646acc5463a5f108c2b0f67467144577623837592288f49dae014d8dad601174

Analysis

max time kernel
117s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c2cea81009d967f5f08448d05d1b402b.html
Size

287B
MD5

c2cea81009d967f5f08448d05d1b402b
SHA1

ee97ea82bd42d9c31634f224b3d7909330d9e005
SHA256

646acc5463a5f108c2b0f67467144577623837592288f49dae014d8dad601174
SHA512

a3fdf92b24ff30e1608195d0775fe1f1a4dc509f756f044ec8d7b431bc6f7fe2cead893c7bd6a7cb9a64496041af46e8fdaa082cd73da570215340e574e6a522

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8053372c5074da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000296f00ab64e6f628ac67fd11fc0d4dc2bab225db2d4ea710a7ee39002a71233e000000000e800000000200002000000035312851fdb8bf80f26223a13acaf00a892ecd6e1fa67a65098967f2a2f38c7c20000000a7fe0b9388873e37da7741b7dde533f2460c231c0f2d1fa2924bd7cea0893719400000003ed8af300601d62ad9c28d0eafe2d6d551affe46571de41d7c8bc78c750d21132d8556d919c2ce654614f3e3fe62be959642c4de8a1f34615d1252d26e45bbe1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416390903"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5680FA61-E043-11EE-82D4-52C7B7C5B073} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000020ff976b22f755a9f4e523c690a896f9119b39421da69b364c69d30ffc6e10c6000000000e8000000002000020000000c7ad1b136e50a710ec09013947a2a70bc7eb5bc66fc8874183d0b81cfee6089d90000000b8a095c1c00d93c9ddf2a23f028bc57fd9c178d913ad6496c397232215d32d868713df6d36c8ac0ad9ca83c635ef245324c65578e9150b91a93e4ce15fb1117eec6824d1baa5cee0cfad329cac0e0de8f169d46f615b1f7a52337f75d3e9b06e6f703e6cb3fef841ec8e711e231f86208d9fc7e6eb49e53ae1ca7821e037f4afb42da0215f39603857586672ca26858540000000ae6088a176402adf55ad82039393fc31ef8503a5af2ca0c635c6e4837421191778aca725deddaa9ac556f95fa34d32a374ef36dd788eeb1de5bc91a672a64082	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1692	2356	iexplore.exe	28
PID 2356 wrote to memory of 1692	2356	iexplore.exe	28
PID 2356 wrote to memory of 1692	2356	iexplore.exe	28
PID 2356 wrote to memory of 1692	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2cea81009d967f5f08448d05d1b402b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c114645d1f144c35d58bb1c4772628a

SHA1
fe31fa9998c475b838a7dee80e598b868f2b353d

SHA256
68fcdffbbc8ac16ca9570830de639764378c768e1a4cab3a46e518419e78513e

SHA512
a102374905309ff84f7edb95947ffc898376d139adc3dfcec7419a964de1b71562b3828304234571d78cf919d0859534266b5adb9d9eec812882e1be3b35914a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5b3698b3f0fe386410b34be44f10231

SHA1
a317dd5af9cdf3fbd54c1999fcd90296983bd421

SHA256
0085b9f85321393e9a5bb584d8a10aca93b1d658853b3e8ce082d8a68a2902db

SHA512
9b3dce3252afd8dc23e615e83fc29bd80fbf8f2a55170e40d65be6503ee2bd76f62d5da7043408a95a785ffef4a73ad719702240505978a6e8642ead1ce394bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8f0048e706232910f71374dcde801c1

SHA1
b0358dc31b0abd5eb9f4b07af3b13e07703bf8ab

SHA256
8cecee95afc8ba926370a934c556f9ac0caf1fcc5772946569f171bf4d424db2

SHA512
ae6e3f4ad38ae59d669d9ba2b0ad1b05a0fafe31d303d5e0ef67801e5bfdbdee6f02b439ae2c743a6433d4a4238e1a6a73d258ada757c8d8578d5b6c8d04d984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6763e95467f7633b77b4daa682196459

SHA1
fcf7276b5775f4f9b9edb69f7e06322cc2afa96e

SHA256
2ad6663f3e489bf0f137ad7f31d594285ff462fd39f30cf9aaf65dffeb7b0c39

SHA512
ac9aff3990b6962236adc38da31c4846a9b85c7d659b3dd93bac2e977e8cdbaeeeb54ad419d604b8fdfbb355c04a2a05586d825a5d55a2bd152edcbd83a412f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4efe5d053c8fada89f08c3a5b43a16a4

SHA1
75dc3d7842c6ce51d345d36455cb3571fd091742

SHA256
bdefe09f6b60bc3b43a886529f4a2a7fa4cbe5e86fb63463d90ad99858f56e0d

SHA512
97b8164206d209176153c9e54138fc23c6e1107fa38b3483eb89b3e25919d8ab2b1ee40cee77064bcbee555d6e57a1e8f28cfd202eda74fcd5837ea456519cdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccd6dec4c3ce9df01f36a3456caab2ba

SHA1
cd812bb0b740beb06bb17f71235ee308a119ddb6

SHA256
0389f87eefbf9fd536ea56335f1e8c8d19b304d69a0b678652f56845f0afed81

SHA512
285375bb9b394e0e290dffd4dc1589e13c4acd9f7483853d1560eb43fa61a866363dc4a79ca06d9a8e9eb3cd0b7bf4d8df9f006fe9449d6d06737669fd6b83f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcc2c1eb27c2edd8be9db2f717257925

SHA1
b3063ccc5256e5af456de7db2658ff1e6791cc03

SHA256
c1728c9f3e0da73822277ae2976c72281b7e5247a13f596ca2e666c7dd973758

SHA512
27bdee947c0932c4d421d52943efc373c43c832d18b3206e5254e1dece928ccdb62748499fe446786ecf38442d3d81b3e29529b3101e27bb2d3c0c18e725827f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7bfc47771db3eecb3f6863062547673

SHA1
d794b6072c29dd206f2e20aaa4cadc28fce80faa

SHA256
f7246cc779bb9e633f63ad49165f76d2a2185ab9f475981ea42feea09df4c76b

SHA512
69a4cfd9569f62d1ebf4822e0cb6102f74adb1b6d847b8959be7933493bea12721f6128aa94bf9b0aa1720a4f0e9550920ce458e54e65335df5683248fcf313d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8088.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A21.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit