fedcc8f391dfb598c6af9c6cd5cb6b1c37b14024942f0126b483b849680af7e7

Analysis

max time kernel
242s
max time network
281s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45c73658d06f65eaafa43e47cf2230a3.html
Size

138KB
MD5

45c73658d06f65eaafa43e47cf2230a3
SHA1

3781473c433596ba562f0ba0324ebe7724b71fbe
SHA256

fedcc8f391dfb598c6af9c6cd5cb6b1c37b14024942f0126b483b849680af7e7
SHA512

9f3375fba262fc246a0688cda98da2a26ca40e4b87a26aee2d121788a136f69c7de484a55115cd592536233ff88c0d60d2488de5348b619fb8235e02074201e6
SSDEEP

1536:Sq57gMyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:Sq57PyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410692254"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F917DC0-AC6F-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2920	iexplore.exe
2920	iexplore.exe
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1640	2920	iexplore.exe	28
PID 2920 wrote to memory of 1640	2920	iexplore.exe	28
PID 2920 wrote to memory of 1640	2920	iexplore.exe	28
PID 2920 wrote to memory of 1640	2920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45c73658d06f65eaafa43e47cf2230a3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3283e06a54186080e34fa1018b550e1

SHA1
08d0a927d5e79c186ee2d514d08ad2c1e623f46e

SHA256
c3ec0b00da15379aaffa66b2e6bb9db0cefdd4e23305358644388e01a357555b

SHA512
46231a88e9452a7c556b66a8bad9c084a3f58812bda360c4bf3d71457c635ae2e9f5840ecc66bca40326e5e66797dd12f659f0e55b7df853f7310647d6033dfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b892fdf262cd7909d3ccd4f172afb8c7

SHA1
2a715670a0003abbc0f395c78efd996117b5648e

SHA256
46ef8df722685fbdb241e61220043102681137face39e7fc5959e72684d4324d

SHA512
2ae4dc23ec4a641a68ca3a948955927e9740b0ae6ea18195c9e2f8f13944ff39bc18c33e22a1daa4fe91d7b93f1f13b7ff4435f4640159317231e8a6c9209b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9932bd814016b49c4d9e42281077b4a4

SHA1
85b47202fa4d097c2697f405214eb66190a0da8b

SHA256
aef1e7fbea7acaa808369239d124f4edee20373a656c544a56c66437bc68fbce

SHA512
a0be3c1081267dcad5dea1b18c49ca9753a8fd1b861db2124a1d90d4ad4ec3773294b46bdc550dc892a15d56c9a0f4cc96f37d41d19047acc8a942d28e9c15b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
029d5d8e69951c1062d25d31187856ee

SHA1
a8ec7fd4fd80ffbf01d66633b4193c2ed691dd89

SHA256
b4bdc9bcd1753ef1dc7ddc39732efc469c837d9d8c9e3945872435c35ee7b864

SHA512
645a65f921e89f61a6f91b0c7c32d3b2e1cdf8916466dfa7d064b4454a371739a95c547aa91493adc3470713de3b4df67f33bbca82011b501221496f8fbc282f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fad56a9901a35714427d7cf24c7b23b2

SHA1
636a338b8b8ae5626a25e53c013bc3ce31fe7e90

SHA256
0eb777cd04f77e509a1d675b88b74ca4ab5d2afded8ffa4d6825bbbf63eb86e5

SHA512
ff6325aa757056955b1ca01e42eefbee4ac9e8b1d2e815095387cd13fb0df4338537a7fa566a7bb4c19f948c8c20a06c914842baf1d7091d557eaf585e68b026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ac7e4c4accc4d727524065e8bc38ba9

SHA1
5a39dce07cce0f625be59a4bd68d712ccb23af62

SHA256
5df9e5493dddffb0156e11b0fded4616881e900807acfaab767364dc19c5eee1

SHA512
10e201dc8224ead2443e6528ba7e6412f951cdb85413832ed4f902fae9914e262233d93f3439487be7bc233acee8994347310c08c93db94e376294f047483918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0bfc9bd84cff5b1686f215806459ca6

SHA1
b225fb9f1373cd6cfd92a224506ab2101a1322e3

SHA256
12508326a60fe24a567883b8cd472f5886d88a2eaf5a3ff9493a42b417bd1082

SHA512
915945588d77e7365468c02367bf0c230ddbe93a026b19693b447cb433270c22b38b6e046c6fcfa346590c67f101c6446760d1fed0b74f5abc04fe8c2682e2b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44699fe42b8f752400f656bcbd5ee024

SHA1
ae997c3fdcdc9f195d5164e82addb58d20d3b332

SHA256
e81c1fe001b7cb0100342eefe6d9567796079af575a9fe67a20b0fa95737b478

SHA512
15d86dd7856dc50536384bb603476aa5da0fdb174b5fb9063c9bfdfa687a48cda89057a02ebb93e4a3f9a90f8be094ca94f949cf21361a26c749a265594e5043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33c2aa5951deed0d8c67b652d9e3caa6

SHA1
6ce926e00aff752b18814ea0acbc81da1589a89a

SHA256
b77a67e6356341a9b442e285e4e10e0c222e7f11dda4b429a322aeb1f85b5ad9

SHA512
b770b8d12d0ced73adb4400cfad44de3ac9898c214b67e237df2fb0f92d272c6510f55fcf990c31d1f020b967d7534c416ecfb22d2bbd54fc92131391aecad88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa25ea39f73f76d388b7d70bc99cb2e

SHA1
c688f40f15d5eb157952195fe537ff0f1bd7ad64

SHA256
a04ca7978d2371675ca9af7c4b1b5c32425ad55b0fbf391a45107015d12a016e

SHA512
71df3f05c8f92a113685cce2fbd145db60ee4e82fd7091eaeb4d7eb2044324f65c9bebb3147043f2ed6b40571599969bb972085249e070cf44ac25cd63d65800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e96b3d67eaa41a2c132b1093293d8135

SHA1
f588408a2d4744b5d2edcb78018892ef2b59ac32

SHA256
11dc6e2ef9849f0db4c600a6309c3cacea25c85b8f71aa25b4340e89c80e6c76

SHA512
42c6e52cea92f1359651f672a22dd0a14e375e2bd1414d591c13b5f89f0ee14b002e9cd2914ca8ccb640e67029e7e09836995371202e99bd19ee7c087b57ecd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
459afab32cf40e91ab4057fc5cac249c

SHA1
a092a0889dc5f51ec1b677f66b5abcb55e747a73

SHA256
4630e71693975ba5e002ca631159c3a645c4f5eb06c7a37ff9419b699f9d316f

SHA512
65ecb78e14d612db0c85eae3efea72a30cc63774aebafe3f15191086ef734ff2941a13904df2d5359c67fe3d927baf5125a5dbd3f7707502717932f6cf4c7513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e0939ee01f3bcbee11c2b253489e496

SHA1
4509a38154cb739b632636de8bcb291c7103c90b

SHA256
c04cada23bfb612967384385189e2957d00f53548c5ad96fcbb50202664126de

SHA512
2bbbd7308c5cb2ee58d15131bd58f042cb4709027a00a8747acb6c3b94cc3853a3142cab6b93e8ea25b77c76302584c768f59e65c5bdf43086b55a6bba7ce873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1219fb0ae0e757b28bf0b48831f7420a

SHA1
d9905328e0fb8610063af411ab243deec6f06976

SHA256
566a10d220144dad161840a4fda247a62d035e0769c1ea57df1ff2483d449be1

SHA512
4643970c189f9a9492744667bb16ba8acfed369eec3936b394630e752beafc68e831f1690547d15c588b3b37839e48ac2dbd68c25bc74b5e841be41efa14f590

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB3C7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCC1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit