c37da5cbf14ee1140aac80b6eef4de3b638e3126350485d876c1db28573f74c3

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 00:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9fe3bd0794c55e6a90ac3b2b3ee7999.html
Size

1KB
MD5

c9fe3bd0794c55e6a90ac3b2b3ee7999
SHA1

e53509b0c5f1870acb5c335a7ad500ad1c4b3d8e
SHA256

c37da5cbf14ee1140aac80b6eef4de3b638e3126350485d876c1db28573f74c3
SHA512

5b45f43b9d3c640170fa7e3cf6c41ac277f61dba4a58fe7250f09ab219ebf1b8352a9ec2e8332f2958498901f704d8ca64c7dadfe522482786a996e897e0be01

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01cb69a6d76da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000cd9a90930abfbd96269d92bfaf4e0b3ac41cbfe004ef1c19efd0381382b157c1000000000e8000000002000020000000c314037ef729da4ce25809368a3b3243630c449427c7eeea255d1df961634a65900000006c7c6589c0fcbd34e65398ebe89b686848a4227e5b03d82193015b2d6c15c3fbfcc841fcbd6d5c7a23f7a21dce9713cfab03f86477190f3f5a97eccc2555c546a9daf52b443547465c97228e4324c005c1d005f5fbf5b4d2b26dc35146c0710ca16fac8dd79fbf10717faf5fadf224025d3c715f8e4b7032190407a983116756583e0c039c784c720427d67142cecd034000000043a5e1e89cfb8c6ac2b4d957e5d94d333a5d6bdffc080d553a0f3b3328645cbadecddfd49df1dd87bdd8dcc0761af95a78dc6816be3cbf0f1e3dfe795d280210	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C586CE21-E260-11EE-87C3-6E6327E9C5D7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416623445"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000009eb7bf672ae7790d7ecd3aede997e5cd2870bf2c100450f4b07acaa3f0440679000000000e8000000002000020000000f7be79a4dc2b65cae652493f3991c17b421314eafb9aee6f45b27e165a4be51d200000005acec390211b49ac1d638d5fc17476716fed7e0383adb157e1577640cda326c64000000060c7b87ae6ab82b8a6a0d743ed72b17a10acd92e09d526e7dd2ab453036187ef2b3d8a82b73711ffc5ce8ff70f6fb52f4cefc5641fe7ba83b6e26f18a7215b03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1664	2512	iexplore.exe	28
PID 2512 wrote to memory of 1664	2512	iexplore.exe	28
PID 2512 wrote to memory of 1664	2512	iexplore.exe	28
PID 2512 wrote to memory of 1664	2512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c9fe3bd0794c55e6a90ac3b2b3ee7999.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a267d8f6a91a3ee6e73682550c4b680a

SHA1
8566391dcfa90a136c1da28920435293949bd4d8

SHA256
7792272043090f2440a261b228a1c7660ea2bf030feb8c1e1bbfcfa927f02472

SHA512
edec4a5f986fa2daa95c171d2bb21e79bd87c909305ff62e51829e948776696ca841079d4f199a7bd14b7492acb72d59e3afd31d4561e5701a8db999bedf9360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08e7f43e404f3ef3a1168017f1309ed8

SHA1
cd7e8d14409ac2d9337c5e8db35399aa2fe138f9

SHA256
20a45d008fc9633fc9087a79065d7006fd180dc81a5f898b66f1296ef612bcca

SHA512
c42c5863f27335fcc6cc5b333913059b2a4a31a63d07397ef024dd84a11f9fd6b427a3b6342d95aa19386ce0b599b36659b5b89b301cc9e4f704120a7a94b7fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ef13672908ca769ff0b5b5044346457

SHA1
5eb8a68ea95af2bc8ee2dcd0220f710e6139c253

SHA256
442e3fdf292a83c35e54665ca9327f15649c5761746a8a4b335b1a43e56880aa

SHA512
ec9dfdf04fdb840a0d435fc3a2c05a38ce354252ee5e472466a89f6a8316db76388ce29040e130e66fa4c52bbd5fa35ad27cf9214a49f9ecf20374fa7316542d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540ed0660f9fbaac9719a47e71afd264

SHA1
0f812562da6a2d029fae9542cd0ce085dcf70fe7

SHA256
487dd24f3024829e08bed67ef167d31cb5952122383209d95c73e733bd37a236

SHA512
cd38a0a7219af236791a87adbd4ce9102bc7f55b751101b31bf2c0b9cccc73550baa85457307721ba31c98c2cd948445526e46ac230df7dcf2109d2beb86107c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beb9c9d5375a4f436d83dfb45d5a81c8

SHA1
ee1c82f2ee37c7741c4b97db25955d3abd9a0b84

SHA256
46526d44c5e0401a3685e99d07f2f1816a8a29de18ed0000b1a564a5f9f8dede

SHA512
2411cdf51b38b048a63ddf427321178b228df73d4640f098bbd90094445d75302af5aea04b678269017fee9b7cc7a54c44db810d88aa1c38017ea36800ba7288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c67b7acabe43be98ae71b79b7b19529

SHA1
dbf53443bd9f4779372666b14680544c83b54357

SHA256
776785da183032a3ab42fc478704c063b981b1202e613a5c4b154a374377b5cd

SHA512
a568e02e6808e253c367a5ce84710389e03705da3f11fa96af1ce19db27cf7b85a431c7e02c423c5d8052d5e3eb4b878b86c9373cd92ad857cfd47cf65c8ce96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9e35d1bed574785819239a67836329c

SHA1
216875df0b26389d9c47398babebdc1d81ac23ac

SHA256
ddcd2840ce08092118e3293963c70cbb289044d66cbd641369429629e7d16131

SHA512
7ee7baee57cc85e0fe135e3a5425c02b2834fb27e737998324acbf489501792b15355738cee43b6116dfc71284efec749c4a045bf24f9261293910245ed36f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8944c29c9b424c06f6ac29aa87df24d5

SHA1
d91c2ffbe29403e944725b622f4ba79b68076309

SHA256
9893ee14006673577c1d820bb855b3b10a7b036f7a39587232ed32d2c2a2dd2e

SHA512
1a69391f027600193a2694a0c35ca94718b13230e9464cd963f3d116b3a94314dcd78afff780244d4725da2850a34e5dd3c66cf48273b54fd159631536413224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66b088bfb9d854fe4c9a4ce13f5b4772

SHA1
fbfb204cbfa229b3bb4114ae8131c99feb673b4f

SHA256
c427f4bd24c97a07b44515abcbe5b3cc639592999aeac08da77c0b55ae919e89

SHA512
8021b13a07d0720fbaa49542495b0d00fa8ea85faf2cbc8ea7dbd6f036c6ac29f10068817beb7305fcd3fccb2381bc0d797d5c977fa6503a37a04b586e9951c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D2A.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit