ddd175555235929ead91ebadf39eb4b924a94c5e1c87a412f65c41663bbb6813

Analysis

max time kernel
138s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3bd1ceb95780567c03fa11028307b16.html
Size

3KB
MD5

c3bd1ceb95780567c03fa11028307b16
SHA1

0f101b5783ed21f68241469894520ad01da22364
SHA256

ddd175555235929ead91ebadf39eb4b924a94c5e1c87a412f65c41663bbb6813
SHA512

6591efe98970515550288e44c811b08776ee000ca8d585c5ac910489d8dd996b0b9bffb2a965e771a04ae949d384e01589572c4c600255ae41b8a5c869ac214c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000884f7f3f7232a1e61fe990715dccd4ab4e822b7121f44abbb6046294ac99b337000000000e80000000020000200000005732ec0e689f6b7e16c93c1bc6e96f2a56be37bc9aabf567050dacb50ae27b2c20000000e3c1e8b03357b2bcac2a16c6997f735df56a5b5f5fc91fc82923cad4e1f083d2400000006c11c537af187f20e3adf79dbd27ed513a0448790e579b431e33989ef24d030ed831132db4030785ec52421603b7303c9e9fe657da88f31048455641b6e50e5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E176B81-E087-11EE-B35F-5267BFD3BAD1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416420121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000004782d224e384ac520f9ec722f261c6e89c8ee793a3128fea95e19d1647543ab000000000e80000000020000200000005336fae7523be86b5837b1a8e356af21bce3b2c2228f7642c117b632cee0a0f890000000df8aab5d64ac97ebeeaa921274958e3a3f245de0864a60160ca7aa846a9fb28d316c23c3eedb26101fd1af575c28142856edbdb4738ebca63cd3fb7b7c82a0566bdd3969d279a60b2aed4539598a683fb97c9c254267dbcc949827c0ea3a2783473f64db1cfd10cb02824e2e95b2b02e94a1bf0d87af7567a21f84904de547c777093481068e4e47f54764fef38ab0f040000000a363185c2a47f13e9e01116a777e094d2f0bc747d5c3dfb88b29775723ccc2b1447a19b3d681bc51f380095369f603b79ade3265075562a75b8c9cc7504a48af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01d1f339474da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
604	IEXPLORE.EXE
604	IEXPLORE.EXE
604	IEXPLORE.EXE
604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 604	2148	iexplore.exe	28
PID 2148 wrote to memory of 604	2148	iexplore.exe	28
PID 2148 wrote to memory of 604	2148	iexplore.exe	28
PID 2148 wrote to memory of 604	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c3bd1ceb95780567c03fa11028307b16.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892cd43b352367f65c5f3ba37f499816

SHA1
bff12b09fc9115b505bb08bd0c91fa96f7c950ac

SHA256
0fd467badb576835ce77f3fbf49de489e89754c7e5f0e856adb3739136752925

SHA512
a7fb76a9c728edc65d4927ad1fd5c2f769e80371c09438875be0943a7d708519bbac04cc8f26082a6b1050a07ecfd87585a9a12a4b83e1fa519368b8fc0b439c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d727b8aafcf6827d29c88cf61ec8481

SHA1
13ac67573d429078be97e40d9747c19b71c9832a

SHA256
7e6acf9efeece69f07818f2c5548f384474e65b74f5c67201382482fc0d66fa3

SHA512
6573bfa65f57301f7c31cb2591fa99951c122e319135307c6be370dbeee24e0e3ddaef1288405240d1f67035336d3adb471129caaf97b1f4bfca66b3e69c257b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0be43b7efb398a1d0321f63c72dcb92e

SHA1
5bbb851267c7ccb8e003ffc4b4139e79d76aba5b

SHA256
ea1c6a29cb32642369c8fc31920f07058bb2b29ab7fd26a365e29a70c88f2e4a

SHA512
51bc11baaff911aa37b5e2fd906952cc0c0b3830cb3e6a91ccdcdb26922babf0fea58d084901cff120656cdb8f35c752ccea24b9a471349ba9b1e8b23e672ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
030460b15f476f0dce7221ea10190489

SHA1
1895af0b95f671c1f27db72a2bf946f51a4285a1

SHA256
72d440dd26990d89ee92b3418d66388d44eb17ff284828e492034a5f23b0df37

SHA512
f4caf14f287d0715a78e530cf54ac1571392bf12c83e5be220190e298044734d63bb273b44399826641b180403efe8536778528deabb145f0966088d75a087c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5167137c1f1dfd8f64cc6254148745fc

SHA1
78369d0a057bd7c90512e00d060e7169635f631a

SHA256
ddefd7c9c520edb2f9484392cf5033528e5264f484d251a5d8cfcd2d4b457a12

SHA512
f72d2c61a0c98a5800a7f6938851b3123a39e05869620c6ee60e60c463cc0a7cdb7237160a7ca1634c229745d9cd815052be406abce56369c9f1ef0bfaa5f9c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d7fdf29e18b8fa7fc5b761aa6a376bf

SHA1
3745fa6ec6673444ba280d9c0a5d4f45cba9edf4

SHA256
b6a12d563b4b1e1d0cbd04927a3202f4f58f9b523125ad0e178d9a24a38a038e

SHA512
9bc06753eef3ca6b6e6e18dd65da1bc9be338a92fdbed5316e670e7f9d24d3448f8b6496a61112c67a1bdcd54d653c467768790a1c469036f7f81d321b17730e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7faba08bc921487526b09873c452899

SHA1
5b073f07392a00c02614ed63cf0d5d16478524d4

SHA256
6eabcc102b1d9a2f1588d5743d3ce43e046dd1088ba91a1f7817476033be486b

SHA512
a12e0eba2600f4afbafd7cb35b81dc1fcb2c612e65bd03309244e2e71bb04531f4bed90bdfe3295ba10a7e2aa8aa4892afd18db62609aa75cb71bbf162c8d6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99ddc718ee5a8227e1a0384a08d14d6c

SHA1
4971285abf3d356ade9ca17c69d514ab81fe577f

SHA256
4d1f7a7948db28c5fc4146e6957f1019508d8ec01994387f4de3024143301a17

SHA512
131f3801079b4150f95048d3e9aa5c2d9f8944285010cf1739f2f3b6fca68fc688dbd08eff11971962fbff575d91d78515d00d5e47bbc325366bc1f620c39e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEEF4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF293.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit