3c198f98b99530a2b2d1fabba43a72de257da60099b7fd9f73f0d6c0f2828cda

Analysis

max time kernel
144s
max time network
176s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47f6cad0e6bf2e885a009c2fecdd27c0.html
Size

55KB
MD5

47f6cad0e6bf2e885a009c2fecdd27c0
SHA1

646cddf5abbfde689d15b23491bcf9182bec46be
SHA256

3c198f98b99530a2b2d1fabba43a72de257da60099b7fd9f73f0d6c0f2828cda
SHA512

1a514f5f0673b4357c780d72954ed4a946ba8dbdc8d3b9b597cdea69ad5ba3a7113416da658ff894ddaba0469d025121c776e9b3ed3a2a3952879ae912f1e04e
SSDEEP

768:2rSzpHvvCIooxJ/I/gM+fq0KvPsSfRhzEll6cFvz1oM:2m9Hv7oGJ/m+fq0KHNhzEll6cF72M

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c5e2db1d41da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410761776"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000098e7e5c5e3f927f7bb921ddef78af3e73144194e79bcc7640968cab0bc52201f000000000e800000000200002000000034c83ffd07601f43a465fbe659796e73465936f5790a0c8817ada9c8a7a1333690000000116e2cfc9bedaed47cdcc7f3484e6e3a08748f9eaf83ee638b8aea24e68ffe8b39f152de8e89821feb77bebf25f48a939ae77f7494836eb5a9fec22cc076919af542076179cb2058d4d054694c2bf1af3e8d9ba2e0558996d08d45e52094c0f5ab004f11f2e3b9e2fc1178533f00115b3201c9c0abfce9a456674914c0ef0b3c46881907539b1eda1c0521dadcaa97ef400000009ae5444a21045b452b9f311c97537fd91412639cf5062d62fe8f57114fa37cf456d9a796c626552de4436ce6b79cbb885d7c75f608d0cfd46dbccd25e730e749	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{014CA6D1-AD11-11EE-9028-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000002a0ac7dcf58d7adc37843df2dd06bf45cb2238a1d4472f7b4135756cf8fd779000000000e800000000200002000000026c75d9937b99ab5751aad8b588eb03a01fdc1b5aa82eb577461f8d505d57fae20000000c756e055ba18ac6082063cc5f2f3772c72d91b8715b50a52081017fb4b0fadaa40000000ae3c377b9c49954ebd7f67e4544a74a3400445d8ffe2337d383c1497523971f3e2e5fd40c5fd822ea63f2ceb463c26928c3145f367dbdb9f3fa358299fdd3953	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2496	iexplore.exe
2496	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2764	2496	iexplore.exe	18
PID 2496 wrote to memory of 2764	2496	iexplore.exe	18
PID 2496 wrote to memory of 2764	2496	iexplore.exe	18
PID 2496 wrote to memory of 2764	2496	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47f6cad0e6bf2e885a009c2fecdd27c0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcdbfa7b833be952ccd57f6c521d7cd4

SHA1
91ec1818b7b751eff97dc2c7445bd11516ba6061

SHA256
f471470c4e5d6bf02daebb9a1fe41424dd037b507d145ffcc0fc2abf5178acac

SHA512
4047bc7080bf1b690fd248fb40e936380406af29921eccc51142d928bf5048ed1586ce07fc371d144773dc8046f2e32be53914e8aa6d7d10ed169fd0e8b9a231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6779fd55b317f7800f196e1a73da7eea

SHA1
a894d8b639f041e7b363dd696f51f132f4049269

SHA256
5c83e68ee26daf112e357867e3d3c3424f3ab705b2756b9ab63ad2aa8e172ec5

SHA512
31f66aa25f0a4b7774e68e76d7a9c98d587a19d5be90e6224bdb809c1c6f06ed2ac7117309dc387ee056a1c26de7df8bf78a6c441ffe0269942342dd47179bb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae28a6e8923701e52f6b111881c900cb

SHA1
c82b8377f5374bb4da2b7d6ad35fe737f56f4a9b

SHA256
ab0d1d9b32a5b93a6ba35a2f80990438e3e4a24fba9b6a375d012555e502e10b

SHA512
cca620c56495add6fca76cd80cf9b854847aa9e8c72e7b83249cc35e2a3b936c3570555ad04b099c2a5d5215dc609606ba70fe3249f23992d39a97266758869d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf4ba828356d60d56131b453fc629abb

SHA1
732e59c6f828a080973eb5ebfc4ca3f12190e249

SHA256
583e0ab89a85ddb33da12d292cfa81ed7c63f01880d2adc066766ebd375ecc56

SHA512
840767a34f04b1e8e54b0355bc9636f2705849663132feae351ba3898656fb985f492221649f82db918075d49d6a1e3ef2d74d1d2ff00c02be8e8486d8c29a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
135b75af6d3baf3ee2a84aa7cee97a51

SHA1
14db9a11d49ae08c3d1f378ecac3494c54e1ca3c

SHA256
6dead505e4345eb1c513660aec15dca83d6b212c7c61cf1a0cf549236343878d

SHA512
3f8cac2f8088be09ee987dd3f5f7075dfc3d01d9c3ca441bce0354baa2f81bdda3291413272ac3cc84b26733a40c844dcee705cc80810b628c5d404989fa7fbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2b022fb368c4dbdc91e1992b1c87029

SHA1
3bcf2c979cc44c43bb7c3792f6577860137f9a4d

SHA256
277ba7c02624e6802e5bc9c5dbbbe9d6079f4b2171556d7c5fe99206065377fc

SHA512
9f824ad08407a7bd6e7db2076ef84f245fdfaee061369f052129525e5c7cefd35ecb5ec59a5ad4be251fd0f6a20b33f75dc721463acd0d3fe4d0d45d120135cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c3248bcffb1651fa9594626ac9020c5

SHA1
5e396a23f9ba409bdf7ac02249dfcf7817914e09

SHA256
fdd7a66189a019aaa0111bd5672b2dd586d8036a56607b5f4c6ecb7a7b7c03e9

SHA512
b3c676d5d56fd7b58224e414f19778eff48d5f5a400d5c3ca521470e0ae42a90626bfd2c33a717b223f4e5a760523cc7f55dcddfdd855bb7103c294b1b561124

Download Submit