3e59be551463b409a91c0aa04a585912d7d59e9e28880193e92d7f9e96a9505d

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ce16c55fd086190d399daff47a4559e.html
Size

3KB
MD5

8ce16c55fd086190d399daff47a4559e
SHA1

02d4542f5744e562aa889f506bd8a61f68912425
SHA256

3e59be551463b409a91c0aa04a585912d7d59e9e28880193e92d7f9e96a9505d
SHA512

643307342a21c5c689c9262db1f919ddeaa2dde0e42df46bafccd5c4d18c98013c9939385635405ecc3de183ccf949dfea6814ac54376aa0da7e7b94dc98f005

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000003bdd1ee043e21a6bb57ebf0c32713ec6f9761bfae2c105bc3e4d371536d7bc56000000000e80000000020000200000005c5641026d0bcea6472a1fa618c2c08d9b9dded58b49f88352ff7c3b15b1f7f720000000c7979c58e10188df9c862da2817fffcb2135b4c67b3de6d2556ae8ea991d8d5140000000379946089fadf811ad9bc6f7035bc02b1566afa906c04caf6c1f3e2e6e772bc464ce96c5462246c06579552fea9a50a9ba2bb410651b0fadc21be3aafa89dd75	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45EED5E1-C2B7-11EE-AFC4-6E556AB52A45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208c6a1ac456da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b5b53721e47044e82c5f9a30147ba1d717696ca3aebb0597e5f6274510ae999c000000000e8000000002000020000000c5d01841174c845fcdadd31ce0cbd4df02108b6ab6a0499e32b7c31b8056fb9690000000269942871840e2d7f4c1fcc21a4a47f9720bc5823b4f73fc6092621c3eb406a206144dacb6f68f8431854991920bf125672c39b2c43f28260a7cebeef43a0b7312e3f40d546b34d732a42aa87c8173447c928c6bf87f9ff9affb5402eb365d1c9b8156eabc81e66f333e8d85250c8b4cc6c4e7e197b672e641e8cf2426a3b82cdeee34125c25fd90c99531c401b01d344000000082eee58a3c561f1691ac1a6f251f1bbb5222e3e90d35fef637f633d19051c07909c509d2e4a17dad2c94efba1d0b10e0d2c547f29134263802c2ff09f96bc23c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413142158"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2360	1948	iexplore.exe	28
PID 1948 wrote to memory of 2360	1948	iexplore.exe	28
PID 1948 wrote to memory of 2360	1948	iexplore.exe	28
PID 1948 wrote to memory of 2360	1948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ce16c55fd086190d399daff47a4559e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4abe10eff8acbc157a6699ea89471e8

SHA1
3a2c621b221450266c777c4c3df395f85a6c718c

SHA256
869811cadad09d262c3d43b5306ad8ab6ae0c9cb35989a5f5ae3a1f6a736d113

SHA512
2141b74521134e29d3b17b5ffaab5c403559d3c367f5215b559d02517a8b9f6aa4a35c74ac4502d96f5e3512a3d5655b71c0c8f66d9ac60e59f3485e835c4959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a180a0a9aacc7d1c401ffd500383a484

SHA1
f5de17bdfa24ebed37732adddd582689fd8834db

SHA256
164c1531f9e7930b3bd2a1ddd5957c362cc13092757c4da9db9dd0a020a30486

SHA512
81738e4c8d8fa1978f51140de6ae1c7e9a335dbcb631a3560723d1e175bdf0bbd410ac9ef1e9fd6a988d8587e1b5311e3f94393f0aa28ce38242f783fbbf2a52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be849ece120a25b332084e31da714ba7

SHA1
9fb98d0b8e8a406c854fb272c31b906ce76fd395

SHA256
2d86e066f298203dd6b9c3ef20ebcc0d03ad9e90a8e495b51baa8d6d48195882

SHA512
c685982aec4cce7007b45196fa47ce16276e9802119c36644b122fa281bd6e21e1741b588eed3c54981f67b321f7186f72c8f8b3ba088175dfaac134fa9d079a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5672fa312f214af2eea2cee54a5082f1

SHA1
becf5ee93cfbe53e33f56517ea7c52b6b1d44939

SHA256
33351b9b2d253cb53c3ec4ee116aa14ffe1bac959989fb33da094aa338f8b102

SHA512
396fd056b0aa7a7704f2961bf312d52a2beb983f96fe6010870ec09f53554c225eb3cc418dbf2a7803ad50b0984292af402dce4149254f3928725da887a5f20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
122b9969d59e702e2758a11224be5964

SHA1
4d9ca16c7e909c993a036a3077a03f10276e96fb

SHA256
30e8ca02b17c0a49a912cde49e6d456d1ef06823b50f0ff3e44b867b098e20a6

SHA512
f127e58bcb91fbf60cf95897e51cb450c84fa07e43acedb9538d329597392d42bf9bc3a169f4a3893f98883b0df6decfad7c43e4161d1f0620971ea7ed801b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3b9e04bcaead65c1181f024da7d4162

SHA1
c03e330394edde71ca8466dff029068ea3651b04

SHA256
e7d70d9204d16800b903b648c28752b8829ffac0af978f2957cc7d52ab715ee5

SHA512
c2d8bdd3cef9580fae899df71333a8111df4fcabb38d2ac4edb4d96c4eea0519a5d6ff5f921dea03fb18c5e2ee2ec23cbe871ef7bb164291b0432b87bbafc6f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c94b372932d672e4d73363829266ad6

SHA1
925394a5ef8cc34a525d615b2d36181bd505dd0b

SHA256
c6974a8e0d703bfd70f84bd0172fde603f24cee894879b7375a60880ce4fb595

SHA512
51dec930e945787335bc69a5c2cc51727f827e8ad59d598dbefb2c2c7633fc3bf2e6299223c3aeb7e5bd8557c8b5d67634ff8755b4d94dc67ab6962b35022aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74c55e3b71ce7eab6e82ca27ab1c6f63

SHA1
d5e87d69e22c254fcbbdc025a71c0f99f7769ba9

SHA256
6d0ea55e0b6c244e9035ef07df8c69d81b7e7690c41e3301133372b3086e17db

SHA512
f85fb2c5d197d372d836848ab1690667b780116ca420f7acb2b7c5bf7af19e122963cfe2d48a072039d4ae53f358a3ed39144d82200e8fa949dbf29fe99d241c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9868da06bc7e84e4a9e86b9a8651ad5c

SHA1
477f9e43f707f8144053718e22b6af9de2c75595

SHA256
137846bef207075b7de492e9c2d12d535785430ca2ba38cfced7c608a6eb291b

SHA512
bfd9096564bc0f9a32b504eef05994e6745e2551506f87e3e8905aceb46afccf690e34e2dfb0bee644e8a1e41629174c235f661bf4574ad31df68febb4b54331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e945288f52f84894fc8737195c73d3b

SHA1
5e53bb659ca04ce1657b778fb0d0cfddcd4f7e08

SHA256
842ccdd6f5e151fe3e6e9843a1d0965c075182815dbf3f805194bd47593a1da6

SHA512
5f116e7f8187aaee38c14ff2241166a9caf6d288ae81795d087deed39bc1e08f635d746892bc0681deb5aa11b57206398e2817c890aebd6bc1bb71e3db3c3e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b324a35f3757c3ff5854ad9cc6d73270

SHA1
9dc020405d2fed82d801d5d7edd0f54a7c4ba5cc

SHA256
1209c3de159bef0ef35ce15bca0516f96129625bb2544cd063268226ccf128ec

SHA512
bda080233829a73daef8614dcd47bda75d916a0210ce687edbe91ca169775a88a3bd1b984ddfe0760c2d8262f2a1d070649e3751bd023835d9bef16ec64660be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464095f4779a4505c0efa13bb00b144b

SHA1
a4be42f410f6db91bc21e2e33aaa6bef4c92a1da

SHA256
5741f69b9c0e19f4df2847fbab0173ebdd32a197d7c9b8dacd36a58cfd690e03

SHA512
3029d2b7d2e507f30aca3e9fa4ad8aee8fa2389743d533249adb645677875aaa2af881bb5400d256a322fcce2a19718efd232a39daeb51cc116be8a80837505d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f97cc9ce689609f758fd8a8b7dd2818

SHA1
134110e68ef69e45a5b5f17e151b040d0f2fbc6a

SHA256
297dfe496f52628ccddab7dc6b26991c6a35920c88bec5ab2c75dc75e4a6fb53

SHA512
1f122df9943bdce1187e691c96305677ea6397e120edb2942c48444d6e2d948300e7aba393c392b330d2b98ade8d54474478be5102e8120c9a8e9c1fd1ccbc1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6835d9e1fb1bd5434f5632e152670d9d

SHA1
804825dd1f5f19e6d198a4feada0d586d5ad0c22

SHA256
4436d8e8b65903e4f4daecad2e1f8ee38cb92622b3dacf67a1d016c323a0bc1c

SHA512
0f277f979bb77e68d6e95cc446bdef0e9c93ec841fb4d8bed3c471d00812cf30d24a3ba869dfe5e0cd9d1b9a8c3c7252091bc13d325ce064d9ca46aff546b0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c91be3bc7f82f352b88335c989482bb

SHA1
97153d68a779af4238de8466d16fc37b555d4324

SHA256
b4536884ad1db3e511bc9940ae7af07d1c5024caa3e335610fa4733072014ecf

SHA512
3b0a5973dff431de601e35cde3aa5603291314974e7e4429897cf585873ae1c91ed10c59cc8da6969295489e03039b97ad2e53e83bafba10a1f66dbb061e2f0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa6031f8553ce601b8e7322336719949

SHA1
6e26b249ed7039772eadfb558ae83a89b1cc6881

SHA256
a75d72c72832281cc6eb810d1035a8a466f0b18a991a925a50919a637ef467e8

SHA512
3bc11e09fea615e502b6a45857aa0c9dfdc94fa7f5f4c6ac9f8f2dc6cc929667e08bf66572a5ec4c0d66e6e8ef0d4fa68aded1f1b8289e41dfe400ffd14dfe9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c0c7ed8deba6c50ea212ab4c0be6330

SHA1
4df962c81b58846bf67ee2f63508ac7a304bb509

SHA256
432ec473b94fa148d125fed5365487078dfcfd988c90ceb07fd1dee5552d419b

SHA512
57e9b16b32a8d9cec1c05b9264033f92e9f50aa339f43fc9dbb633ad10e2a0008ef2f8128cd4cb873c2987003a40457539287728bfe12690127f50843d281305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be2d55715ad541bbd136916826dbff1

SHA1
fc66e0b4e659ba37918f73b6a0dfe18a11b3333f

SHA256
2c2c7d84bd5ec1cfbb4de6e73dc33672ecf566f9cbf3996af1e5d24f841ad848

SHA512
023114a9ee81c85b4e8192d4ed9c971f9c321e96385c0ebca3341576a49b343d0427c5e7a278d9583856d66747f3538c3ed0d78b86fc6f93122a7f19bb5e72d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F5D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar300C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit