0cfcc98ef7d8903ca412f11eac498799d7756f6e3aedce2cb2b7162aebe522f8

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d2e1df9d0555c40a4767551cd4ff94.html
Size

4KB
MD5

67d2e1df9d0555c40a4767551cd4ff94
SHA1

27f9dd7a6d1a44ba776a623df24d0afd39f531e8
SHA256

0cfcc98ef7d8903ca412f11eac498799d7756f6e3aedce2cb2b7162aebe522f8
SHA512

e008c094342e7d8747f451191cc55b717bc16c9ec81a87d6001a964f91c9e529d440fec79d0576c52fbec954438923ad6ab72a931bf1b40f0eefdce2f1927f1e
SSDEEP

96:1eJH7/btguwUKAhG+ZeRP0HVtBBpKruP0HVtBBFmK:8bJ+AhG+SYVLBoruYVLBL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411835456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDB06131-B6D4-11EE-AF44-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3000	2224	iexplore.exe	28
PID 2224 wrote to memory of 3000	2224	iexplore.exe	28
PID 2224 wrote to memory of 3000	2224	iexplore.exe	28
PID 2224 wrote to memory of 3000	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67d2e1df9d0555c40a4767551cd4ff94.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0a726732dfe997a8f7aa6182ef61e80

SHA1
72a8f0f112cf3466bb310c73ee581093a1f96704

SHA256
2ecf2d274e513cd42f0de9199890512a9eb72321c2195c53a544d58371fe2d9a

SHA512
4d018099d042ba18015891a1a5372700203fb506c2caf83d92c46083ae4971d1cdca41084da371e6a9ea2ef34cb6927b8eb1dad4029b92394524ad646810ac69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a631e114d4a87f2ab65d667a65acf138

SHA1
73164e5ee32b440393a8d1722785744a3df429b8

SHA256
5f29afae647b069f8ed83f9d2eaa805ed6c5ee76c01e9219b8435aa36569bdeb

SHA512
70b404e639008825bf1ea7a16ebebf048ad82d75e14b3ab245ca1197b9b5c027e2db7c68aef1bb10b3f84eabd2012491dcc0cfbde454708f5938e74de706b757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1b1b94fcc4d33c88a7f45b4f9e648cb

SHA1
f73f96b5e31eed85dfeac93f2cb8143e2614b6b9

SHA256
30765c2f397cc9aa59cff64fd59b03452ffbd4b9106f53220028232847901cb2

SHA512
0a7d314f52dae3a4df798bbf6d765ded8fb889eee5267b3be9ce4dc5b94986b7bffa5b90ff69634379ec82b72291b55018645e3914260b14ddd108887598945f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83d7a18d440eb5bd705b225ddca80258

SHA1
e61f68816184b8940c8538363830ba9c6bcbd68c

SHA256
0e3423c1c9574660199e0386fbe6c6a70d22342a3b2aa30a5f678ed4897d864a

SHA512
703200ceedbe55658a4f2d415e2b811f10082bd4109aafb7d43494b4678d69ea9bc097f9cff05c839d0144200de841b21a5c720f0d9a025b0f3f0eb965482ea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be4a84f2558be7470ed189913b2cb42d

SHA1
8271c10d10efc70c9ec87fd1daac24a1308416de

SHA256
b60988cfbbfb2e6c3b1cd08c0a1c1398f5138df95146745a28319b123677bd70

SHA512
231f969a935af5927a71741dc0c231d620c2a0ba10ea2b0aeb24b08f69811a1ab84b2d95dbb1bb0a46d0ca19820fc06d7ec2e9bcb50d79c5693e0f77c10e63c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9238112ee1a459fd1fd82306febe5230

SHA1
0387797ec9bec01c6a158210748ee99307d63557

SHA256
ddcbd4ac7e9db1832fb5a2c52d032632708c2780627646860f46a104e6d8c67a

SHA512
82fde9d1168ca280703bd2dfa94d5d4b306d0e4e8c833eef7f986719f627bd1be29e722a681d0fb3836b9def64bf29ae7fe867f50afbdbb380b27d229c595293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4083b34c2c9384c016699674cc54f31

SHA1
bbd901da28db60843a49cda821deb05720dbe571

SHA256
9036078545264efb08e2ac0ef8ac106f9396d1fe769e741f37d9305fb553faa7

SHA512
3d65f01217b64ee0feb81a8732a54f2cec4c4a65701f3ee17fe928e357570394c3f00e863a656381641f738fe69d1a9a208a40e238004df1c1b5b26810989bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
085eb15153b6ab56b11643593a88443c

SHA1
d0b9a2f229078bb00e96729871f152690dcc71c3

SHA256
0bbde5a8075ee41833cc620cecd56e2fec01c2f24384f0f13e0778a2fe944a04

SHA512
7c8df0f0c173b0c7fb2d834e91ff9d896589c3f30a4ee4cbd9074cd01f0692fcfa14ce6a4daf248f92522fb1394fbb7167505de5195bd0edfc65b8ca780b4d25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
548b943d37de59bd60acb6c02e1cdef1

SHA1
febfc692a3368cb71c81b2505a922a6c3d05f625

SHA256
77c90b81ea6f117d7ce825a1f9a570050d3f9d3a7fa1c797a546baf0b039a51a

SHA512
b01d9a12224090f55c1a689c764bb2e00a3504b60f43a5ba3f091bf1c457b3bc1bfcb0b09ec6f6d7dd56cd728debaf9a0abcbbf515973f83869f7b3c1faccc2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bcb95ddbad73d500e5044a41ac2ef4d

SHA1
e17d9082ed271e308fe132b872dc1ea324f1c0a3

SHA256
bd1c52dc3d869f080e9dc1ffae34784d3964fceea8aad7b0af5d0922a06417f6

SHA512
df215faea06526535f7aced319b5de170c4be1b6d265cf4c780552b682c434e8e6acbd711e7068629cf84cecfa8e02f1fdcc3dd4fba6b0c87c10b6df7a4eae07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab40BA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4188.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit