6134baf8879e2cf7cf8c2c3bd257bef6d2bcec931a899a7db8d054f980470fd1

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5802f5c6bdabf71e5e9f3c9602f5433c.html
Size

1KB
MD5

5802f5c6bdabf71e5e9f3c9602f5433c
SHA1

64038342573e109fbd70d45120e2c0c95fc3b818
SHA256

6134baf8879e2cf7cf8c2c3bd257bef6d2bcec931a899a7db8d054f980470fd1
SHA512

c80cc4d9be5dcd79b02d55bec3d1fa8bcf4f6df293fa3bed6e3d6661844c781ed5fd65dd813adf9a7a199c5605cebb2bdbc4fcee5f0ca5aebd6d4deaf8373695

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{831293C1-A15C-11EE-BD45-D2016227024C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000009bba8ea65874193aca06f7dcfb350bf4376dde3ac39bfa4e23f5c0055ddc4daa000000000e8000000002000020000000f688e31969754a578abedb37780d0e93565f550adcfc00bd5a89a59127a7737b200000005ff10f27081f9a7505eb488d05743866c6b1cfb1045aaadb10817558851d8e5840000000e38a890d76742c8c3ebbed8418f8ad0b5e3e91083f8b38a68a22af9dd50deab579740c36792aa36f1878f194de682462b8420d2f3be272e38ac3dc5ffddb3e78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3014dd596935da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004752c7a34fb71fac420100108ca4a7c8fa794101d94c6e0d4909bbe6b6920980000000000e8000000002000020000000029b6581ae97b62d844641f3cf39a712e10cbae9014c0330523b85e9a9c91f2f90000000f782599a111b54ac37ffcfb580ea999b93a3d3c99365e33ccac3e80012f46fd786dab2456f6dde624b9b8b2d23d1d6709a2181cf53a4d8b8d0b3c14b704fd3a94611e8a4f8504207610894bb2f82bbcfcf6a45a1d21de60733a5c7d7fa4cc3a2eb3a1d25a92a04fceda10a15af4a775fb69fb77ffbe8d4ccdc2707dd2c3e317052c965ab02b32e551b6e323fa991beb8400000008680ac5bb60af0d7a1e75a0943c7561f2fab8d14036a005c3007ed39ebce0d816143ed9d770c079b45623b0cce8c1d9cfd3ad73f2021413f6e1074d15e93eb37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409474790"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2292	2224	iexplore.exe	18
PID 2224 wrote to memory of 2292	2224	iexplore.exe	18
PID 2224 wrote to memory of 2292	2224	iexplore.exe	18
PID 2224 wrote to memory of 2292	2224	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5802f5c6bdabf71e5e9f3c9602f5433c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5240acac930069bda3c46ee051034cec

SHA1
f1717391ebff1c1512c4a42462f045f279ca4e06

SHA256
fc51235b7e7e63fb31f6944bd13e6d63ac4cdaa0b07de23def174021468893e7

SHA512
832592cb889d3b0348724e9df30bcc0fb82dbfe9f83179d44c1d423c373f413640e437d7f778320bedc794b7733d1f89968cd64ac8cbec5275294fe52c5cd29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af532ac6799aad91dad08d2e1394bcf

SHA1
268ac1792bfc29b6071bcbbed1013331db7b6e73

SHA256
01ead94fa836996b04e61529ab3722d14671b1622b56cb993ab8f7aa44ae1745

SHA512
5098a6d4e2f98d4cf04d54606b94dd0b0eae599e4e5a36e8d247f912b1c363bf695518bb70fb1803a7fa7c2ebb9120a1593792b7264ca797aeed4648222aa627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bb21bfa31dcbe7cbef956f7f5231988

SHA1
770f800b19638e2308fdf3e99735b0476fe028a1

SHA256
168bd45330d1215dd4c65b7d0e7853cf4b5646d5d1589ec19ebef185026e2375

SHA512
3d19989f01f9b8f9f0cb206c5ccd30777740ccc33e3a5d2d377a3a445deb44a8630c5c8af3611ba3c4f2c03e0aed78aad1ec400ba8c53509ae48ea3822ef6bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe5355221337e08ceec888cdfdf3bcc1

SHA1
b6c09959fc16539958697ff60b7e6664f332ab3f

SHA256
9d83b7085ab7dae9b9c90937c4e5eaafc5561e202d66f9e3cd2aaf574f6f7a42

SHA512
0399d8373275c197fc05eae2c689786cefc6a982126a6f31de4316aefa3ae984a696c0545dccb546612b5c1bc583218a36996951c55b78d1951149683b3ad84d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9a347b489122a7f39bb2df047627c80

SHA1
85c7519a61e9618a790c20f6b5541e16c96c0b9c

SHA256
ddcf36ca24d5834c01608357cb3f2248d4d34b5b90312c0437270c7cdf2edad8

SHA512
6b7d36b77fb3f196bbbc70159f179db1f9a7cbe01a570c41a25382a56dc7a1db0b36dd3c578794c67628cab52ca4ce9656fa8821651961c34285cf1918839231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1b3349ed335a01062986b5832cb0778

SHA1
f8010005db22e85106fd003b2fa20bbdd6eaae7f

SHA256
af0bd91b3e8f667a449eb8b4d610a251da31a48026f3034cc202775b059f4431

SHA512
cf319977e231da2c71851147ed4187ba9de1acf384401c8b90ed5b3ba55765a0eaeb9f07bc699c115ac336a1f836ef8b5d7a31ffd1ff702cfa20fa3fdb3c2288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7019751b0339a2babffa43a89f52e3ca

SHA1
868d8c68571e9e356bb38b002d73b4b6592e56b7

SHA256
de16bef5de05975642965ae6ead6cad4fdc0ec7de9fa8bc49329f510078f444d

SHA512
abe6f4b001c0cf34eb616bc4c5914bdb2ea86bd673f12c6ebf13f2589035bddbda38e762cfd785bda3fc8de99c91f504ce905e1196d5ad4a216c6ef9a2abf5a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
348592c151d5fd48d79fcca836319f8f

SHA1
9d718dd6fd978fba0c5237901560d4a5a05e807d

SHA256
4461a5910292b91cb0fc2bdb448d54de979225ff68f933d64a2d7423f576965a

SHA512
c542c49a98a4faeb1f908ba61f730f6cc481ecfc3d1541d020d1e3a3d7af6305b6833a27aa1ed8c972c945632cf755d36e2a5fcf7d4ad572cc5e5d5ca2469ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
053f6bf5bcf21e30a9d959f860ccf3ca

SHA1
ee299a5c5530ac91bab577e1455ad4631a2cc8bc

SHA256
010d460d0335a366d6410fa20db1ebe39b075978d9fce45b605da4fa62f73f26

SHA512
e055fba18a895c48e69f4a2378399e41244c2bfb32f6166b406a98661f81856107b46209547d72a973ebc86432149317133cff2c835b83a0a320ee3b49eb8ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c23cd1474e8c4b0506b8b7084bb7c04

SHA1
76c3cabdf092135a384f455b0b060c504db1f292

SHA256
153b7a8d8527db48ef2f9704ede4aba063fc1e3758a328886ac14378c78d5c07

SHA512
92fe0e5f31f77d1c2314418a4e9b560342ec5619d6b39aa13dd2afe89dfb28903e9126d6bf86fff705ad9bf1cca94eb0985e94e67a02213a6242c33743b6327f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3576e847418fe70871c2c08518de7d2d

SHA1
00eaf8b83ffcf359a2c64c8e4e4425bf6a87ba5a

SHA256
b8763f80a45682cab3b8b26fafd4faa84fc15f85af013c1ba8a6934c2aec14a3

SHA512
f59b0caa2e049bba65eda8bc0dda033ed90adc33e687fa09d3258718a6f8b37303ee44318ca2fb90167fd414363c894504284410c0c18c57b3f2e7dc05039fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fee253a95529869cf04ab34b398dd9f

SHA1
50fa06ff2429ae36143871e6e81435a9a86a026f

SHA256
75c00f4c27719a4e0c316ffe5e76a9aa6e4c5d81ad70901e34de7727870c5bef

SHA512
2b5f8af6909cde96277b83a140e406ef58d55860fe4be4b9de09b32c7009b21f2b8a62527a8f5464d0709df8ce49c3475ff51a6d030341701c69bb24a37f7f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB435.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5DD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit