72830a534019368dd8cf95ba40900b30c780cf817910a117e92c66e95603e15f

Analysis

max time kernel
120s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ad35e76d1e093093811ecb915580dab.html
Size

2KB
MD5

5ad35e76d1e093093811ecb915580dab
SHA1

5ee780c342790e1f4e2e6739060353c482ed13a6
SHA256

72830a534019368dd8cf95ba40900b30c780cf817910a117e92c66e95603e15f
SHA512

93c885edce5f67b7a9b23ced62642d02e7e9bf42996f3d12751840dcc58648b557937d55f5aac22b43b01c04afa123fa340f000929a21e36c848245b2bfc1edf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{297630C1-A160-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000bd5d4547b6c81c4a86fafc3884fdbae74d27ae8950ef0cb4987237c90ab04683000000000e80000000020000200000004f9e589e74fe75149f3319beb2be41c33d02c1be1caf3bd4b70e2503fef2334b2000000094a1e6b4b5f637a6b234c1fe4785d130cac6368933a3fca646305aed7adbcdf340000000b3a3969872ab738601cea4a2d102b1569b53cc8a2c9ad40e748ca5e026d1dc2ce90e1d68116a7f171cab95f7ae691662858382252404f3fe9d8ced581d651a86	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000030d8ab8749162bef8cb3beff1f5ee3975e86d11f50ff80d5083572e18bf7c6ba000000000e8000000002000020000000ced1662c079a2730d5ae4e322e09f84775b49157acdce8585524cadb0d1b118390000000ab4aaab0756de20a8c09ad392e0857ed3a3c36ed0e3887be858b7c53f0320953b89554f2364930136bd081166840bafe374cb81cca17814ba82b56cf360111b0e60fa0192cbaf8148f2096ecbebfefe2b8a71cee5916e64cafb2fb1ba462e29cc210f765951e41bb3fefb2be612cb3e54c502b573452904222fa96798a6ae89240f7d9846b41328003525a10a657740640000000f6b54d9de7a0ec19b1802d987ff9b17643ee4fa050b80ec4adc8636cdc2ef3db6b39ab24bcb86ef1ed9c0f6466065b5fcada9d76aa94ba87313db48f869f798e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409476362"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01282016d35da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1388	iexplore.exe
1388	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2752	1388	iexplore.exe	19
PID 1388 wrote to memory of 2752	1388	iexplore.exe	19
PID 1388 wrote to memory of 2752	1388	iexplore.exe	19
PID 1388 wrote to memory of 2752	1388	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ad35e76d1e093093811ecb915580dab.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5f5c28b30c519cf0c234ba9a0de1d74

SHA1
0a8decfdc587b7d1d1342cc116a8d3256def9244

SHA256
29c92f71bf515c44b05bcece6e76b278b34eab6a58415baa85d4251dc74e5bab

SHA512
9493d86dadd8beb5dec72070edf33aaa08f6f6d62155977d66521e3771962d0863e901d866e569ab17089a60c0c650e34cf6c82e73cf26846d31365d9b7bec08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
409578eadd45eda1d06e45733167aff5

SHA1
fc602348cce0d58623f4bbae494e46a54d1f1e8e

SHA256
7f6983d6d2708ba0d662759cfe8ab5327c09fa15d20768008b510e36b5ab67de

SHA512
4ea0953649c67ae060c89e417e4aea8708fee39653d442689ab4a1560448938f5fb918f4cca8a3447eb25dcbdccfe8695fb24eedc67683f26fc278e64f553b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
982a4942df2220a369e32e160a1d3cdb

SHA1
a7edb766787cbc624ee553782d9c358cbce85da6

SHA256
1b79f1cbab467b7f9d5a26f01c091dce6caa31d0a2f14dd92ec15988c6340d11

SHA512
91490aa63357a1232def22accac355f96f70c92496cdec9448b5a6f9332f9f08896333a84251ac9848ae86c238a2f6de5a5a0e98d9ba1de3e82b1780c9ddf1ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b38ffbbd001d550b094a79047287faeb

SHA1
8502ae76c02120e7c26dc50ec397dc9107a5188b

SHA256
81c3deb75180958cb78e5c4898b36f061bf098250c824bb9751000ab8eed3ea5

SHA512
b5e4c5ef6840f2c2c01c844d99a10a000f6c21d3c2cc5bac28b7998334ee0d9f56c63208c5f1e23aa7c2a205cf51f1f58d1a576177f5d7ad6b7e8fe393ff950a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba5a4c4237e74c020ae4b3490e9bed0e

SHA1
ba7329e7c63a2d63549f58e63bfbd9d21bd29be6

SHA256
9546e992c56da4015d90419a393d75f4225ee7b8187377d070e26ce1369418d2

SHA512
05861f0640cd0816aabd977cdf4b61cc99e99d3fce2b63e101428e9fd80ff1d475216db23322917d6b36aa9cc7800da7cbf4126425976d3e6f9bc40a6716b35a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
782fb3fee46b555a1e01431012b9181f

SHA1
5dbcb6486d481ed26f961745d7546a477cd06210

SHA256
4571caa677b98e9befe3eaf14f2f0bd569575fb329481121bbd74540f6dc86f0

SHA512
c01fa2bc974564b2deee40e557c61cb413822e31f09393a4e29309b416e983c31d5e1befe97913cd6c053c5cdd1f4e3ac70524d7fa1eb88dcbb39d9442ebece1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9945.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar99C6.tmp

Filesize
91KB

MD5
b9a4811f3b8ed0c468f1fe91c299fbb3

SHA1
d70e5483ccca257e9a400f44a0bec7cb860a57ac

SHA256
4d4d391b39bbf4a6a7eb5e1b1fe131214ceed5880b947c8a43a164ab1b8c4266

SHA512
32f89717766061ae30fab526a0ee6eadc72d149a8ade527af3a157c1c8afbc58887401f9c4406e533f6cbf24cfa9ff7fd4d640248010b602c41606c88e27d63e

Download Submit