3def7ed64751a5b8171b1cc47cae75a86b8bedff9c7b7d535ea1573d89030ba4

Analysis

max time kernel
137s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d026dcf73dab865887ff8736c57f45a7.html
Size

852B
MD5

d026dcf73dab865887ff8736c57f45a7
SHA1

dbb03087a8a15a48725d50f16649d2b5e47a3956
SHA256

3def7ed64751a5b8171b1cc47cae75a86b8bedff9c7b7d535ea1573d89030ba4
SHA512

36a9c2a9d8c226693bb0076fdd54ca664ed964729dbc5af4eae302adff5bff3fa5314244aee39b5f8b693e4d9cc0018b120540f7a0484d1a2174978d8c12df75

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01426890d36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C452A3D1-A200-11EE-B36A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000009a1c97a9025e437d9c81befc9c3483bfc42328a8706277b42034aca02c12bd8f000000000e8000000002000020000000aa665b3d5636684b21874fdab5c79f921f60272441afee07825709ca7343264820000000e4ada02f953028c73ab003a29abe4c9277990159080141db49638ee6f49060c3400000006b917e204b363c505f7144923a9f2a66799497cea4a5c61ace523e7c7263f9741529dafc6e20433e9ab61f8ab503c39c3096e6c988433b65e5204164687f5be1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000513c4154edcb73f4cc52cce3892a7990d08a56e778796fcceebb3e49f4469bb7000000000e8000000002000020000000cfcddb94a1bd0cb4c44ee102eaede0b9929a897ab0fa4c9a1f7fd9e30d2c9fbe90000000e9ece2ebc2345a4b0940423cc7c77f62f0a58f916466a9afb5636d530ea41c9c73964db080ca8e33b462a67d0772caaef49038ee0a8542c64dd977dd4345571736190543cfc8114572a2f5847261fea323d6c9ec4892794a143e10914bf4ceb559da6da7fda23c86a209f6b19581646f0b123b62501198901761a7262e794921993dfd0bf640713665f2f881ed1e2b13400000008b6d3a86cf5418112f0fbc1799042cae30cecdf1350bd59fe522a58beae01a970f6441cde6a71ae641d780eb11609d2565d51ce64de0b699faa0cb81bf8c8a5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409545350"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2640	1632	iexplore.exe	28
PID 1632 wrote to memory of 2640	1632	iexplore.exe	28
PID 1632 wrote to memory of 2640	1632	iexplore.exe	28
PID 1632 wrote to memory of 2640	1632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d026dcf73dab865887ff8736c57f45a7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1b2ca0384d9969e8e7a8d65fbfb3059

SHA1
74533e33951629755a38fccf68245779f356480c

SHA256
44bdfbdf5597c1ead08181f6e6eb10033689d8c744a2ccc9223161b02dca0b4a

SHA512
f77af13874654e50eab6040d15d13e42f490d9f1bad505282210b2fc1e4007f3db35044fa89b255951563ab3c14ee0c562ca1578ee044d35e251d89881c1af31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a65d1fef844b5c9a402da55c4a4e48d

SHA1
11bc5f4b656981e1ed279084d8858ad65b5187bc

SHA256
578d5c2ed953e18d2a5e641743dfce41bad04d627451fc7700c8b2a17f35982e

SHA512
e2944e9bdbcd8fa5c6acc34330ef231e3ffe89938652ceae1e6dc49f1af7c88ac9837c5cc2db01982cc0491fbd93dc6df7397e6ff73dead3ba6828a2a71edda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf352948a5ac29165f06bb5dde948493

SHA1
fc44cec9db0e5792032358bdb49885283a5e78cd

SHA256
325f2f7f2977094dcf75fdbd85351562028c86f5c0c26b24a83e6787e827ef59

SHA512
3a02b2861bae0899ed19dea889e9790369a11a1f64db972c1ffd49e0d9ab931327f1e27fbe4e0948c8b58dba28ce55b635a49c3ddbefdad3c541eefc107d448a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8313a4b70b0e7194a57d7dd94db653d

SHA1
50ae1c15749853dd20f1c2877c339b5d7b8ec28a

SHA256
fbb86b90c8404d0eb65c9ec4ba512dba51ce4a20b60742cd02906c7882d5a1e1

SHA512
a6098fefda3bdaca3b53e707e850c17e1082e88596e7eb4ff9a39de05d6a96a021f09db511e5c67cc50cd3cb31345c635755b16bba167b45cc8a022b58ee5fea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d66856e23e9e6c43fd2d0662e43a7c4

SHA1
e6cae7981ca5690c266cda4f31e998cb448c3522

SHA256
27cbbd6778a8f84fb8de0b1762ab4df32cb7416b59b2d1e65a7a66445bf2d072

SHA512
0b158d1f143276aeb7f06397cdf3d0670a2d0d9edac3f111d7d02e34492bdaaaea9280b8ed4cb6df0025ee59a6991f6af6f6d0ce28c170024705a95fc67e7be5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1e16129f8bc9614cd06dae21bc36220

SHA1
48ef4c4e8ddbc76482b7a4ef67a6f1bebdc72bbe

SHA256
1d4d95182347c3d2d5709c16bde71cba4145b6e702d66bae454ced648bb57cbd

SHA512
cc3663933369a5853b8f16158b5c8f22c7c7683be315bdacdd563053a59abfd9d2027141e7034d152c06470c6dc943054c58d531db323a0381cd5a4f5211ed53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9d319e9a8646036021ad9631190d5e7

SHA1
d7e2aee82c826023c1c9c00b9217ff473bcb0688

SHA256
b95bb1ce8d14672f069e246cc6b78069f70080b6400d50f99eb63c40cf975f65

SHA512
9c59b94081bb39978ebe3798abf4e35bfc4838f2a2327369a82313a3401cb6875308a8b64bfebb3e8d2e1e5dde20b4598c6caef2a2f81e261ec107fc05e9f09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51483066d25d5a30d3762d34671b737f

SHA1
307b9d9d1dc7241554e899aa35188a3b9b13e138

SHA256
810710bf7d5082ca0dce6f343553fec3fd9225c6b3a614dd33049391deabe93e

SHA512
49814ddf3f1af302b7b8e40ecea389eb18198b9c5728e28bbffb14afdf400e20996f5f99ed11c539c10ef0ac0acd322910d0506b11a18d317d549f297e13f052

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4720.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4771.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit