f62964376cd667c63ae4d8e7113959589b52a25cb3a1954cd271da9af5c8db09

Analysis

max time kernel
137s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b51e1ba4deb135b01e08d72f33acd876.html
Size

2KB
MD5

b51e1ba4deb135b01e08d72f33acd876
SHA1

f33f20fe474b9269aab16539562004737f3315b8
SHA256

f62964376cd667c63ae4d8e7113959589b52a25cb3a1954cd271da9af5c8db09
SHA512

32626f4be2ae72667dd00026ec2e0accf83022915ae70432de75860c509b06a00c9497332ba37b5632070aed29e390ababe12cbdc9a2844cd1d4c3c6970b2eea

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000bf4c64edf8b397ddc90ba7528ea3cb2527f6366c566974c44547836e21c67f53000000000e8000000002000020000000e619ddfcf017ac92a0d7edd2a0cb0eeb48c033a24eb5c6dffcfd0f2c264991cd90000000e3f423f85e63a66dfe4bcf461df3583eb2739b15e027c727e956d21ca3e08fdc62098a6f19e36342c9154ff9e27cf911fd63c63921c431bfa768cb8e13de7fbab50e93d6b28257cda963269d6b6f85f278a3019f8c307708d4c94b70cec54059d0703c41a59d31b95377e50c4f655448e8ec2f8c8e61c54a5a2c65af6b1d91576ec963410b42c7c2d290c7f3157b9c364000000041443d4bd8b623654f75062401b901e7e269a7495cb1e4ae522e28fb7518b66869ec9ad61cd72083164efb5593b2956b212245e11a396df1fe3a911f3118e3da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A81D21C1-A1DA-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000053ea5621567f8b82a8486c90e22086704fab9138c283789bdc15e670d045ff97000000000e8000000002000020000000b6c29114a0e49b1caa890d44ec20c3c179fe78c0a39a31279947a1bc7b9b6132200000009fa89626775d1a74803ce434ede012fcb39c9aaa5fd73c66ee34d0051e078b5c400000001ff4d0824377b9c81bf1ca37203f1214524aa9aa8dbe5bbc84edcb6e9d0c640b8257c5c19624ff7b071fdf9ab84d354ab179b32342d3e7568a94559498aaedd4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50026e7de735da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409528985"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1452	iexplore.exe
1452	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1988	1452	iexplore.exe	28
PID 1452 wrote to memory of 1988	1452	iexplore.exe	28
PID 1452 wrote to memory of 1988	1452	iexplore.exe	28
PID 1452 wrote to memory of 1988	1452	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b51e1ba4deb135b01e08d72f33acd876.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0fff85465df6bf0ff412cd3b078112b

SHA1
5de649afbae5b2be75417bc588ca34e1d1246603

SHA256
bf762e6c46db56c48fe20f2f149e14a1ba81b3a8cda75b45192a1640a52ed20b

SHA512
63fcc557d26988f50296e0102b05a62ac23a54374b5c5e226447ce79836cb37ca7413ce2743e6acb16de98fe6bbcf98a9aa322967793c6752962dece8e744e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d026c136ac4b0fb02bca68030f34ff13

SHA1
601675a70d8e9b4db941d712358fb48ceade5c70

SHA256
9c31bcf98b09a6a8f14e1c0fe7f84d7ad994e4a356a19b4e7aa1377905403be0

SHA512
3451503fcd58f55fc456885667c6fbfd941cebace52d8a37790ac98b5a415e459566c34f5e82407c8872c4efcc501c3ac373d93f543a09c1f7cb1dbe689c113b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30f0f608c7f6b06ff1679481b4ffc733

SHA1
7bb3beefd571e93f804747be1e9f6ba9e692c8f2

SHA256
65b5e877931406c427dc1b541557719a4e3949508471f7e203ab49f6a2d43cd8

SHA512
62840ce13c4cb19ff2d6e152cd64307a5f4911b57d17682bdce7b2491ef2e3010473f7805d11e449fc9eb5019cb01f836df38df5fc49cb109611dd829cc3a86c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02b09e184e314c625885a45c03baaa35

SHA1
e5e637525fe8dccea8103f65f24e0f2d9c40f0f4

SHA256
660e5f1cb149acd91bf6c36127df562572ca8e6b5b011c7fc244d39c3fd5fe1f

SHA512
9f5d9c032e252dd7c2b65edaa30f654825d85ed45c38e6441899430fc520663ca1766aa56d92f3c7fcafc6f1af78d483726571364f3b9ab4f3609e2231445877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
987b003d4d66b754a3a50e828cfb61ac

SHA1
952c40ed0bcf2620254cb88d3a1d5b20a74eabf6

SHA256
8bb0ed59c81ea4845ce18f5944bb9ee5891d6513affb11fa67215ccd37571aef

SHA512
cebd27b88cba7f5f7c118180b08fbbb393b2604c7fcb571f52d32e8bba75f7da8472cac9140e072006d95e178e52919372c6bd36e7956989a54e267796161ed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd088902434df5570fa8f7f761ffb02c

SHA1
f8cb376876c51bcbe054e879158d18f6cbb8ec81

SHA256
bc240d2f691bd534130d6e10b8493c4f9708c1150861c8f0e3b486ea483f8d7a

SHA512
38f564aa4f4d998c95db77fc7b6742942579c73141f860e70114000bed61ede391c965f12ca785a056aca69ea8b783d8faf6be275e0f4ba95a55a8310dc518e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a7841f6ebcd2ff0b3cf6bfe43d950ea

SHA1
d119592793d2e20e465358122982832da9f3bcf0

SHA256
276fbfd9e2cd61b86376d73aab795ade38511c3e36ca0b74e2825988347b460d

SHA512
2a8d96556ed5300a28745d52a522403803b21816c78b1dbf41f57222cbcbdfc78fb59c8e7bde28ec147840861f7889b4ab8c81b222e434a7c830870143e712aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ee7373fa159fc5c99276c043f9f8d3

SHA1
210e9db5fe0a6d85a135a017e8753c2837b2cf6a

SHA256
e5b09fa89426629e2814d5f573a6a22f4c25c444d6adf3c8ccdce5373096c224

SHA512
bce685a513c3318b07e5298f8baccc569b1f3662d091ee4dd482f9ac74d74e11f6634ad79fa4c939fdaed5cffacd9a4279a9752b6481829baaaed02a6aa2cb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0C5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA164.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit