c15faa07f9a464de97ddc41c5c7f41c83784291f77434fed152e657f8fadfa28

Analysis

max time kernel
122s
max time network
183s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a5b82ad7e9fef02dba0d5efd3549b677.html
Size

1KB
MD5

a5b82ad7e9fef02dba0d5efd3549b677
SHA1

8cbda568feea3bcb8d7e8372b4124dd90d37ba93
SHA256

c15faa07f9a464de97ddc41c5c7f41c83784291f77434fed152e657f8fadfa28
SHA512

32a503b36592017f10a30f421b6005ce0603b3d8c202d9b436d0126b418dff0f2d64a9f34b02506ae0f42af5cc72f3171bcea89196eeacfc13041c39e70e1bf9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000848c516e3d8d7079e9886bbb4b3a404a5d1c8bcab82da7df57796b37220165bb000000000e80000000020000200000000e44fde1572ede37b239b405d399e451bbc03cd66a2d9a2620a5aefb62561e4f2000000040df426a6dffa3d8d691fbd61ad1cb2a041eb9c912c9c0a9d77912ea94a7f26f400000002e66285a79564cbef66377d750af952efe19bfdf7e6d8060f9c34e0097ad6d366557986578637aee13e6dcb6e1f3d940815281490d206b65dba1620e84526ba3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5ADC2471-A1C5-11EE-8C00-76B33C18F4CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a68325d235da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409519822"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000009d024ada49711529056d55ace53130ae06c0e74890edeb5be324610def71817f000000000e800000000200002000000079001a02480c30ff7b94b9a42fb6a50e30ab66a51387496afcc133eb291557e79000000023ede0ca34df6e0015c67949e157c2f2e24a74a496cef3d5f3c18991a135b147ecac885d48798f61d38a5746ff8bcb5c7b382a4fe109f0100d7ba647fc9eeebeae1e197b8b98b061e916c5729b9a457717d9e3da6acb25c6e7033f19e7495721a5629cdb938dde74796853a97c79169c66c23dbc70e324115dd66d4b980d9c5303af534061d471cd2c1cfbfdf2c0863640000000115fab8e3a9bfcb794bd416e8a8fd0f6c5d2457a18ad26662053b11dbc9c1b5a977b8510ad7ea676fa47d157fbe673c9a5a8d235a7a958f06447ed14178c97f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2652	2716	iexplore.exe	30
PID 2716 wrote to memory of 2652	2716	iexplore.exe	30
PID 2716 wrote to memory of 2652	2716	iexplore.exe	30
PID 2716 wrote to memory of 2652	2716	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5b82ad7e9fef02dba0d5efd3549b677.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43e8045faa2e7ead2af3630e62b3fcc1

SHA1
0c93447fd8502b0c0a9e6e05e0a7d010ae126339

SHA256
f2e1e7227b9f4d3a70356d14275f77dab533e8b2b14fd421dc6325f871dc7944

SHA512
1e33a0fb9f9f9fc5ece6bed3daf3f46d52eec2038ffe9511520932874b7501c89ccc260a981e89d26f1b7b13bd0e50936e964cd505d04ec197b57bf54c6d3a23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a80d98301f8fd116743fd7c19356fd9

SHA1
f26b4ca144c6688944410b2b84af67c781e4311e

SHA256
ce6b1e2aef83aa90304d6c2643c781ef5715e0c795ac0b13d3875dea36997399

SHA512
28179ac442d1dfc1884988836906207eb319f3f932e65ea8c2fc711f65ed83700ee088292f52b34ced0a3c9fa5bb75010329ef1507d8fd0ae5f429990ded5fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f7d37a7278b0f820024bb8ed3a236a

SHA1
6b78e15ba8709a40fd6033f886a44d43a979c265

SHA256
2fe63af00ec232a8efa66f2d478877138de4cad8095a0b0c2af81de8746efb49

SHA512
9929adf33328d817c02169e5beb6a0245ba5ed79871b9e0ab5fa381392e5f20278e3d87c4eea988ea98ace92d1ad8973d1699fd3634d2eec6f81990c4cde6009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fcef01101b20cdf83a8aeb603bd4611

SHA1
d6936f0e453dd32f6bd85f674043ae24b032aad1

SHA256
99528813f54f73db455d8eb7d761ea07e3f7667a6d4a68f62c44975e74f35e06

SHA512
76d1a6c7bc5ae0589f62876db2e3ebacdecaeaa60dee1150e649e02b06a92fa04185a26eba8c784ce9764380ffd6d77ec82a070ca4a83e59d7132d99a537381e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67af6fc49af86619222ce8429c8e781a

SHA1
88d9075b37142b993f42e2e99e1b315d61c2c205

SHA256
504d95f4f33622ed601648f9a4290db22797f371460176d85d0c3fba4bda9ff9

SHA512
fcb7681bdf9b0d6a6ea80d61fa97987ff6fd3513d16150cff802a91b9de8225fd6a042f35fd45c76fd79bc76118a56d1a5c0ca7a23d6b287effd72bf4a6a847e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98872d1f86ff40d2475eade55595bc5e

SHA1
20387c99c4eafa75dfbc12f630d3dabe51d19479

SHA256
d1784813976d4215f250db4c110e35d0b0dc8b42fcaf6f5ba7da4772aae31384

SHA512
1e3931b021d188567ce23d3b980f535d16801d61511e04a2081a930b79ca731bff3806e6ebeb9fefe7669bb2face7d9026d84cd6f200b533a961165d1c1b2c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
799315e560d48856fdb84dc7e04a28bd

SHA1
9c40c57656a0196add41ddd369126c97395f801d

SHA256
45ea10992b941c8272470b1bc17ee02756509bc5543d20205519a90c04da9b90

SHA512
a4f1130fa58476475d20a0fe8cca474f576236d605552e4f5bd9ee91394857654702e7dac2385cadd1cac928f929be17d8d69c2fb0bf8f4596b38c163cf08e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4ee04e3a35898e65909c1d2f575eef5

SHA1
a73e7117b9b40ffd807b05bcdf2771adecde3f55

SHA256
5dbd45730499e5cd150b1ce8e41aaa41caac67bd397cb61182597470e98d36eb

SHA512
0381d7bb80b61a7b46bb5aefe8f34e6cbe321466cfc8db43af083e6f2c6207598ff550cb3ac034f96791cd31de0809986a040ab83edab17ab2b93e7c810298ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0950b7435c5e26edb3a20e145356996e

SHA1
b1f95bd72421456f05893b8e5087a3fe9c94cc2b

SHA256
d8dfd1fb923408f1c743dfd7ca20399fbdc016854c0461515aaf3c4b681ada87

SHA512
cdc43e6544cda4394546f8055726801eb157f576f5f532e8e7e2f4115569c4c65174e52b578edee50735e7396dafb9b74ec9ddafa6b29264b98dc4c9021a9df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8745151984a7f0e6b0568c43d9ec7d8

SHA1
0bc4df5fd71c05366bc188c86cdbc92f09610ec2

SHA256
710c78762146c6a4e1f196f9fc87bb13a5fbc6d7916a1620468e8edfbaea37ac

SHA512
a7eb312bcee8aa0cafc94c83e4ebac26979e67bfaf600730ba99f2ca71da01c8afaafb48cec8af261fdefb330d19e1b5bdc61b1f3acfc9311467698a640da6ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
330698a45ce0d26a9744958e1c08d3e7

SHA1
3b83579dae60bad8fe50d5a8a95fa79216ff220a

SHA256
baee9ba70381a37888017a2b1bcb356454617b2e5ade6aff733933dd5b7ae71c

SHA512
6168b901514cc70268dc532da88046c677d7d899f66fa825e2d62d674f05d13215757d54440b7ed0e5435243b5a9cede8a5ef27868da3cedc7cea2143a0c3fa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23c8c917bd9110b6b61699eba9360283

SHA1
67f75ffc5a4b7b05ae17207b822d9e693912dad2

SHA256
e9cd522615f956fa4e617fb15eda9ce0c46b738e4b68d8a46b24beca4b63ee99

SHA512
9a8daf1539a6c0b05fa606d20498c70a11388f9d4ea4ae7bbd7ad2cad1bb293fb0755c229fc7372eb7d2462bc6ebcd1e45697132c4fcf5dd276ff5db9cae7986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27987924e6855dc73e08c2f3f3e496cb

SHA1
c8751e0b5d12fa9da2a894b48d951050df0bcd4c

SHA256
d5e55ea76bc971538b5608bf51815c235a5d83cc390b1ea161437e049f9344ca

SHA512
d07eec71c2d7a91964df948c3bb88bd52d61b1c165fdc2fb89301e0b12665ee7111db05787f6ca3343f2222ac8e9056fb2c5df6516b48976f78bb028dc55597c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab129A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar153C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit