1418fc3456589befa0607c0fbd4f6a20fc5b054e967fe69d33440700d5942e34

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e015d152018044c85512c480dc821dc2.html
Size

2KB
MD5

e015d152018044c85512c480dc821dc2
SHA1

f6213d4d28e7ecf9677a2ce9168c39332a84d737
SHA256

1418fc3456589befa0607c0fbd4f6a20fc5b054e967fe69d33440700d5942e34
SHA512

f58080e01d1dad624f3b6ba50e74b15f9d7d05889d04a3f8e05038983acc926021dfd36abef037d039dab20d6f69f66d222ca4d05a7f46c6d23f8e373fa81a16

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D0A3F61-A10A-11EE-A80E-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000bae8a87ee542a903b4a0d12092329adc42c79582a527f6e61f0a8d42dfa9ae5b000000000e8000000002000020000000e0e3afe6103c52c50f667fb0f347685e17ee9fbad3cedbe7a82ed9ba3712d91c2000000045f722d262ba998281487406e3a2eb4bbce072b84a346cb42a0450c3eb92fa5940000000a703c2c532a192e37db28efdc3bb658eca6feb95e79d7183f25fa7a78d79fe8ace5bed20254cfb385e82a1dda5794af910d324559bbc0b0ec7567c476655f5b2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803d6d611735da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409439599"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005bca0970d2cb39fd5e84e31cd7531669d79880d9a493f4d5139e1c37d301d87d000000000e8000000002000020000000e6dffaa3f991b4e274bd87fb26eeda1f8ba078db40cc372c63cadec8310b6d2d9000000055303401ea5b2c20c24477bd059b4a24a7039dd0c0daa0971258a7659a60e6f4f0fc5bdcf32bfe5f223c6b63512a288ac36447323888d797e42864b7c90f6acbd8883b17bfb47aa109a9f4921b852c2f901f98ed7d171d699544ae2d660bc32ddbd7ce108df8ac5f242b6115d4c50c73dc5bd7beabcbe0db01968f417b2df9a1f8ceb4edee828c93da52b42d31f5d22940000000973a1385a360bc3bbfa8e7edf07842cead05a67e2bc96453e7dee7f6c6f48e7189749dc9778308473807a8cc329b95fbe09bc894cb848050789ce8917ff61d50	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2304	2148	iexplore.exe	24
PID 2148 wrote to memory of 2304	2148	iexplore.exe	24
PID 2148 wrote to memory of 2304	2148	iexplore.exe	24
PID 2148 wrote to memory of 2304	2148	iexplore.exe	24

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e015d152018044c85512c480dc821dc2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c274faecc64c113e240a27335bc03d65

SHA1
3ede59c9a4283bd7e34e3b6b695026d0c5028341

SHA256
e4e148d32ae2b65848c807d39ec59e4d258a92fad794ebf8af661bd5eff45a14

SHA512
adde3d4dd7a1538dd304813a603421246d15c09f834c1861c6d594deebbf5509793a59b34e2b331f759688a6cc4b4c3a092d98d32667cf9544bd3bd16b716daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c1b2e6a09b3cc0400c7b56b41f0323d

SHA1
f183472faad25d6a40fc1ed5d47dc0a55acda251

SHA256
da2720e95ac5b18549b3c629621afdae48ef04f48865ad5e89463d84ed74dc99

SHA512
c9a83661a5b0e9192b9532601ead17fad3e8640ec1604d1fac2293919f9066a4c07f203f9cad043f95cea7373907f02e85210f69296cd8b88d0e598918ad63be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24ecc752d20ab47dc5fca648eee5608c

SHA1
089340b617017d5f91d25f33e75f523033cd1820

SHA256
dfb786ce4f145eaf0a448d1295c346fa5b0319513b0a7286a04dcc2ed68533e1

SHA512
8371e6efd6077a4f1e0573b740fa1858633640c8af0efb1f9642ef57ad89502ca42741b61e080d02ced9b12f3abb32d79d2d0c711ed0fb87a95df55720492728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45d0492a079cf18e91def26e3e30f01e

SHA1
6dabdd3be1c20c89f430a62c586f5279a4b998bd

SHA256
d1fda9aec8cb58e016b3e862f08105ded2a2f38d02d8f6cd2e36683f31697f65

SHA512
2598cdb0117c6fd7a5a6a8d4c2087cd67a8fdad6b94fb922fdbcc4698722c101fd75fe7880c472958825975923cf413bc30039c7a0c0ffa169cff5c29592a3c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
344bea1ad95f39140605c81f53319c92

SHA1
d01a7537a3a7ddf31ecbf674d076479e986cdef1

SHA256
ace7bff30e6d72c1c20230e8b6ec0ff71b7202dde34e287f35370e866ca667d8

SHA512
aa0a070635ad3fd6ce055370e3f2dd6e308a2862d035e7bfa5635fde9341e7e046e9f2b289393da85b75a4ca1e00f7063e1fde29804d1d8d2ef946311e1c0448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04314691c92ad1bd1a5397f5ab4afe0a

SHA1
72d182ab751aca89eef107be030458f1524177ee

SHA256
0972b49cca28d98dd1c8d273a68b7d047a0015b75473668689125f9efa5a3037

SHA512
2cdf86a2f30d5467a2c314bc6964ae71c62dd860bbe526ee1ea24c3427159796772c4ded6fd97009ad383de8f0e8c85a61c30e7061981fcfe1f03708d4a2cc68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
668c2142c6df24a73e1dd855a3b7920a

SHA1
6370001e17bcaa81b2afae33bd683f50fd84436b

SHA256
df37cc19770b3e9d506a7841502ad10ad9f62eff9566b2dee84d6055dcb4dee9

SHA512
d87c04d1c7d8900d769bfadafbfc8ff376ad90e4433b30a40bf6da50000aabeacc628868839a171af672cfcbeeba9ec642c90f583cab9728ec2f6bdb2ffbfa1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99979cb064c8c361e946ee068a8cbb5

SHA1
7de95bc0befdc7baadb66f66c5408d4271418bc9

SHA256
5ad724e45c188dfb944699171aa175b434c815c40de8be5bd7044e5ed1062e60

SHA512
67ce7e5a8e5698decb174db3ec64920ddaeb7536dcd9463b528e201795859c54b2cd00d9c45f57afbbcdba75d4bd4aead08b12517a3dbc18e808d88d35d789f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f74301eabcad8b953d142f7e63bae9

SHA1
a7c8ad1a2cad6f2f1ed1d95234bca8545e3c63ce

SHA256
2b642e4bd3b170ff4c4314223394fa29a90ac5670a73893697dabb183110fdcc

SHA512
4d7b7a4a1e2167c9fdcd84e0d8b86c3cba9748021831e41390a98d50e80fdbc4da84e240a53c03b161f29008df51d85e8cd83bd13c964abf0d4017670d2732ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14954b35b6e36319baef4a4f5b87e5e7

SHA1
8fb812510d947a6622a9cf337bbec8b7785fe930

SHA256
ab6613b1487f2bbb469eb1f23a376cdae0637f6c0e069b4ddedcb7e1476da46c

SHA512
9702ad14927399e56b0938cc442fcbec0df6be1351994d8b1f0950d0edda95c307d4007b52f98cdf1aba95aba35cdfc11859bbf5ce6d675f5ec308430f0254ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbcaa9bb150909e56b8110ca95313ea2

SHA1
851d7158128560d19f63dbc6acdf17f1941be49e

SHA256
d184e6c68971bde8cf0cbf0257b4722a8400c542568530acda55fd6ee700bd43

SHA512
40faa8bf03cb25a795f14fc99f7c739c6363a801eca4de143fa1d784c315317676993c561294247b45b235d479e1fc352b8b6d793b71bcb5a0d277417f680196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e85724f54736c9c61b36aca2346054b

SHA1
1888d5057b5233a21019f70dc759448afd7d9f47

SHA256
c549ae91081a8b97c6ef3c1130d913b2ff2c416d19dc9a770fc6583146c94ee0

SHA512
111675bb11d50ad18c018eac4000137cf96418974b760b2d193d6837ea78dba00964c806af5d3abed57505feec59dd1d9f319a361393782e9d9794a4d286e40b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2898.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A22.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit