293b18cb4d8f659b1ea20edce14f6636b42a8b9d611cb831fb1d0ccb4700eadc

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c05fcd836e78d2adf662d5b8b10c2d.html
Size

4KB
MD5

41c05fcd836e78d2adf662d5b8b10c2d
SHA1

b9db540093d66deaf86ae71bb4d039f112a8fd70
SHA256

293b18cb4d8f659b1ea20edce14f6636b42a8b9d611cb831fb1d0ccb4700eadc
SHA512

408f84146d4b6be482637ef8242bde909d692ed64fb7bef7cbffe1b20f7c9370b714b030aa6c67d090a9d1868ca89caad0d8c6f3e8dcf88136ff6f43376ca2ac
SSDEEP

96:rf9seakGiwLsvfpFFOxUEa9vBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIaLvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000030897d03790a6e85e93c3eec35e1f30efa5ab4a0575aed2655243a46f9b18101000000000e8000000002000020000000e50595bde21a0d8fe4a8f84ee01220a9cb7a46b4b1b9b34e0f052e63f07ec548900000004518e99e6b61f6c97c20bace38b7bdc3059561987a8dd7c44632f256487b4a75e91160adcaf2987e9bde8423557a5ef108008c645b23fa04714fbf0f0fb5677a0f1eb3b622b90d8a9112f39bb8b1fec077e5a7f155b9fe3b0189444c0a50b5201930d2fda459ef94dde7a7dfe46c63e5f85942ebcacda771633fb578569455eb6d92cc7e3006f7c511bd1c893e3d8f70400000008f265e947f851e8dcc7dc9506ccde40f6f6fb0f5878e9e14ef939f291a14767f88ae09802c165f5ece1d99b2f1d06c925903992012e826d9839a0b364010cb1a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410559449"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB4037E1-AB39-11EE-B517-EED0D7A1BF98} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000029c8bbef74576e6c63827b5712f841fdffce8a1a5bacd4bdf2ce3b8a5e273790000000000e8000000002000020000000a0194654d807eca250ad9fd7c3433d769e2ee77d8044a23c19f9ce3eba6835c020000000bda0c7b63dd27b74bc063616beb1c880bf9e442feb5f4233b2353c47c085c10440000000fcaac197a93b23cda300ac3877eca3d2eca1f10114b8e2a30d7b1121957093fe562616d67ea8a3364fe295631d6d1a3412095b5249be4292217eb7481f365530	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908c61c0463fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2840	1724	iexplore.exe	28
PID 1724 wrote to memory of 2840	1724	iexplore.exe	28
PID 1724 wrote to memory of 2840	1724	iexplore.exe	28
PID 1724 wrote to memory of 2840	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41c05fcd836e78d2adf662d5b8b10c2d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3797b5d3ec7447b9487c18c04fc8cb16

SHA1
9f1b81229d19ebd2c025647527660e07d9d5dfb5

SHA256
4ca5e8d9536f08550b23a5073f17a0c37e8abd4055d5d451b2da9746a51fa5a7

SHA512
9e433122643ef2b91a30542230a783c3a99833ef1efa5148f9041f09ca06ed3f5760b469e579dfd8c65d37927ac692890dc606a92deec460d030fea375ecc095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf687e3aef94f2c9d8ccd3f56502c0e1

SHA1
63059ea773fd22f61540c91dbc1104010a6dfa36

SHA256
7835ea99710e03275ce5b03bac6cb5d1ca66b2ac844113932415e77c7e192799

SHA512
65df1ce749ec918b05138d58c77130814f641413fb55f38c21110817c0acd4ce59dab99c89a4b5a475f6d6011eedad8189f9462f7627e095210540726caa3b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f25879c0e65687a0e02e3ae108a2d3e3

SHA1
95128a4a89020b8d42cee6def16ef2c8312d283c

SHA256
e3f76bee6ce49b803e3335e356e2c3035997840a69e1353aada8d76c5539ae1b

SHA512
1548840214609aba9660b10ea8695100ca6cb6372474976f1df31d8b02e41f44984a935468de1ba802bbcbaef668f9c904ae6e75a1469b82b8c85985305bfbb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e2a7e42c4bc0d3cea57c7a6bdadb44

SHA1
d1e2d96ca0dfcb5468ae424455c4548b31e8042e

SHA256
a4d8ca47b68f3018a4d594d6197a12b592bb62bd631edb7b68a9d011e8a7b9e0

SHA512
f820557592ba47600c952614a20e40bf08aa655dda965bcdbdabc0e829dbe8d2bebc5c4d6fbac5c7cc703e39531f8f09b359b9280ca636823c700148ecd60151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa7849210598cc4fb0a64db490249f74

SHA1
f0b40b7d0a2ace0d004700be07dc3b35455f8a0b

SHA256
58e422713dcf3b3c6ddafcd9ae39bed727c2f8df4c35178026fee3c8ea385820

SHA512
828e910c076eecfeb80a05d0a345ffb20d0d2337a957a6da9646d1c4d3bc4f0683c96f49c4ef39f7b667764a75197016f5cfb530fda737bd4d59f422e9d566be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa2b22a53e4e68af43f1f8877f784462

SHA1
5817d47102e5fcf2a68b81f0e7ce5fe157de7e1c

SHA256
70a9b707d76a1695a57d09a3a183572d9616ea9c8d89c5142691ac981c78e0db

SHA512
d9e922bdb8616778e851094c3ec516c246f8a8d59b1dad2a1a258f6ffe5f710792243405483fa9bbee541b9c336e22bc1d08d0e7419ce8d16c441f6f8e036047

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
596698028d3c1aa7eac3dd2339fdb85c

SHA1
ef9fe3bd6d225af11057c6d553392d2a63de118c

SHA256
314783a51625e8de2a927e40f95d30bc22609b1a5501bf089141d0d406a8e502

SHA512
b54e8f451f100fbf4a466b991dbdc2435a17d23f631d6cdffa1e57aaabfc3d95c5c0de991126301e0dc3bce29512c1f905556dee161dce300257d0df933c7759

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC333.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC365.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit