1bc1a6cf6b26f82d0bb7c8262c2a26486b2d558a9817dd66fa3d8c43fe1e6d36

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abe1a0c01088f4b1d0caf540b7f09ccc.html
Size

2KB
MD5

abe1a0c01088f4b1d0caf540b7f09ccc
SHA1

e28cc2e819c638c79a08ad4bf5bd7fc67e37eac3
SHA256

1bc1a6cf6b26f82d0bb7c8262c2a26486b2d558a9817dd66fa3d8c43fe1e6d36
SHA512

1dd84d68cd685e8e7a101bc4afafd11e4f1c18dcd401e75bcf6e1b65d73d654b2455aab0cef63169800137daedca95733625efb1283807a8fa70304b4a77cd48

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2CCDFE1-A0E0-11EE-88A2-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000047d66bf961fe24ec97999e95e1143af18601f9b8811507bd301d07c9927ffdee000000000e80000000020000200000004a00186ad974b062f840648f29a0ec769bc64470c3a7418b64df38f125801b259000000070185c81fa5fe1916ca62ef996fba2a185c5a116fba48262bfd49b16052898b8f3714d8bf1fbfe18997b12782464507af7c60badd0ce72aee517672cf3f192145a8551d6294001d7a1af606afd493fc018a7b8641386f0b08c2a2d653a3ce523857a9a233a7536a9f6c8d05a6d7abee42bb20641dae61a5292c52d2d63db65a158b39ba5dcb4240dbb2991cd2401495040000000f8c145f430abac3da4e7c753dfe6fd7317dd7c394422e8d37f1aa755bf639583bd9a9c6dd8ec6e8b38a4ee50e7be51902fb5ecba46246b49ba6a6f3db4b5bff2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409421690"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000c55560e4bcd0e5ba76161a7ba5c2b82c4d29e04bd9bb4daf6a837cdd5270c8cc000000000e80000000020000200000001285dc014ef945918499c012c8fbb1e66250f368ba9f75448aebaaa22e97c655200000004f3b02f26eaf43b0479a146ba80e22d09fee2454576aa41300ff8322fd33172140000000bcae5a4dd6e8ec8ef56a2396644f40fd2f1adee68131f19f69c16fc81f004d658e8757e96928bd44bb29181395d4f2818daff2500ffd29b0a5b33ef4117f6ab4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f64eb7ed34da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2060	iexplore.exe
2060	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2652	2060	iexplore.exe	28
PID 2060 wrote to memory of 2652	2060	iexplore.exe	28
PID 2060 wrote to memory of 2652	2060	iexplore.exe	28
PID 2060 wrote to memory of 2652	2060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abe1a0c01088f4b1d0caf540b7f09ccc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
495faa72efa39edd05152c84806fac76

SHA1
c2f2ef8c6b527ee93e5f5ab5678249de68075b7d

SHA256
0ea5bc6df7c98d02f0c2c09fbb74dfc1c28810c711203169e49749dbeea65d96

SHA512
ed7c217f201cde14f9762068d6d662749425fd5fd5ece62a4ddc04ada2faadb15ca3450fd9acc03ed7630bdd5af60aaac1634aa8f68a22bde4554f0bd167fbf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
006bce5369602f7c4032189035ac7b3a

SHA1
0e4f42b5666b6ac65a5c096e38f0b95c48db33b5

SHA256
d6b179bf6f2a7cd5fdfde2610d6a11bd2c7d73685dfc1e732d20df0c3d0856c6

SHA512
595a6a1eed3ebd0b7dbc3a7411b7e3f25bd6ef3f290a62c078db4c6765c4d01d9561a0f7b0e94fd562555be1756208142ff16a406f7bbdce86ed739488885b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b36fd16be7faaaa772173c1a8f61df3

SHA1
93389381ef56445d75b46f7394cee38c23273b9f

SHA256
5c542825e4a36e4f53b72abeee430a746305fb972b6780d57f0c8c0d567dfdcc

SHA512
8a83c6667e4ebf4720c141757b55d4bfe0961bde2c19bd9c90b81a46b58f0bc8a5a90cf3f71b68f48c6c62027c382fa394d99ea5d77464f057bfdabb398798ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef87b62bbec18d8a70965f1104a3d796

SHA1
24438960e6edc23e46944941dcf384b1502130fe

SHA256
49e62139aaf295d6ca255c143fb174ebcd080a35f382bcc6f3befd4ffffadb7d

SHA512
c0fa633a3c4ff951fe2e047c16e1511179af289047873ad0f57139126137e40e652738ade9e681bc2f3a815d1d0d74b70e8ddd67e8ea94fa582ddc46fb4a15a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2c9c5ef43bec678fdae59637a8f858f

SHA1
5066febcc52b7cfd6ec2165e91f500a17885c2a4

SHA256
5946862805b9c78377ea4ade89f8fa20b0cf88735f1c068eb71e6c61296d07db

SHA512
699ef9fe77fc3171d673eef520df19f9b58e81f0c0e254e1e9beda860a371eeca1214db40afad8f1875d8ed5f40f5a0b64bfb1ed93fcdeae3d2cefb979e1eeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd8ee7e25fbcd1278f7941c353d144b8

SHA1
c2af222630925f034c08331782296dff11fff1f1

SHA256
ca33586472b89a9e83daae79861851338f2d8fed932d0480fa6e73ef1097479c

SHA512
d28e3a973b167c96907111d5cae7bd3c619e7d62da579069ad718a06fc871138e7d8fbb0d0956bee98db8893d67b5afae8d9a4f4b9679df3cfefdf34730907e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9408393f9fef64d939cf6a67cab489c

SHA1
5bbb899e4f794bab1e4e12fc556a0eac717e4353

SHA256
d25909d29ecf79ed07cbf83b798cf1d04372b6ef0b129c7ba5d040e1bee2b7ea

SHA512
f794980972bf0e6e4ae68c067ddb3dbc7793f2fb7e148f9de5ea8dd82567c58527719bc0067260de27db3ffc13a975fd2cf0ebb8e5dff03dcb54399827345151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f33e2606850053234a4bfdc3b37ae115

SHA1
7bc6d835a9f79045496bed305ed2558af2dc6940

SHA256
331d76f08346b9c6431b59db4b149ba2dab576133eadb41ea7d0b0b846f61ede

SHA512
04457ac45f18c0ea1ea085abf8797da481a7dea8006539c8a0c92d433437ff984128448637761ac0bb7e316fef269f68a2a920d102317e8b7a823f16137d30f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35e4d1ba07796d9c30b77d5f06d1a595

SHA1
112a453dc34643281857a230bd2ae574873116c7

SHA256
f8b45fc1b3c259d2f6120fb1950569aa44fefae4560b08b3ca5dad6790fa34d6

SHA512
30ba0555f53d867d0b103d9b0576471a313dfc4df7dc99810c29c0d137ab9f7761809b7b2cd759814c05c0dfc398642d7251074dc2a2d300dfb73f6937bb0263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1bd0f20e0250ccb02f3e52a280af597

SHA1
93d63d4957d5da98015ddc802dd2931729e58934

SHA256
880e39141f32a97cb4c950f378c11cc5b22bdf1768833f032415bf55cb1ae099

SHA512
54629a59a7f68b964f2506605fc29599f8490fb5b586bd3d39041448b9ff5eb6f1b4d71a1d6f5e15a49bf6abb2deda5273dd457ae3a2099fbde4319c8c474c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d2f7fcc615d828dbe9204a7211cd148

SHA1
569d23b01a65352c2a9cfa1d3c2d61608cb1157b

SHA256
bc7d9f87e364cdd169d529861d762dbb43b552f6b8cb17752b36a588efe1de19

SHA512
f95a8f2813e91a716a57a9cd1b2db24f8ba8e0d8ae4fc393c2bd0e90ba6f02d1868edaae9da8a6be76179f4f0889f98a5c245d8a420818d7d4398ef251ad4aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0537e75660f6f3fbb77f5a10d81c78c

SHA1
b31ce3907e3eade220287da9e456ba590ba9fdb7

SHA256
52663f1249514bf867ef30ed49ccb2bc66404dd7d3a8ba42bb5c18a70be3dd60

SHA512
0424bf23d3c5b1fb71235a25b3658027d1e48404733caa386ae7b4aa7f6468aed00a77139fb5253e8db7899ba07726d9c853c654ad3c036a3899e6529e588da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd3531c606b4c6c038aeb8df7bc46bd0

SHA1
35dbeeb71536de3863f05c2b0ef00324e1b77709

SHA256
21a79c54140185937cb60fad52c8a1e6d126d133778a416517542fc946e6eb61

SHA512
8545a0012a4ea1baca6612be106da0486904bd3b4972cd59c8b8014a83121b19c0f1b096a06222604a7a9c3ad24e0aeefb28cb328f5183dafcd26c787e1e740a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa44e4905f2f07a27047650642060898

SHA1
f9a48f7f86e0af708d1458fdc7d369d45eeb23a5

SHA256
009fa23d7befbed711b53f07ffe08f686a79063e90cb2439eaa050962ac57743

SHA512
ce7cee4738425394d6ef13bbc5cac354a1982c8fa323ec1523bf5b258f4951e7dcdb175da3c71c1ef1b9f6c9d4735c0ba7e2850a0f74c54ffcd48ddf80c8b84d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6126731eda9d32ddf22d73900270de8

SHA1
6a9cdbbad7e9729800c330cedc39b936dfde8b76

SHA256
b60a72076bf6be8c6b2015471c839ba03769c1272dc017c0fc10550a9e030c13

SHA512
0e9418c7868bde077a897e33372ab9f9d8432aae564bc999ba3bf80fab9bf1bc49e9d423479b3853c358701ba20e2d9e132761fb92c311defc5a950b405eca84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cb536c7a117c8a9c5478993c27032cb

SHA1
956fd25acda3edaf7f3be7cd4811251761535d83

SHA256
818c5258c1e84332520f712a6f3b17a99183b6956af489ee06c9ae37599079f4

SHA512
9e9e0c5ac0f94243a0774b97acd9cb88f94c45e700c49ec1fbbac77fd5d7ea0a214adb820bfcdda1cda0827e8af9c96c4de496301c7c16446bf3778c58519e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae352cdf27707c73c040924fa6e549c

SHA1
8bf0e9872b958a6a3a268c006447a3b0d18c7575

SHA256
b94e99e1da01abb3ccbdee44177c7b0fc99ad2e2bd3971563165aa2aa9c3ae1f

SHA512
212ef950e3ab9dbf563d8484432b6e30da2312412a2e799df37064c2ad4918055fb67001a223b46c884bda79e60d39f28f801f15f7e5452fc32278ed9badc82c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21C6.tmp

Filesize
21KB

MD5
189bfeb4e90bf09e3457a91964ab0709

SHA1
e2fa3679e281ca50a297e3b7e5fdb66efb9c21d8

SHA256
9e5e2888a1e7aaf1d0cbd89680bdbf3dd8618ab2f9c0dc29bf826b14bde6ec3a

SHA512
fea5e3562dc82d7db2899eb8f374dcecee44f2607b819bb96ce5e365272cf9a6a025265e7e41091bad6b3e73e28cf61eae898cee8ad3d42f1f135f450fa7128d

Download Submit