a869e068ae1225d04610b181ac0ef7d41f857f6d8b32e18eb7fffd7e8b4942bf

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2a382c0091f44c8e06b8c4fa1f32992.html
Size

842B
MD5

d2a382c0091f44c8e06b8c4fa1f32992
SHA1

ad1385600acaa0b97808af77524247c3e05987c0
SHA256

a869e068ae1225d04610b181ac0ef7d41f857f6d8b32e18eb7fffd7e8b4942bf
SHA512

d1b3ac8ab2356dcd5bd6ae35c095795a4edfd2e25a7862969bd0e93f7eff02968227381c34861dea54c617a8ca6d39b5f287a760150d5a6b9ae18c7a884dd77d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000ea59a5bf05517c266ed9c268d23514afbd5a54e4d4a20b1ea8c7c15c8bb5c26000000000e8000000002000020000000f6f71b1ca89aaa48bf826b5ece3da797d987781cb206721917fc4b3276c3bf1390000000ef5ab6c2cbe2ad41e1e31299c16084effba924e15e1bb5600d0f187c3146b65f7b3d618e727f664d393ee67a5a96b6bddfaffeeddc16e573bc06ea563da7bb963bb0dbd885110788f668b485b644a655b28ee709afb6aa1196e026483bdf00cadc5438ca8865cb46aebbed5cd517a2ca08e9a0b49804075dd603d119ee9d685155e8983883f2316e7bc48b6b0593188840000000bd34979591dd40439cd5b0b6914dc719fff957d74e4ac5cf44b91a49811451fcae2b99cf8d69092fc4372e657de9bc372d3939dc17bfcb9b9a86d18f1a5244c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e003debb0c35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7E14971-A0FF-11EE-BFFC-EAAD54D9E991} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409435017"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000afc1b033e9383a077adfaf6388c56224a78017ab728418b180b52d6da183703e000000000e80000000020000200000000cd645cbb65eecf9c461a13459a3e717e8fe53aed8f693d65a16c6bf670de21e200000006c7575ba1a26d9e348be016c76cc08e633a8514fecf863a3ed4a542a9e02c07a400000001cde538e1b7fa3d2072ec20e2021d3445232b52e2749118a38bbd6c64566dbac41bc5cc0a00981ea5c031ab46d5373c1317687c2a24e465623b5cbf2da36bd0a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2676	2052	iexplore.exe	20
PID 2052 wrote to memory of 2676	2052	iexplore.exe	20
PID 2052 wrote to memory of 2676	2052	iexplore.exe	20
PID 2052 wrote to memory of 2676	2052	iexplore.exe	20

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2a382c0091f44c8e06b8c4fa1f32992.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4ec8bf920d4a749ce29508d161680d7

SHA1
bc92a509993ad1fcdedc5672c412a5161c46a984

SHA256
255b114067e12b3b09d2ea170ad0dae2f1918498f515162c59c3c62e64060a65

SHA512
fa7879dfab900a93eab813106a18645edbf978b60ec1730e6dc5ed4e60ee5caffbd0cc6dbda3916112d234309c36b0bf80200a390cd73cc82c38d8ab10ff4303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2250a5ed890dfdffabbe85860ba25bd6

SHA1
125216d57c1edfe2577ded87004c15cbd44063f0

SHA256
aa050c9b6902a515db248e430f484a1f97e2f87bf888eb54dfceb95ae0e1a65b

SHA512
1eeb04101d31f2cb2b1ac373a454f27d3df1ff226877b4597ed087b6426ee83a2f48fbf0f5ad346acabcc0bc6327d3355836d84b508b349b5cf6744b1043cd94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d4602606b0a04fa25c2ba3cce2da434

SHA1
fdccbfa1aeedd430781b322db2e8f058604d50d8

SHA256
6232d70c97dbd27cb3c7e6ea45698a98f1377c5e7bd26931c15ef1860026ab15

SHA512
3da015accaedacacd587353ea1009405a103f16539f475047f83f8f7929f1c82e91ea80f2c50fc231b5afed223176f0ec188b6d3a9773d8776334eecac8b9901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
613d8e4ad27d45d8aafdea0e9875d04a

SHA1
586297bef855e7b3e1b8061a584e90b4308b95e5

SHA256
8a536c445b0b26491ce2c9d7e1b3869c238764e21a51d9d8e6202386ae5597b8

SHA512
0056c763fcfd13ee3d9ab50b2cb2ddafe0d2ad5c3d3e6cae413b51008356c9c8c221b7e517c32cd7ae275128c2f032d444c77a3f34d8668234f7db456df89697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b5f655fc1056d87ba673c601f7c3cc1

SHA1
903e94d8cc05303786ac7a1de34b2a51f1076114

SHA256
d0480d4bf11b8f4de5926542c4e6065fc1b8db1784914178e28b254330844f39

SHA512
093bb13883ab04b0f919162ba8c744320315e4781b68034b3990ed188fc7f8b887e7648bb2d38edf66241e5c4fef83d8f8dfdf4fd837aaf216c699387ee57ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90d67bc66cc3014e694a2081e8a50183

SHA1
6267ae98b18850372df60c073de11a4ca42cac65

SHA256
51b9a8d590f526d59661b4241e294537b5da4a1315f4776a2dbe6275b7c1ac49

SHA512
4c306dd68dab93c4910be97f7785ffbb694dd445362164e0d12c9706a6022b0bf2d1bd0f9be43d57491a49e1d9a4ff8c15f303c20d13ccf92a336b54e4736c1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37b47c9082835c0d65ad6c5445cbfeed

SHA1
9439fe320ada47568662e084b22161e9dd838422

SHA256
2ae8719998ffd32173843f83a6985a14cad07dd7260f3961bb22b81a9ca571b3

SHA512
2445aef8b98da110f0e82d6601effc6ab1093a6df6f8c57173a7c763d2dc8c36b660a31a78525c338307ff52b148a936558fbf4da4d03476439de7a1eb891542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07dde71cc417b097d03821607d3383ae

SHA1
64f39b2793e1f88ed0ab9a4c1c43d0aabeeff954

SHA256
509761f14c8bcd7d023e18312419e3003c16b7ff2e65b9419fcec31a52c7ecc4

SHA512
b77cf70a343586ca515cd5c9784d7f4afa0f63a93254655f1f8df536f81a243a957c9d4f0ac419b6a1767e07a1c6262eb1d19eddda7d4cdd4dd6f2ade99c8c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f0c0f2f187dcedab18f8a55e378d5b

SHA1
bfa178496bf221ded354def7f9c862781cb83c9c

SHA256
862cd5b90699e07a5e400dd05c8c71b441d48b91f8614667f32e3a32b7e711b1

SHA512
5f0c0d44cf7bce9e52e1893926deb3cb9f811aeae05fcbcf9c7c9a2fd18a603083ccde76b408359de4d504177ff1814b88b596d65b3df91cceeb3ee65bee743d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d5931497788c6bc6154c7330d9561d6

SHA1
6f6deed11960f77af68bb7938a740df992d32000

SHA256
ce8e3a5065ef5cf39efee25ac9ad72269185d0c3d14938281519999dba3cf056

SHA512
de388988e5f7d07d3b149ced904f242b323c1e9d5dd4efbcbe37f7ed44288f1a217c3d16a4e574087d0c40b3d5bb8c65160a201db26ccb65c14d50e9890260b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9673c8c9ca2857c612ed47d1b3e2efc5

SHA1
d103586af288137fa882d4c0c5ce60cfc32eee31

SHA256
d64a457bc56c3d8259f711ae576f005193353e54d26571210bb560ebb3c3d798

SHA512
8822a7c82cc2c3f02cdb64a61fe9fd4de9e5073d300c4403f6ff191ae28918df3a9faaa988e0a7e1945bc4f9f33d900052270509243141eed312a98b303db34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c33798691c376a9cdb5f3b8fe3880ef5

SHA1
c85a619ac8c04ffdeb99d26ffdc67492c7473aba

SHA256
74f6357b03f6e597a785a819bc252708a482159071877f24d4f685da268aef31

SHA512
b919e2b4702effc052081bd5f81e550bdc90596143a91597501b4a8268f87698cf93fae74da1bacd96896e3932e9545f383e9113a592f5793045180f663beb3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58dfd1a016371260630aa016054a2775

SHA1
c1510e59468aaac19729b77fb314e7fc44f9a5a9

SHA256
595d2d79bf38ec5c809e6c3a73d4eeff184a0c00ea1fffe8abdbf2b84ff92ac5

SHA512
50fa3e5afd8afde65d480ed2964ea3eee3b15a8e0e6f3fc5a3685209916b753f6a9eadc07eadd91a1b94e7928f3718405181f4e65ad0b10b471c9e5bb82c2968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3330057227ab4a7d29012198dc78f5ff

SHA1
557a9f616bd3fd76514e80311557896b21c1a024

SHA256
13ea43475a3fd5a9ec07fb2a30f31a48881f190fa17581b4e7a9d09cc96f6550

SHA512
86275c49cee2508911a94583cd3a44291ce354368dc8fc6c4f8fd81963bdbaf7e831565b548c4f60458fddd9e6741a50288741632f87a3f2c1b2ace2c53f6179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03010eb611f850169bfc7fe9ef8180d5

SHA1
4735611144adf37504472abbdd15232c919a2f9d

SHA256
e1e30e00debe0bf287d0882458eddaeda14e6c95afae40efde0065db4daa4f06

SHA512
f5b5144156a12340eec742aae5ecbe9fdce3775163f34889d06b2df891afd7ae849815733a49ed1aaf55f2f95deaa0ede71dbe21e440dc2c3eaef9d273d797f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8baf9aab5e432be2d016365d3a5c0f54

SHA1
610f2d21e90913f1d495024eb0abfe07b4c2d856

SHA256
53ad0b721a1fbd94251345196f38588875012aeb691988ddf10b85ac3dc97c44

SHA512
0e99b2840cccea74ea3f75f1e1cfb4f281eeffd5465a83573c86c1fdde0beedf3ac360298337c9fa86c3fbe1bf89ca026409d37aa4c28a5737f6b028d2501f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D40.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D52.tmp

Filesize
41KB

MD5
1c6b68df2a6ad6249a77f7e4af0a4d07

SHA1
7b7f68ebea3dc4448e64395429e1267840bbbb58

SHA256
bc2f9032ebe993958d8328b31242f3ce1de061baad545167e8ec7c1c68e7ddc1

SHA512
0ff4bc3aec98ab74a6ab5622f18444fa1029947ce96f636fe1cc2dda1789e360062d490655f31f481444ca4f009448d99d44088018e3470278359b4fc99ed325

Download Submit