ba728af86aecd9873a0d21d1991ac09723b2faa07c13f2a578bb8cd77bf08b32

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58966a3e35d06318ac1f5bf5da5a1bcc.html
Size

1KB
MD5

58966a3e35d06318ac1f5bf5da5a1bcc
SHA1

21355d6256df3260d57e5aaf5558c366cd9f395d
SHA256

ba728af86aecd9873a0d21d1991ac09723b2faa07c13f2a578bb8cd77bf08b32
SHA512

40c4840019646fc6139ba40d330a937124b395c855444bd023743b6ce0714b3cc6f12af60e2009712201f6d460eda31523befd9d7d37d60c2013609d221c10d7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000047a7f540593216fb1a8d04be2fe36648ee36f3012624edbdb588295007f6e7e1000000000e80000000020000200000005cdd0d3a399f874bd6cf8d374e31b6f9713df2f63bbe2f7b0cbc8f6cf6d01153900000000ee5827f3b6943cbeecc29e6e3e0dd410e4d99bdc8dc9d2288104905a848ca701b9dcb71bc3dbec83171ac64b8cb972ff3bb420c49b05ae08e2f80d9c84640726e095d41d641c897291b5e79d52aaab92a7603dda825cfd9adaae7a753abebfec0c5ab313a729c0820bf2c6eea9281b2cb97a777de1cbb9a0cfccc6e63bd872e8068486d587c34aee2fa1d1d07c06eba400000006931f7e322ae0922036584cea86d8804e106b8dd0680323dee53a8b5f22a6337b443bd5fd0669169a0939a393e6f9ce56f81898b84bd8a1491c176f59417025e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79E31621-A15D-11EE-AFA1-EEC5CD00071E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a6d34e6a35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006ad8a3bd449f38246cccc59d31bc12a18f105ff63d988355191c20eb9e5c9659000000000e800000000200002000000014f106ce419480bc24d30aa0c9665c830e0968db8176c169ecad69d466bfa1b720000000027f044f698269ce6a92d5cb5d1e376423bbbbe817da512458ad656efd4f853c4000000058af1ef2216e5611fd66316d7dc83a97d153e9081d16443002a4fdb5af6499a85b03266c5e7b9152198d305f4da7913c16ea6cc14485043a90d8f468c6123c96	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409475203"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2136	2044	iexplore.exe	28
PID 2044 wrote to memory of 2136	2044	iexplore.exe	28
PID 2044 wrote to memory of 2136	2044	iexplore.exe	28
PID 2044 wrote to memory of 2136	2044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58966a3e35d06318ac1f5bf5da5a1bcc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11e9ac5920f636cbc48cba7b41880776

SHA1
2e5443b84f2a6710b1381223f21ccea563ba00e4

SHA256
7135b94b0289b936c32833cd965b4f8fbb07dff5b4256d6cd32c4e6d888b1e1c

SHA512
e3eb4d445f03da0092175dcc80a91c4fca83165aa8264863ec37fbedd0ff6e74bc8fe0619b720ab194d56c3dbd004f1515dead4bc9fe5ee3d335cab9da014246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a36de2792330a51fbbbecdf63476ec

SHA1
eb372dc6e441464b35b253c05706d2e5f33bc316

SHA256
e58cb57258b8b35b9cfef7ee9e79d66c49f33d1375db8a271148e651ff84020d

SHA512
188c68eecafa53402fd5b25bf7bc9a1c5f77a7e6ae29b9b738495fcee240edfca62f8f07455f417152f4291027834dea5e71c20508f8389b08fcaa850b17af7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba37eaf13c4c684f89788dd7414f4d2b

SHA1
36ea579fc6eab3e3037b4c876dcf561780e1c801

SHA256
29cbf47f83b07e245edd5a00f7193d4b0d0b040bf5cdb3523356bc995c0d3da2

SHA512
db482c1d581cfd2c16171128610767441e5341940341d5b9b07bf6bc11f313d9e0c4b8fff6158a8fa55bf3414d9dc48d59c1fcc4ec4789d0947744223400299f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a9dedfccd5b9252c63318579bfd09f1

SHA1
d509be83ff3c627990ae3460edb95baf1c861fdc

SHA256
236a86bd278157443c222fbf13295726eb82021659919ef01892ecaa42af8015

SHA512
6bb2b46d3e03ec694fd6398818b8049612c26d4c761210bc963c4594a86e018ef558076c9daf007a5feedba12fbc6e4008c5ff20efb5d5b3d6c3af52f5561a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83893706991b3c8685525af0609d36d2

SHA1
1155988a773e0c0ec1c0b4ab4661b6e8f7ae0378

SHA256
d9ccc693bf2a9d4dabc2d59f00f2c7b9d5d1d6e095d6fe704e204c6857cf840b

SHA512
0a8244037495dda23a591864dd625917c02c926f3f35e198c7384c4d43e67b8abd0cda7cd8fdec643597405bc0bb04f5939e93393fba1a821d0638831ce0d31e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20066b70f7eaeb72a98c9eff2e657d44

SHA1
7f8a8775c4b0cd6967b91e046bd5ffd5d0a1d24f

SHA256
fd938baf26553775076e58a9040f8608a57ff0cd21cdb59d07fd5fcd98b28c2f

SHA512
328ac97b4a8a9033b5e87f2682b8aa82c29011adc3ca7c9f728a445e19a239722d8905a9312de527a01add94d3aeaf0897441f327f5a92785ef603f1767f2958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae1df5e9970841107c7b07fd8f8f7eda

SHA1
e392b0924494e46b9dd8c5c5ee7c4213f2082654

SHA256
c903e2886a3c83a99159e6556f007c19612aef67227323fb75d968416bb2ec42

SHA512
4441413aca0a8fa5c9a8e0c01fab7b451ca423cb316d52526672a5ff59d14ad2cac2fb47714efbfe2cf38e3b070bd5fcad1fc0bbbdfef0a8bf6c85aa3f4b946f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8766c0e97c8bef2391c5988e6668f99e

SHA1
b8d9a7aba2f36c4fb7953bbede7be81b88c6b322

SHA256
429709585d1b9907e784182accb23fdeb633fb3c855ca3a25b1378b378130085

SHA512
dc9ec2d18cc5525cc1554f7fe44e363b9945fc0e032f151a51ffac7be2162f6afb8ff259ae32d495f073793903912921875e7f395ff1d21b129009ccf04747e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f2640236832df4f6ed2c9704bd9c1f

SHA1
b9b3fbe3b55ba45b2710f9d157e52241af9180cb

SHA256
b90d4e088aeef5a5785977c87dcf4b9d6949fd04aaac2f84b54849fc727fb3be

SHA512
d7182f8bf4065f068bdf60091e29b487ff6371498f9dd7816f577cc3271ed3684bf546ff24b502cadfd2c374aee0f6f8ea931cae9711b2e6034fd957ed598259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7078f48107cefd1ff0a2453b75bf06b5

SHA1
8350e2eb99a8e6ae2cffad68d3edf71a138857d2

SHA256
c687a74c9087b87844a2d6d4bd703ad7d5800380adc527ba86485d96b2dd01f7

SHA512
d50e2ce6e5be3942167bfe5cadadd499fd8c1464ccc1417c89b1fdb92459f4d974088371d51ea0747ca99ad1732a06e5cbd022d216e15d6c05e6e14e296c348f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eced69c76a543f9984902d83b17ca95

SHA1
4d83fd3d70433e46ef27e07ed082f1ac9be69565

SHA256
43b1aa2206e1cd9de890e8cb90a0e7e3f5869c27a7db5821b1e7fe12af0a25e7

SHA512
b42a5d21ac6c73853dd6b5b6ec0ba87e53303b79063a622bed4627e5ec37a7c740734416445b4acf9f5011505d4ef826fc2e4aff7be93ab5ee80336f9bb8e108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68f9f450313be745f4b4641cc4549504

SHA1
de419cde687a7ea472a6a07909a50dc58d67983d

SHA256
fd2780ff753ee14134fffd96742b1bf02fdc6c68e2abc946f3d4ad23a3579a26

SHA512
26d8fb28a8714b6d7beac391fc6d29ed9fef0dfb0d8956388d26f663f29365dfa8c752d7c5b289789ce0c35fd2534523a360750f94f8655b3f708165440b6820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef9ed4ab30acb3eadbd934a40dec3f45

SHA1
a0bb9ebfbe766dbf2c6122d0f406dabafa4ed2d4

SHA256
4680b26360351393e119836a555db6471414a32ed02f0cf6daaaa2cd2fc992cc

SHA512
b6686724795f9583ac891134b63b0303cf10f8652d36e9672d2b56179c6582cc3d8be8c05b15efb80ce8e0718b8c613457d8e822cecf39672e3b2365697fb42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C25.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5CF5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit