933c862f3d8e02f0d2a9ab8852d9d42ea30f2d34f8fb3d35427074b8a55f5daa033f76e77197104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bba0514e6e716de1c11761b8810b1b42

SHA1
381538f2d614cd9aab435b92da6d91bab7725b55

SHA256
9a59488c0f946cdafa0a9a273e259ffe631dd8c36d8e97ff2f286d7823ab0929

SHA512
c8682cdbcf9ea2baa79d11f572ca3e1aa9f71b9fb51fae296ed5f337e4ff35a00ede67e6082ac017eab1a3780e69d028f66fd12ade3a56c6b96db6a6036f61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar39CC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit