95c0e34ff5736cdea57cbe14f64f3cbb1a84747b730458711b4bd2a0f8250bd5

Analysis

max time kernel
11s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0b014d303d393d70ae38b932208f7fe.html
Size

601B
MD5

d0b014d303d393d70ae38b932208f7fe
SHA1

c25ed407c56de8fea0a48d9ded3ab0c6aa46052b
SHA256

95c0e34ff5736cdea57cbe14f64f3cbb1a84747b730458711b4bd2a0f8250bd5
SHA512

942b08b0bb31603f3dbe44945a64664af395fc337cb27c070a994a1e33cd7cd92c08629d8eef624c50388f771c4e89358a3fbde2c1135efe8c91faee691436ce

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005777df4f1ad00a43f957f2f8599c9c1cb6f26b10f68ad3ee5639b3edf3251329000000000e8000000002000020000000a66b6c0b78e39cb030a54f3f69cffb46b205d7268c8bc4d9042912b8056ea376900000005041be8b7b018cdcd6128f969845044d671bd489e0efff9d9b9426cb2a7ae2b01590ad3bef690454086bd982ca5ccebe2d37b0990d0d02b4fa4906cd6653c2bb3d3c48554ac0d3dd28388a2c38481ce6f4c8fd7ab42074c22b0e255e4879f131972e3da4e62e28e7415cd48203e1bc804cb85edad1e00de47c899a22643783fa23ff8bb52584f7047b9dbd56e8ce41f14000000022cc1a35b0f710b2302fc39ebe42812e6a0b28710001944ca25d2e6d279fbd5b67d0d566eab37fdbabcfa2790450a4faa9172cc9db8f2605afa1a0fb712ca4cd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE42F0A1-A201-11EE-AE81-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e2f8a30e36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005f2284c7089a09b22127b2d44a4122c382179b9439597920bc93e81f410b616f000000000e8000000002000020000000c22b71c6cd943b2a9c62f8cf75be53b5c5cb4391abc4de306b5df4f504e944af200000003d1834645409f086f62f48a1244971a194a2c0483f926b5b4dc91cd559358a424000000058aa35b167fdc40a36e59b18fc33cd7c66db2f3920e014fc8f8d4753d953563563d1a4fe2f39305aa72db555d754d3e0d9c1525373def7cf4177ed47cb2a5e46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
1080	IEXPLORE.EXE
1080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1080	2928	iexplore.exe	14
PID 2928 wrote to memory of 1080	2928	iexplore.exe	14
PID 2928 wrote to memory of 1080	2928	iexplore.exe	14
PID 2928 wrote to memory of 1080	2928	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1080

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d0b014d303d393d70ae38b932208f7fe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77fe8e0e4f91a1adb6e4daf6be9f95a6

SHA1
0a1c1011e08ab39b5daf4efefee3fa28359a3e1d

SHA256
be26cc856bc863a4200e93c9332fbd1305235ff3dc0396afbd46968b40c842c9

SHA512
7ba1e077801627fe5f2baccfe1d11d5ff393eab415a866dfa9cc98a6f674e96bfda1fd9752fb1747e07b3c05e42ebb20edd239487cb7601fc928fabaec07b910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47a67f7370453f2cf7cf7e52ac41cf0

SHA1
d57676c3bb8c920d1ecd24d2e8b90762c939646c

SHA256
430e169425f78219fa0b8796f6eb9582c8707b1ed0977aa883794bfffed73a13

SHA512
27d86b736cb718bed741d510e6c7e962e82402727a9e22f7d13a40c9f13e4a3e3ab0db03aed82bda679f20785e1b6ee4b96f5261735e019d787dd712036d2b3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b6ae006fcd482371e82b7f70fe93665

SHA1
82a045bc0753c33202f2d36e1ad44bdf834224ea

SHA256
d631f9947f30a4973b868fa129571be3011cc05cb1b9d0dfc2d509c217dc9789

SHA512
5cd753290dac8363703a46e330602c066cd9c42ca02fa025f3d065c35173a736bee33308a9edac97bb28e114263f727554f6415da8aaf78725301f366614afc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe7c524d88984a519b4e284d65dcbfc

SHA1
746258f5217ec27ddd2d17122a876bef928f97ea

SHA256
d71360fcd7db75a998311839c66386c5fabf2078aae22dba373aa76e6e2cda5e

SHA512
42f5fc108400772397b4b29321d3cc55597b00fb5d1912574805c23932cd021b8aa78dcc1143010acc952ec31ae45c4ad59e587a1722dce0a87806fa4dd81029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c774592a0dd85b4b8c8ef36b9cf8271

SHA1
4b586d6d63c58fc0a714b2ee2c6e54592420d52b

SHA256
e9bd3d272308a9fca87b41eba30d57e19fcf997e50dafe93fe4af26235a04aa7

SHA512
f1b906153838ed18c4500c49d4de6e13efa92dc21d51db58dd24da5a773366a75edcafe93f2b11f748b5652c3abf3a5be46719df715cd5607740f715a1170972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c65aa0fc5bd0d026d821015d8060f0f4

SHA1
25d5170074e0e82a2454ca0ec7ab6f6bc864ee2a

SHA256
db37246885836ba9b4ce8b8422a50b0f18a3a14595104e8510330b0dc03f592b

SHA512
dbaab4ccdb15593e7abff90a32286ac1571d995a44c4aece3c6600fc583529cbe39bce72eef0e0dcf432ac15318c090085d84013c0ed333b93d7ae044fd313e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee49a3f73431134ab3a6fc8b867b10dc

SHA1
09ea586835ab5952a8d91a5c7b66bcceb2c03510

SHA256
fba50e3abf45303dff4fa7ac32fcbf803b30cb10b008671070c26b919b6545ee

SHA512
efa695382736f9a250a99553be564eba75c3c31fdde37035bae2f4d7ec2091412699ae85bed1b9d78919cec68a2b7498d8228faffd19193b2be5579104544c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar231F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit