cac1fe6518ab16f6b665a1851c3d8ea3761a0d794f11ed71e4f11b4e9e051e5d

Analysis

max time kernel
145s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5333c52dde75aae5e6436db33a49119e.html
Size

1KB
MD5

5333c52dde75aae5e6436db33a49119e
SHA1

d1f5eafca9bfbe3679359a475bee58b73ffb2822
SHA256

cac1fe6518ab16f6b665a1851c3d8ea3761a0d794f11ed71e4f11b4e9e051e5d
SHA512

f32ccfc9616ee61d6978ccf42b150319e2ecca1fc43e387982bc406384f2765e13757e5c551674623e6e341421376087d11b91501de7eaea3181426d423d8219

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8014bb437444da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411128756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d5e70a46a9aad9c8c440cb52a858843ee89e79bf8fa332a302b278b2f3e6a24b000000000e8000000002000020000000367f9de84ba3d117057b6d0c87d9b0c8cbe928a3cf444e94b747a6fa2b5b257a200000008e23ba6536eeaad1e1c3a7d3fb6d31bd8a41e0b483e0748bd622662e06e2d0da4000000059400305496c71a60ca5e4918e5700e16d8233f63224e2b4197374355939ad902eed86c9fbae6e14d26d9ddb6e53a6953b442d401c86fe96861e921a29c6a497	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000000b3563d783190aab14b065b33e1fa716d86534ec3bc3f47b39ddd1f72aa9b08000000000e800000000200002000000038a3a15e923aa740fae5b1a7053dc25b22cc52ab2d56a19451821d10adfa80549000000003e2d1458b22c17c29fc74b55ffc0da1261b9a3bd8ca3a954004f64e4d678977d24a5d48b7a3632c2dd6f8356b5e2ac54fd34e2940573af798a49d613c3a97789a4c0982e215caba02c1503823f2f85ca85cdd30a24607bc8b425ad00e8d91ccf4f73913da4095f3b9b5f6477ac8bad4bbc7fcd682dd05f8750fbf837e7c0ab5158146c5a00e1828a87c9b167c102d6c400000009a356b71f8628cadd27cf5d97d311ca944b90f1394b9505562c1ad2a0d6cea4f68be0dc16fab2b6465dbb4f8a919a62d52940d4a2222cd63f292379a6c9ccfea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E412821-B067-11EE-B908-CA8D9A91D956} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1128	2256	iexplore.exe	28
PID 2256 wrote to memory of 1128	2256	iexplore.exe	28
PID 2256 wrote to memory of 1128	2256	iexplore.exe	28
PID 2256 wrote to memory of 1128	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5333c52dde75aae5e6436db33a49119e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0717187326e1f9c82831910cdac49d5f

SHA1
3bf67823aad0e7d27109047dc1651ab3f58241a5

SHA256
e6413d33f5741d5aeec5f9c411280cce1224b76b17e5dd4b19190f1311b06be8

SHA512
40df8d836d7b259e9a85c2c3deb992aa404bfd38ef14327e5dc8dd71fa93d3e591cfff8a54231fe6c7f62e4216c9d2e54dec74717b38d91359c8a298f4bae37d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f28135324ded6316c4e47279de3d6caa

SHA1
de1bac2238e8a9899224e105eb04689c9f543f07

SHA256
cf65920507594915b487d80e2be92598d45824456ed377990f7b57a9747cd24a

SHA512
3c41990bffea8e0ef8e091fb572bcec8e5ede9a49b021ef1016cf819ac727a26ea3c2ccf4d0c696dcba0fe55a052aeca82d1e80b6dcfc21068ae65cba70a7a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3033e21dbcc0de7e7f4f25c1c232fd5

SHA1
03d4a9ce2fbd210a10b4323c0bcfeb5a531bb364

SHA256
b39871063a1422c9e53f02e319111c8ce2b6d4a9b47ee586a967d0b1084f3581

SHA512
e01bf3e33d8b75bde247339b333a505dd4cf26d496fe64267eb21aec8ca49c532f0d06d9df52710d368394a74924cee27c8e4895b6fb7b8cb3e50050ddb21d37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19115c56af7d1e92a52784dc35b3fdd7

SHA1
82ed6026ce84b322683b2acf94de39ecec3773ae

SHA256
7e00ed8f9d32ec8b18927137258ccd05ef70ce300e05ccedd80db185fd227905

SHA512
13b1dc53700d299be050714820ca17f4f0d243e19c40afde4886d2b5a246625b78a5c8cbd72f2ae9c0c59b14ccb2bdca33d936617a3d1261b637ff6ab5e39406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e185b3863bd94ec7a864ca3c8835d435

SHA1
a50ab7a9de7552478d54dde422d7417f965d7c9a

SHA256
a39dccefcf68455a1b8ceaf744887dd740efddc39923364e68f1f5906f9d6a9c

SHA512
49d5b73a79516bf5f8a820ec846e1bdcdd1a01bf2f5cb2c2676080495400db293ce8bc87894ecba091ca19c08c15e1dfbf1c601005e0ac60d82c15088be6b2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aa72671437a63a3f644a80efb0ce4b6

SHA1
c92812b0e160fbff3af323a5f947ee41a7ff3a04

SHA256
7fb8ba276f92ffeef088db16271275a3a69cfae7fb0860383c0c35e9e256adfd

SHA512
02ad3916d680b5ffdd8921e718d6f08e83cba418fe35a3f59a6720bd61775b24dae3b00a16ff450c83dd35a87031950ffd1faafae8c68a514ee71aae451654c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37D5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar37E8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit