c0fe69d15b6ec34c67ee99297231c70cf59580859fbed40c9918f3f9bd85aa8e

Analysis

max time kernel
67s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43697a78f3c3e2e26a20d6de12ccd0dc.html
Size

1KB
MD5

43697a78f3c3e2e26a20d6de12ccd0dc
SHA1

f71fdce7ff3995dc044a1ea784c8d615f94761e1
SHA256

c0fe69d15b6ec34c67ee99297231c70cf59580859fbed40c9918f3f9bd85aa8e
SHA512

2898febbd07993db36172febe3b7c0456e532385a09603c3b05a4bc6a3cf1a0070a4d1a022c2fcc36349dd4a9eb25ee304708cc02b57cb2c47723e85df4e026f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000004ffe8ea799e3ec3330801bbf4d5b437c4a025a71e7d35e663c38718d29c3c6a3000000000e80000000020000200000009b1727f7752ba5bee494a798f7703f05d074e5d6690e03db43b0c9cc2cc927a22000000047ff34821682d616a96930589babb36247408222351c125930cbd5786d32023a40000000061856c1c2c1f29f6040bcbd3dd4453baa202328cbc03b64b9b467a28c140d9b09532127adde6ad0ce7be13d3320301600817a83a18c28552c876df5f1105fc3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000002f3576807112cde3fcb56e2f912c3e652371bd4f35acfc915aeee1f358400b00000000000e800000000200002000000060c459a5c20bfdad43fbc2ecf4184294473e998e7a26668654fff38dd5af9ccd900000003a1c3def8e19e155001962f56cd69a82623193a52fca48eaa24b56749270801dfc344016f1ecabd43b800cc07d39a236d4b97f087193f909272b0c9afdbedb276746aea3d927c81ee5d02b262a2fb346e15698c09d89c6590fd6fe37da0f0d48536cc66f85e349e0cc9ce8626b0acb4c1e32b6a6c03f5086de530c54bc21cf400840eeefe3731c17e1e80c47de15f3ca4000000069522ef0ae29225ab3be200b10262ea90cfb2a60d8f5722efeda72ec15f92486804d590a25a23788696a86c4374de2ca306a9ab671e00d75d1354187f225d456	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9718C781-ABB2-11EE-9911-62ABD1C114F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705c796bbf3fda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 3040	2024	iexplore.exe	17
PID 2024 wrote to memory of 3040	2024	iexplore.exe	17
PID 2024 wrote to memory of 3040	2024	iexplore.exe	17
PID 2024 wrote to memory of 3040	2024	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43697a78f3c3e2e26a20d6de12ccd0dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
df8b0eafbe290a16d6bb26fa0dc385da

SHA1
1dee4f6eb1b3403f1b399e7d9fd1bf90b220a444

SHA256
a386f2aa4c48754c3e7c3dda30d3cf3f64c63eb9bd76c85866b6b8905b6b980b

SHA512
971c3635ee2643453b014f2041c7d8f4055b524aa4ef25c383145c7177842721c527ccd6ff9024392e9cd6ded29cda7971f934d74db038e287733c749d507895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a057710726877fc3b22c3a434275cb44

SHA1
c15512f229486b217278b8cc493c0a739c820950

SHA256
72ac5f93058f02f11c2920ab2367401f0af2eb25cc04333d416c30470ca00375

SHA512
52a0f975fa9858b81da083a51c84cfb9db62621dc1fb312984b0b57e49d9c35cc0fd499fb61715a28ef2716565d509207a5e992436cc3ce99749f39aac3754f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a3013966151f5c68b98448f84440c2f

SHA1
7ca857665894f79ebc21a06fdfd17373829fb724

SHA256
f4a6073e166cdcaac36ba1edf50c9ab31a39892489be75613546165439b37d19

SHA512
fceeca095bbfcf24224de73473baa0ea73d42f8f639409a68c7042259817285dc93255140e9f48d4fe23730b172c484827a7ac9e9e53ec6ebbe2ec7edb69cc2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07318b0ded040811e2ee1d578c582434

SHA1
4c6de3f55da0083d1c5b5df255e07f022abea6eb

SHA256
b2458d4941d06a6dbf015764e90143432a24e77e6456837beed9368cfa178391

SHA512
88b3cdb211296c05c6749cb81d4f8f7aadb42c173b6eca982cef84fd9911f510b1701eaedc41a5866c7d094371ff31c3b8809cfc2683afe763b39a54e9800e09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b0ec19686e34af25be274ab6ff37dc5

SHA1
ecce93a3155a90c6daacb2fdd9e4fe1157ded880

SHA256
9ed3fe35e1c34cca7e20e60631ff01971f3a02238ddf89ba6d3a789b987eb0ed

SHA512
345fb67792d8f6997af607c5269d9ee5999645345fce89f5d207ff40c7a521c31d18ece2abb6a067e8946adb4ca36a6e15d0dfef32a6c1bb3f5b01cdac5e3314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df500ef4d84c5232570882225ed7cdca

SHA1
1a5d9d792cc2e2a40274a7536bb94e43e01abb82

SHA256
f5b878ab8beeb39cb424d950017e6b625a1c7683d34339f98d142807d115648e

SHA512
d07db45e39b816b6af07edcdbb7a79834367fb8549fc573408cd78a5b5bc487bf1b82ffc8b4b23d4fed615f58fc5eda57e186d619175b3e5d780d9e4e39204d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea0c9321f0af41dac2c9a8f5a5175194

SHA1
33fb73ade072eab319545f4e8e1207a942af1f8d

SHA256
c20f3c73dd16561c3a69226ea82f761c5be03d8c5b367caef26a58c99ef44aaf

SHA512
b680327cfd4d1ae54cb950012416e10aef45700374914df93033948521e7afd61b293f6a44e96006c7f8c01cdc8008b71890dbe172a22b69bc6e46be16b1eaf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbe79e4c0b2e01e5b6a93a23823a2f55

SHA1
7977ba414d8ec1d54cd7fbb59d6c68ec2a6e57e6

SHA256
8538e77be370f46d373ea65a18e0c1112f15c19deccf723c3aa5675cca2bf76c

SHA512
f8e767f45dabbe5446b22bb39dae948da05f2a480438801b75f7c50c75585c52c8cd6d735b8359054b20a72dacdabec4e74688fb9513502f661af8b75b976257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
750bff9403f023f44aeb9c62d34965f3

SHA1
b460a531ea44371d44495c91011f43478f29896a

SHA256
cd44a60c260bbc1becd89367244ff247e51254b74cfa26177ae5f2fc78de09f6

SHA512
7761971d0b4bfae16311c66a4785e522db883f09d3dfd9dbbf0fe4d206fcee18e99dcb529efc6445971436eaa40a748f487acc8fae1730ba79e9f64110f54383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9b51b7e8c6b7fabfdb77d1c4001d0e0a

SHA1
fe9cd191dae533cf32e15c29c7620399b76d4f7e

SHA256
ea8f6ca37664996cd0c3d530b1a33cc8522499a233a8f422ee5fb81fa1ecbc0f

SHA512
f7404909030801ad8e39e56b0a15f71403a24b2522131ae37697ace8e67f54ee7853d7939d88cf0574504657678868db5b0b4deaa00f867a722191f3ae43b11a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26F7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit