c2f96f8a4ccba41ca619bb7437e951041e94dcc4acaf668b5246df0531032e0e

Analysis

max time kernel
67s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a73053b8837852bfe1fc04601d511e1.html
Size

1KB
MD5

5a73053b8837852bfe1fc04601d511e1
SHA1

ab047df4b1b85dff59d5c1006590c2924e37a866
SHA256

c2f96f8a4ccba41ca619bb7437e951041e94dcc4acaf668b5246df0531032e0e
SHA512

6f5cad3b0ef98c5b6d6a2ae5bcd98e3a6929a12802898675b5497000aeedd61bd406c7d7e310633449ffde6b062d5d2ab91180e2d07c23fb40a485a827333c48

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3A9F2E1-A15F-11EE-8B00-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08912996c35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007999e973411c6c2d84db0bb711061194f61d422d2a7f8909beac575b5a01198d000000000e8000000002000020000000cfa5cab318cdf83b24553bfee90526989168b566c350e4310f7bcbde9de3e61a2000000067ff1e2c6c7702c8c2e03e0ef5bd1ab898079142bd19d578c59e724d5db5c9584000000090003a73b3b6fce8a77db47527605cd18a7f37214bbc22595d12e50de8f17c78d36567d0748c5eb087aa755e48b4de7b93829a44770a28ef1a425422b4316b78	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f56dec983b21deb535113060db28ba7f235e277b9865ad5b0570e183eac25788000000000e80000000020000200000000c59af0f31176373975091fd4f29b5f302a8d512142074a8ea4ee22ec487b4a19000000087514d64506d14e75f19c282246047bd4672c93cfc94c4053420fff0be9be22f62e64080a4a924a28e8dee535252f340a9307fadc0eee735c32f790c722064cde7ca8ce396e6e81d6b2ae26046e208a2212f4d3438cdecd08055b4d37b53ed996cb35d29b7e5924106a5603df8c7b508aa1fc9ae3bff28e0d210eea8f25c39bb1891ab4c035f6994572af155cfabe76e40000000296c6d4a044aa500af616fa939cacd6d3f94ba61f36dfe9c7ddab4538b2c4242be2f63640a95700e4fd90deaf0987fc4d5e7670f0ec481f96dbb27e098561ce0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2716	2268	iexplore.exe	28
PID 2268 wrote to memory of 2716	2268	iexplore.exe	28
PID 2268 wrote to memory of 2716	2268	iexplore.exe	28
PID 2268 wrote to memory of 2716	2268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a73053b8837852bfe1fc04601d511e1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94eccf9aa9e8d3a85c3321d60d9fac20

SHA1
4d01c58678121cd407c8c13351d2905bb5dbd520

SHA256
6d3f6aadc55b19fd1e23d221da22615d31c5ca21e8904b23aa8fb4191ef18e30

SHA512
3393f86cc746c7b883c01079598b604ac7d43925c932b6b96146326e5e8124b1cc816e4713ed6b3243d74e3dec29e50c6efc371a23e9d29d8d2e500419b0f504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5057d558e7dc2b992b0b92e5b70774e

SHA1
3bb3398f502b421180a86ebdd70ca86bd3d8adc3

SHA256
549f453411c14236ce504cc6053a8d20e2136f55d4969b0f1ef6c8dfa5124985

SHA512
549c3b82f7dd4e498d37d4b7f6d1751ec5913ac97515906eba1f8d450ae2f84dd15792ed858aefe26f5f199466ed6f4a7db9aa4b93312d8e3d76b0c610d9cd7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95fb84147bc82679264f51f7d17f9aba

SHA1
f506a2c08da0228a2f4dcb8fd455789364ae8405

SHA256
f588388f41014cd2667384d049e3192d49c5a9ab1afbb3603b84ea2188abbbf3

SHA512
9456f275ae520cb0278c610ddbbc7a8ab9bf387f342d85af1f375ddd90005f5599b1d59388e0f60e2df28588b345876f87cb7608da11102bca82efb9ad550d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13371a30bae7aa675d35a6f1688e058e

SHA1
b59068cc090437c712f081be203c6a33fbd304da

SHA256
8a3725cccdb26d8ad6cc32776ac5a5a8b1f8b2cec26477b085b40280ae93f843

SHA512
7723739fcdd233a5beb007377983138941829c4cfe2bf53ba8d432b01c1f39fd21fdd9f558572fe3c77a0d6b910c564733906ed6c88525eb45b446e4db7c07d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e428a4ccdf5149a7d7dddae3264204a6

SHA1
306f682ec256385353471d1d79b8ad65100ea212

SHA256
51501064d9e4c0ad5fe44132e7fa7bdaf635ced81e90b6758ed0e9881ff038b1

SHA512
cc389d7346b6a9c6dcef32221514d90db48ff7fbcad7d78c7e798cb73e103e90100ffbf27782822bd6285c11a457ab10e704933d208f5f7bff38657855f68bb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18a603c2c516cec21c73e4fa6327779f

SHA1
b5f434e313a61f592f50d38234b8af58b25d585a

SHA256
595961d6306eeb1b1e79c027dac18ebc400997f02d66401029bba8c104be1caa

SHA512
8338935da12ede47f224a07455bf39f6b96567336cec297f2516005b137ef160f36a9313a524de4283ab61dd075e8590640edf4b5796798510bc3b6eaa602d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56540df3a1821917ff5a193784d9784d

SHA1
3212bc8295a21e41dfa346d968273d2c9afd2754

SHA256
1881d6feb7847c3a8be5f4394d737995169c8f362f9678487cb216eb816a1aa7

SHA512
3b0b4204ce7b44adde8ef44b114ecf3f7bb471aecb5eecb09d878fea3c7994442428ab2b31436902e8b3120a5caa8f63a271613e5e872debd1441c54b3bf36d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
697d6089fb3c147109aa1ccfa94eb0f5

SHA1
2cc1fa2355060aabaf085b419482817255d315cc

SHA256
031c2c83a50b98a275e36b9103f50df8096982fb73cfbda7c37d3b55e8e51d6d

SHA512
2dcc38d543fa1bc3395df34deeb595223072e2af8887d6fa3b622194a82c8c3b21ad93b712a2d0b8ac6d0916a044731adcad6ebc4b4d67379a8b38435318e951

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54D6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55A5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit