de5f4d2a6507861b54db21657e13bd2cb421bed77ad0b067249f0655dd771fbc

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d101c92217040f9b95ff88c54e050210.html
Size

1KB
MD5

d101c92217040f9b95ff88c54e050210
SHA1

0ddcad36e66967aa57628c758dfcd385ce6b630b
SHA256

de5f4d2a6507861b54db21657e13bd2cb421bed77ad0b067249f0655dd771fbc
SHA512

f357b99200a08c25b727bc476b4e0214fecfbba428c2d267744b88084cce2f2eed3062e8b4d4eb1a14f2d77c32343e32bb13395169b6f4f8fea59ce5d91994db

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f0d6fba0b75adf586caab0a626537595ac59df2402982356a9fda2cc95cf622b000000000e80000000020000200000002d28215e96d1f5bf4f4fc27b97a16ef97017fbe4586b20d4ffaaf7282620227790000000d95ef893c16dd04bf94a558fe3b2df39cf5923a6ccbac1811cf8f472d24a15223bff959b150be8cc5f4226744d52b6148cee27de3de935163d504f5da6c0a21b2050fcbb916a5cbbcabf3b0923f12d701f14e676a93c8ea33917759efbb68490ae4aa721cad7104a0fe5de15dc429e0b2928a6bf3554f69ded9f09f90a9dfd2866c47a827046657e5a6214a1e524b56b40000000abb0e8c9fb1adf11ee87f682f2d110e7602002b43df93dc1c9322414e2642250e91fc2123cb053c54b3b6efa124a1c09f305fa3aed9be92c3e7d5024877435c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B7E59A1-A0FE-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000459ef14db3d2ef0cc1ffb0fe24b86e59aeed2f0d790e8aa262993ef6c0b95b6a000000000e80000000020000200000008ab7d7178bbbf5a4bc757d4c142b381f29f4ffa179f443962860ace231c7bc0e2000000002587dd5000544b0739c05795e77c5ea248e07f6a6332cf9182b5b7c3a1c34f5400000008b2b626a6806e3f0db26f62f5c721d10cc0756db8e5f761781747eb9b754304d5dd860dcd98992a6f7ec016fad99bf0c758696a2272be48b884bac30eba1c195	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409434384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801617310b35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1340	iexplore.exe
1340	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2652	1340	iexplore.exe	28
PID 1340 wrote to memory of 2652	1340	iexplore.exe	28
PID 1340 wrote to memory of 2652	1340	iexplore.exe	28
PID 1340 wrote to memory of 2652	1340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d101c92217040f9b95ff88c54e050210.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db57f065078f8c2972e1e1ee82584321

SHA1
8f0693ff5f1805cf196778e52d280389fd431426

SHA256
e3ad394d67b9ce7c666f6fe2c579c657ab2473cd73203ff70299fcd35cef5d7a

SHA512
4f0d144791d9f06841f1af981d03a3738227e4a9af8e2f629178cbeb24122a22c4f1575a09ee7a07ddcc8eb07f7ddb588c52bf00c6ae36fa69c5df26922c7e50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c312ce31331839944b86745e69baff94

SHA1
fb5ca651ebaf2f480de6dd1a56090902f904be48

SHA256
2362c991fe66d66f3406c2ff7c0b5b0dcd9861c8338fc1fb501eb61dcab7bd61

SHA512
2d6b1fc3616c668912ace4783519ec2a8f3df497b42ca1dff0f0376259202798026224fb49c24be5ceba447b0f7b88a3dac0963298595e02ce286399aba50fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aedf2ccc5f6d11e87ead48034b3defbd

SHA1
ca887d866d1062cb8f37aeb9c6e0313010f2aa22

SHA256
14fdc8a4764f71d3faf3d1b9d9a857dda8dedf5204d3ba444c02d731d7c95c96

SHA512
159689b3d14d4abd1146c6f1738f19a760580696c1f0e1a792a263a7c410a46b166d3d21b6f9e0d1358cebaab51eeb6eb0939860d9e56152e5a15332d3c8e1b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
731a4b173b4f07d07d70c443812ee584

SHA1
f0798eff394a728c814135d1b7463742d39ddc5f

SHA256
115182fca79148a384e87404d934ef9449f10621d987921544366cb3aaafda0c

SHA512
5c55f7af2f74cb166466c4238821feda4238afdb4d793cf8b71770d9c38684846edda46a51d00e38a6f11973a96239d2ce275c5e012739739f62e889a74e7388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2cc8dd4e740012bb30ab68e681f6871

SHA1
57fba2980e6670839f7755121951f54e3aa57a92

SHA256
9d993bbc60b23e1a5e6cc8fec317f287dcc5bfe13106293eec056dc86597d536

SHA512
5647524b09b2e25a642b5b863e6c54d9b01f77cdd257b204d8a037682fe4dcab01f1fb78683a6aa198266f98a2c65df7b47c91a91ad657741f145024d683dc1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f41b63c08b44dd0a8c5b21964cff4642

SHA1
a6f039d7462c8a688855ea22e316dda75a0c70ae

SHA256
25f1608c7d7a8bd516e803178f0e8407d67dd5837d9c7b3e084cbbee60b5f311

SHA512
22e3648588464f8ea32ff3406277e0832f9b918acf3fa2137f30150d4cfba9c6ad64dfe50cb057e30b5b7fd316a150b71399202991dc10c812d7988adbeb4169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8b96d08cbfe393d63de8d0dfb3a5b7

SHA1
442a7296ecb8b3b3eb564180ac8d170c16c258fb

SHA256
1645da0237101be3cd59993d2cceb74ecb629b400de34eca1777be7ac6614cc3

SHA512
4aacc04c3d2ad97c4234dd154bcb81be9d8e96d5e353ecfc0f86b9a505fa25a4dc6d37fba763194966719c037f1a591cea84032f42cb81a76554f7141dfff603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1e5f1d98056f8c5315f8e233af7c842

SHA1
d71ca5f4ea508fcb1f9b28338980daeb87704b09

SHA256
05b19d76dab9ac4ed0276791959fa1ac3215871664b83dcc6398a2783a660477

SHA512
690bd8bc199cb92c30d291b55ad793da51ade27c4426d32a2f9044ce52267046c8dc3ee2c24ab82ca7a40f73afcfec33ddd5971fce3e29b7bc40840fb6adf3cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab93AA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95CF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit