cc0311c2dfa53fa609edd3a33e9e13ccffcdfdf78c6fde9470f12380fa60393e

Resubmissions

02-01-2024 09:01

240102-kzcf2sebgp 5

02-01-2024 08:13

240102-j4v9aadhhr 5

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-1.html
Size

440B
MD5

e64eb72319a812d749557717ed74e5de
SHA1

1fb21c5e16ef9f64f53477ad25da123d39dde493
SHA256

70d3077bf35ab11b546fdb6f8980fdf8385ccf4dc40ede3d6278e3b00adb94f7
SHA512

b60a39151f5a627ec475c6aa35a39d9b0e58257c5f6a7da4616b04a173493d9cc776912dc80e17547ea4855f56fe273af9978fe6940e16f11ef95ba88a816c20

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410345115"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000bf2f50aea03e51eb30e4d9704b603715949dc930624e84ab830ef0912567c021000000000e8000000002000020000000b2393e19ea263aeb5a06852e26d2149b3abdff87924ebd4874f877cf5b1725112000000049de221acdaf239c0de774b47a59e7f7c425f47c6886b143ce234e297b6768b840000000fcbddb5423bf59875f1d92d1e25bd5c52189829ba04855ce31177d6cb44f498671205fcdaad997fcc8a8caa74b97a96de6fa1702c89f1cf02472b5c4a234b1c3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3013ecb8533dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000bf3ff62c027c8892b6222a8fd9a52ed08fb0d0bac35c35940e51fce7374295a0000000000e8000000002000020000000a4d8945ae916871fe99bc0dfb01bb0acabc5c8462cc117da028a70d84968c79c90000000bb1a9b84533ef5e31eb0689dc9fe54ad53762ad03d25792a9c26cc203da56cf8604186517dcdcd6c1d08cfc6e857017bac87c34d9afae36f1a2ff8398828a6d264ad4b9481b9bd440843f1fba8692f208b030446375afb3131b731a3c39f0b6ebb379db2b238a88420175b7c91eec7acbfc969f6cf36b78f83844bee1f98cbbb2b60153181cd0b5ea09c1b12d4dd582440000000942b5afd6a6ed89f7dc35e1e28aa798e00e8c3a9210a4d94648a279357b75e1d77135b7eddd54f10b23e3852e4eb757b88495d08e981688c37fe284ddeca3de0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E49580C1-A946-11EE-A76C-6E3D54FB2439} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1820	iexplore.exe
1820	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2448	1820	iexplore.exe	16
PID 1820 wrote to memory of 2448	1820	iexplore.exe	16
PID 1820 wrote to memory of 2448	1820	iexplore.exe	16
PID 1820 wrote to memory of 2448	1820	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b632d4234c9cf9fbe549bb13178e3bd

SHA1
3b02cb062755bde7c149e83eb71bce19d65eacad

SHA256
1c112cc72da535653e3ded289917874a24d7130e8690fe260aa739d36f79ef18

SHA512
5e628f499741241ea445382b9d2bad0dff0c382067613652dfd91ed2e4e7bf008d10176c3345ecdb6b156717590259ca0e6b7e05b9ac8e40d3e6d822d30d3534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa47c80f2cd790a5923f2d7458e21a23

SHA1
03054854dc672013ed050c077e66f9c66ba14e4e

SHA256
105c5b49cfb00172ebf3d5133f6f1d6cfa0bc193971ca0e2c6b1617a6b7d5b0a

SHA512
91ac9ec44c8c1804adf54878ad0df4f43ca0c2d15481597660bd1721f2c90078777a881f7791596d80c565933fa0c0f4d64820d1e34e31c5a4544e292c89d190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0abfc03d9195df0e2bab5a115bb52f4

SHA1
afc5c962b0beda433d523029cca8cf541165ba51

SHA256
b91c4705703cd5401f49f4788da4d3d18e87439fc1dda33b5d6c48dcf67a3677

SHA512
0d4b60c5eb7db8ef969c05be6d9495bfc65397a158b2a8ceedbdcdb2cca295314698803eb766e3bbba84dd17c83d122062e2edb08ea70532e663540f7aacb9e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b0c2cfc9ace17544b4ca1cbe15ccf4f

SHA1
b9b4ac5cf982f84f90cc8f1524cffca6e9d1ecdd

SHA256
f95530bfbc08cbf0aa0b01bb0da295e0facc382709e76f21a8315ecb2bf83fb4

SHA512
e888cf934baaed600eb5f24a538a40557fbe42ea87fbef7f76ef651685bd34045f462bc0e049c7368473e66b33b2f37510a5c0804dbc3a011af5a2b482869815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586ed1298558e008edec3ebd4e54c6d4

SHA1
8c1b2d07d976daa41b03344db3f070329ff6dced

SHA256
900be381f38c207d1ef40f255d815813c0d8c0d09cd483cc994ce732fecc076a

SHA512
d852c56fc492324444a37b05a1c648655b0fe82ac79f09ecee7ea2b3497d8624a37d44b855b517a6b118f95af9da836668bac969c717456e7597685dcd1a3122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69725a6253b6ce78265d6c6ee61f35eb

SHA1
6b451326ea087cbcce9f037567eba22196b73e9e

SHA256
d6bfe452e752c69eb20d1ee91a734bedd85d88fc8b8d491a35f4b263c8a10b95

SHA512
e0b5c15fecc292f5f4e1dc8cf557aaa77275926afc1aee8a4c455dc9c781dd065e35cfe15c0ab6bb5978b195eb6b2bcae940ba9549273338134e7e02e5fa9d98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
961bcece7ffeebc9616361681c61a30e

SHA1
58ab418df40d4d984a5c1be9b8891f73b5c2d97b

SHA256
03fe17b2169b87f6653d94e3d406a7c461b21b867a96dda38ddbce88659ee9a1

SHA512
225e49db2db207a08400910da9595633446d2d49424a6304d0d349c0a382babbfd9ae630a938b1526408c5348133624d87a150a77cb661291be8ff00863cff04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b18634591d35d9c36f553c8aad2e02b3

SHA1
7eb2ff800c4def67f350f704b3cb4a7dbd2a08cb

SHA256
a94928082c45ed43ba911c4f1696249d467189ed2ab427bd38ae4fb1e7e1ceb8

SHA512
ddf1757cf539ff09d1ee4a909e9aa19575578879bf114144fe8ea6c284265079249e16e23c61e4906d02c8fea68b0ea0137471b1676e2e4f105a6a98dc724a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
049607cdcd85a6ea7ab78df927428899

SHA1
cc68da501f541c9310d34482bb4166ad2fbd04af

SHA256
223e2bf43ccc16da02364beafb2e7af3c7d1c50e154a927035ac7799a4e4c4eb

SHA512
f87acb5cbf0740e834b173a7f139bfd88a95b5a7dfec4477114e454564aaecdbf33f6dd262fa660feede7202497a82c117f7833169beb62a817671ca3b7e5634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
829640fc39f85eea49c9a6b48d466f1d

SHA1
b831f541aabc60add750497449906939bb936c8a

SHA256
d1fecf6a7b4d3a97b668741b2c401d21229883234fe86f83262d8c240b9b628e

SHA512
df3de3625429137569ecbd4e817cf7cce756f71dd0e53ff693833fc5b779ac44f6eb187d983be873e31d8d490c1b36955c3c31ba054d5a04f15c3f8fe9288692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e81307c8f81de93c07dfd6ee4db6062

SHA1
d27c61f64033153c6dc01d6c25284eac1d284629

SHA256
3eab1be6c040929274da4bb1a356e62b4c4053382862c021258d4c3040f955a8

SHA512
d5e0d825d2d7a6302b15b046bbba951b931fe7f0a184692bc58c4e864d23a19d4217bdb0f73c1690067dbec3abd1d35c89be7cc4c8370c75bb53e227c5152a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a69c3eb18d7895fb8febc050fe17402

SHA1
9fbf7da5e5dab133c1601c5f648ad832b5112c91

SHA256
d276735e6bc058db884fc30e55d6233cadb7adb58dbf4dfdd904d0493e89cf0e

SHA512
82b6661573a3c883d72ce51100adfb64375c472cd8f006720593d5b04fc0e0781c1bbd234b2b81b71790ead921cbecfff7ee9c7b25932c7a06926557ab296cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6793bae850cf477511d2657d11fbc967

SHA1
3d40eb50133b6126706af2d43094c81fc2484a41

SHA256
a242dc9719ab889aed46ed23c3e120311aea4d5575934a2f236e5a237db910c2

SHA512
68af61cffc74d9832f9a26953ee5796287d62ac4b6d7b8c4b884bc35af876ce63c61662772b41063be079b00655ebf80fb0c6a73af305162876538370ed0e3af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B20.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FA7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit