9841f59e904cdbfd54f05a65753127795dee6df074b33ef572555ff9ae9fe6df

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be474e1b251772240d57d0fb055d7f8e.html
Size

1KB
MD5

be474e1b251772240d57d0fb055d7f8e
SHA1

d62bc1b407198f2895fb249273c6f84079b226df
SHA256

9841f59e904cdbfd54f05a65753127795dee6df074b33ef572555ff9ae9fe6df
SHA512

d2b3a4c443ff5df0a0f4311b79615dae46a9e8cb6471b66ed7a7c99e7f454b59906ad1c2d4bea683dd069a35d73aa5f2230bd3cc0fe41aaa2e60de84c404e9f7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36E6AFB1-A1E6-11EE-91F8-4AE60EE50717} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0780dfcf235da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000089bed9aef8f28457dc319999b66d2353e561e65992f366e5ed7c8dbdc65e90fd000000000e8000000002000020000000ca3f3759591c75a0c2fa8626fcafc84a069875d897b6ee2b72784af37d0357af900000000e2abf9ef0ab7fc0bf03cd52f770a9949e6c70452a4b9d36641f1031acc5aa5d83a7285b10691e2ef89ed9f13cd1638a29061407ce7fefbcf96d94165430b5a17df841391f55490f571da1e3d13cf8d77581a8821c3f0ee4f56e334ac1a9d83b69aa60c542d8b321dd21618ebeb7412e379d771d930c8d0f50be867c3b24f0efd96691c750990a3fed1f9af4f995ecb440000000db2930044b0e163deff0895961397c35e819056086939c6694e3c7d65192e5096da8d0842dc651160a201bedfb36e83beb63301dffe018b0b8a901d9ab38b338	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002a609fa3b25676b74878fc4366add2b8025677f3749bedee46e06ca96ea71b41000000000e80000000020000200000003537d16f18ce186c5e1f2e696b9c43d4d1c5a18bb9f5429da18b1e106da5c4b220000000aa3a4618b3c27ce200e0aeaa04af11a187717e787f6afbe5aa7176567e5936b64000000087e150e02b4d0ba401888fab7554390c78079b0b6d925f0cff154383d4d675c749604ee0c6c71d2b4f7b9229654328fa9fdbeca15298b138a3e757210c610aa4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409533940"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2724	2156	iexplore.exe	28
PID 2156 wrote to memory of 2724	2156	iexplore.exe	28
PID 2156 wrote to memory of 2724	2156	iexplore.exe	28
PID 2156 wrote to memory of 2724	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be474e1b251772240d57d0fb055d7f8e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9415ecc3613b75420b9962e7e940e83e

SHA1
f392a86608d50b28677759e675fb224c7e4ded88

SHA256
566d3c04df83a87656535564216fb5ed311785d3b9e6696e979fec80bb0c7fac

SHA512
af60e25eaacdaf12f8410a86576796641607c832f9f09816dece7e415228069e4909e799bf553b67aeb5302d1541918512eb954849c6f0a5897105c27a2ea414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38310545e4fa7333d695078ad7c39cc8

SHA1
82e9b3e070309a638e636cb8c112dd4d1cc3aace

SHA256
346eb31e14bdddd257b618e102f8e050769fb62726020f5875fcd7fc90ae4525

SHA512
e627c45d0fdcf98baee150dc9a2a9cdeb865f1a5a92c8e434da4c3a661a05165ac9c56669cfa5a2f71fade644dbf48b6df8bf0420f434ed5a73ef29dbd1bc57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9781c9350f056011551e74b8426276a5

SHA1
469015c7eded543863dfbc8bd6e08a6cee00fbaa

SHA256
c49cb49734b295d1966d12921aad098d4bdfdbe9c47b54a6e2023cb5753c52fb

SHA512
c7f05893c186706d88df2c37263f3a9227319a4443ef4a921b3ede1f257c98cf7900e7e7accf4baab205561b15a68511bfda66dca997bbc9072d4c761b5a4f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce2619cc32517e6d2afe4e938ef0a491

SHA1
766a7c447e797b1b6c0a7a81bf738ab3bdcc28e0

SHA256
e703dd4ab09f6990fa65da69d7129dfe888709a0ab84f6678f1e14289ae64470

SHA512
f4b95286afc02362d0bd9f91a470906e70f831fdc791cef40dc741d738c02adc42ff5b941ae7745155034be73735f93c8d79d5a4e1e1c4fcf3b2f620841cf538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47a9e5f4e37ca30fe0aaddb2b31de31

SHA1
9d3e7d757ca724c90d42b4b622635fe26b626a9c

SHA256
86517737b6557aad24676fcb7b2db71560559a6fc45cca276f1e4c1846ef7df1

SHA512
51c7c83fbc4d698e5e570efe8e393a38d3f9cbd8d302a4b70a64a235eac425c247bf97e75e66a502c397ee1d79e9d6e52174f058d185a7868d268c1fd4d93ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
294144369c2488c45b4c99bf68a3d895

SHA1
500396b7586da054e5cc4b2d444308b704a5e9a4

SHA256
3acb61e1c20b57ffdb9b8e1362f9dc7ee4587cf428e5f11452b550aad17d6d79

SHA512
3e9d5aa3843c03995eb57c4718beaaa64c17a51ddc6aa7e59cc7b95052b3a45907f074f354df49f48d15434039982577afa5870c2a0028a3dabf33f650d484d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d82ec007440a408e1faed0c416216a4

SHA1
abccb7b1b3ef124e5eb42a391bc1093746fae4a6

SHA256
f68deaf9b7d4fc158ba9039dbece73a748c5bd2ace80013fc381581b6cdc928d

SHA512
7d937be6fd3f29029785ec24db05c394a1c7728a14fdb0f19165a2b7cb75f5750400b59018a7bfd93c27469a2fa3d7c427da46f9f9596ba033e8bca19ac0626a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1366a551fa43b9086fd44dcd6f9fd7e2

SHA1
21db22fd650af94e25ad6575a4ccdb8b6831ec6c

SHA256
7cb16cee9a84973d1d00e7ae511995a9a6fc54a3e7cfd42f4fd8c22125eeae60

SHA512
3fc9bee4a185ef5843c92aab8ad44bfc53ccbef7811395072aa0e864c42b4afb435ae5fd7f5f17cc7a4fe0ee317552c03b1d19e23a2ddea3cf7a574cbb9ceb1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7336a2535b054995848cf8cf59e75d37

SHA1
9c0e89024094121e4764848d730fe07a86506133

SHA256
5e84f1eb4a5f3e418f347129dd64a229da3866799713dd0892405d356f9c4425

SHA512
cf44ee12155ea67e4cabe3ddf8dcc0cca0f632355c34d6ec75b81fb6523f9ef8378cc2cc22ac8c73cedc7b9c1a347ed92acaa76420b4491c0c01882aa8e60331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81c93979a23a9d96bf7bd2d5583bc5ef

SHA1
76b6e56bcfde1f2e7933abf1deadc21f2e9c1105

SHA256
ee686d025baf1b1cfed7eb1f620c02d89c3d9bbed46b4d737ab759f098b27e5f

SHA512
8d52c053c22f0b7f1058e863dd776d3935acac3ab2015c8f93369332dffb18aecc30734ea8e8bc1cb896c531cd2d5cd6dd15e57b706b8ebf7e4e3489f3bd013e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb23b23ad572e27ab127bdfcb004f9b

SHA1
ec5963acfcf727652d8a4adf02d2fc14b022828b

SHA256
e12134747c0a249c10a15f4ef8405de1b25dc8e80bd2515ef1216f4fa03d4d8a

SHA512
dfaef167c4f818f61b4297ff453c436d7df14bc3cea64d4dc630c9d616e71aea821ba18407816f17f819a727abde373f9bb10c0938f909971a2ee6a5a8070b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
411d67b1e6e70747d51bb32dbac34089

SHA1
63fbeeb7171f0f6b449138a8e9af5f07d2e38f36

SHA256
26f0d58b4fd6411613425a5a1573900f847bbae2b2c420dd38931c2cd9b50f18

SHA512
3d25d55176c1178c1f68957073b6c09246a867def53528edbaad09d0a30a06c0822e99120cef7ffc693e661ea129e28e47e69149a769e21e2db5160f718a8236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86666ec08ff17c57ca2045bed4d54fb0

SHA1
1e776159997e4ae441ae6371aa2ecf853728af33

SHA256
96b34bc7b96c4b0bd10b14160f36473108e2b0d3b2013367056bb4dca3d4506f

SHA512
91ba459598472e697f990ae7db388c4121d8fb6a842f8f6c97842ce3bef186db249e121ed07685781beacedbb792de6cafc8e471d1ec6cc4b2a82983783b7dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db34d864cf8b24cb9ada99a4ebdad488

SHA1
a45d9742f7155e4126cd289595fef4059e2bb995

SHA256
c93138ebde1c2d573b6e0de0992d6ff365be9e82b45d21cec870805e3a70b10e

SHA512
4a16458d1b31cd8a998feb02978551d12b79863c694c85c3033692a89ac339f888b4771b251fa32a3a201e0e7ab73812b40918903049082f52c1ff361bbe48e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab71B9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7286.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit