2b9b40ebc5100169598371cb4d86cc09972e01a146d7ebc318616354c965509a

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4a0616d43a8357daec1a9af09a92e80.html
Size

1KB
MD5

c4a0616d43a8357daec1a9af09a92e80
SHA1

83aaf1df7a131bad557cc1108304ec17e006e736
SHA256

2b9b40ebc5100169598371cb4d86cc09972e01a146d7ebc318616354c965509a
SHA512

d6c00e99efc044c7ff04e90d428cb479cd1d5bab7118bc6b09f7bd3147aa3109b7dc1b96ffc45e4ca37a80c02a2b4aca1d0cbcd145807350672094978256302b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008f2e2fe2a4940c818455cab4d9d069a067834b2c75875e94a7175d5b6e1aeb99000000000e80000000020000200000003ca3295904cf71520ebd4cdf0592d295814a2488b6d64b10183083fc055ad9d8900000005da981ae11c663b8c757330b3b640553f9e82bde3ec4c76a5ca77c02c12852956e02d2be04f668f193abaa42556119e4a76eb07588d30c46d9d9f206c2ba8ad336bb03366040a660e04bc5684f5980ff255735367eb50cc13efcf606a839968fb9e2b553770fa9a40a0fcc6a2e411a06fd3e5f3e8757064ddfde45d978d88216506c2dcc7be723cd75e79b81bb364108400000000e94c82c8512c431bc82f1f1387c7b52d2be5aee16e80c0e675d623e709be7ef1fd87f5921832d86717a7bb67483e78d145f370074c6a40b89c4b2b11179f5b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0585d43fd35da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409538347"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F363CE1-A1F0-11EE-B5B4-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a1795b66b5b61e0af500f760f7ea29a81abbf6afedea940d7b08aa08907323ed000000000e800000000200002000000081aef876bef65848b8e2886dc1024b414b3347dda09179ee4db7bbe2b3c32df2200000003f0c213595fd63addf1af4e150a865479729132303aa28c4c2adc54238c49f8340000000ac6846f27d750dfd1d15e833f9db0f4be8a8ab5f79e6f2c7639ee81cad769143ca9f985aaf5c6b823a205a7fb833849d5d43949dd323a114e374f6cddd964636	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2476	2076	iexplore.exe	28
PID 2076 wrote to memory of 2476	2076	iexplore.exe	28
PID 2076 wrote to memory of 2476	2076	iexplore.exe	28
PID 2076 wrote to memory of 2476	2076	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4a0616d43a8357daec1a9af09a92e80.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
987b78666b49bd3b65b735ce98b1dbc0

SHA1
3b4c82fb641a4e6ec415fc9e5d0b67ead1546bc8

SHA256
7411c71e65983bb06060d2ae287c37148b7f045822660dc8b138c51cc075db48

SHA512
cabaa5408766501f20a9ecc6d44c770249c34e3443c08147a6f6a4016d7e314e615c71d31b16bc08d248e7695d76c05d5e5cee2448b7a363ec890a4f9c69a22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea7918b9c5848179699beace43070658

SHA1
2e38db33f44e96c42f7ca050a6f80491407d9a18

SHA256
c8af589ebde1a500bbddb95da2034bccac75d18326c9fd0cf53cf78a494ba0e6

SHA512
b079448e4b1c7ebaf92d357e502e705980b7e203f8821194d9e53561df323e610a4742a5f3649c439d5814de1119b4c845b87bf643f2b631db21601541f181c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1759bfa72fcb93a94e61ef5858ba0c2

SHA1
7f2b0e51058ce918ee3599a34de6e5e2af9f6bd2

SHA256
c1c0225e092b608e854c545d6f8b5507db603f4fe2a9a0be22d732609037f1c3

SHA512
dd094ca06db8dee3fe28d8198c5232af24194bc3ea07cf83dc7d22ceef3d239846d291ab0a344752bb4d8afa079d22c375ce76c8e74d7fa3f51b5b9bb3e0351b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b354dc23294679bf303c4d873bb131ae

SHA1
5c10ed3ca4842badf84014ed2a355c329aa07fa8

SHA256
a6386206ca94e23f5a8eb49b83fb935428843bf21137c50fe09d98b4c6006780

SHA512
45cf76060003369edd6a6f9d37fdd1ea6100d873bd50d612fd792d1238d025882fbacdad3cfcbbf044ff2ead79c039847ce3e9dd3387dbc35f9c929a284d4ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44aab68b62570a59c2fd55137980c21c

SHA1
bf8e566b35029c288701fdc21b955496f5190438

SHA256
014e7ae0a0dd8e6a3ed963433a5539b2467c56ff1d7005b9e42aeab7f1ae4554

SHA512
3f3ce5fda91b3e40bd889d4c96aa16667f1d1ffbc23dedb6bb56ae3f1939f10a5ec82c464d4c53a792478cfdbd57e5158ecf7665f254985f8ae714b09dfe5d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9acea0594f75ee3d8db3d8402e3f0f3c

SHA1
3eca7d9b275ae9a40adf42e66c3681375e03517b

SHA256
856d2a54ef8cfacc0da5c812b0c295045d548ebaba77f609b3ce155f153beb06

SHA512
2c21500ab4f21240d5385eef720d03abcbdc81927a88f9f21a8a3e28e634cdaea2e54dc2fbe2f54976b445fd4af392d381a910369d8077468c1b96c492699f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
588eeda26cd2b6160e7a74eb58aac938

SHA1
4a665d055afeb5511fd6be150cb768cad42061b0

SHA256
283aeabb13f9a795dc49775250cecc42c55749f646537c7b47d8959068f5c2e4

SHA512
56445aa94baa4035428d5033246fa8e5c16147681a91d547d460fa5fbcf2b8df8dbabf823f0c603fd06dabbf4f9fc8cd2f0597abdb4fca477d64fb44bfe68f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cde4109f90a2142be909f264b962dbb1

SHA1
ff451dfdfe9ae17f099627ab2f05608c1c188c02

SHA256
f86f6d6f0a412a8785c1f90b0f31e6638e85b76491c6cff896651759ac6ebb18

SHA512
9d01c00d78d03027af7da3c21574b207bbb393b608945237602e0e832e1c8340576b19f62a884b12fbfa06a39e1b53a5276e2d9496788d6006758546e56d94f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79888b840b0a21947465e76099778da9

SHA1
c4c0bf36bd575128c50b01dd8f18d3f6070bd2f7

SHA256
803c742ecababb3de3cb4ddf70b052b65c84f303a532cc28e77c98cd6c9f6e2c

SHA512
4e9e48538b2a0f60e02bd22388ae238279e95b14a7a4852cb42befbcbe351a44170b1c206c44d2c4ee4605efa6085ef2d2cca2d3acc7c71ea3a9388dc0ec457b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3efd5c5716c88d7071b68b7bc37ee09d

SHA1
3bbc4237c2d2c19f47e8e345d0ff7da8516a5e23

SHA256
de28bc06351b9ed10917239edecd8092f7ea57775ae85399f685504d57ff09f4

SHA512
977d4368ad5f0b7a314b3dc29e3661d649e56454f2c0d6ef79b40427e7306e213fa5d931aa536beaafbfe33c10164a04ae7f4037191057a80f8b15c95a3198de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea0801e67feb50dd38e1ed17094de888

SHA1
6edc8f27acddf0ec6f1d4fe87fda3a5bd5e12f02

SHA256
cab2edfe1df6de84fa0d0d785f23bf0a834726b685b4ca6daad0c1b9bf23915d

SHA512
2fcbb5ce648a01d07fb7d37de1d7e55180afe575acca84079b4260cdba07f4b9c5c24521e08b948b127680a2b758d054917895a05f50b85405c2d95782c2cbb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
257ebbcbbe721d41dfbf99061ae75f90

SHA1
697f102826ad9e64e806726dd64a126f3e15dbdd

SHA256
04995d08629d09532ecf6b08bf11fc6fc7a49f68b29130a5b1e557ea89d73ca2

SHA512
30039e928969135f19e779ed8ffbc778b5e0a3674e682ea3d3647a23c4290172573b0d952653eb7f1e546f81f8e65ccc8c20f7cf124f5c6a2aaed52f3b29bb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e180fbbab9a82607741b4264583d9144

SHA1
626fb2a9368d851b7607778d53c503f6ebf3be01

SHA256
f5c2b683a35ca0e1dbc6a66e51bb211f0bc94486928c632a2cdaf0e86d30e694

SHA512
2b1c50c8b244d9e8bc2e47976830d0d75f4325bfc2385f3c333421022a58978782b350eee395784dd6af4643ce00daf937e8e38bffc11c0c95b45a06971234be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
551423b4fe1ae36adc3a176ab2839048

SHA1
9c2de8b9ade32abaf0d5b1a31414e40f839c31ec

SHA256
0d4b4e2b9c1e9d5b25e40e04e5f74f6b9ca0fcab997cc248a74662a9545bab5b

SHA512
95d72e6b6dc5d0cf843942deba8cad7d0d8b6d9de48fe7096ebf8848a2b9f8b8005256e0030d82512c128658dffc9bb7592a1b427f47f19e301799682747b742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f88932ea4ee116bdccf35935d3fe593f

SHA1
fd625cb26dd3c0bcfe52e246161c0b6828e11eba

SHA256
7db0697828a24ea66e3b28fae8b40cb99d86e677f331921b871601dd9cb16dc9

SHA512
8a4d27283ffbc2cdb5c2a1439639ad9a9597fa32406bd18a89a8e033e40de51af2444d70e07e73dbdf151c61e07ce18d7344f1e1bda2b1caf755554ba8c96038

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2168.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2310.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit