0e6e097acc1066bb7c24056ba6742084a05b81734fc6af7c4cdf36a64ac9364b

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2e33e4c4abedaf43456bf17d2976784.html
Size

1KB
MD5

d2e33e4c4abedaf43456bf17d2976784
SHA1

ce16a1b5e7c2c033a249a495ae3915d1000884a2
SHA256

0e6e097acc1066bb7c24056ba6742084a05b81734fc6af7c4cdf36a64ac9364b
SHA512

5e646ea9a704b2392c9a9abd964b0e9b3ccefa611304ad863209ea4dab748581e4cbb9af52dc3e0429384e9f971f8a5cbcf189874b30e95f6453abe634c17a45

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5172521-A0FF-11EE-8A38-D6882E0F4692} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ae55d0b873fd583b7b099a2c5fb33cfd9395d1e945f9c167a0b172b93d6047e5000000000e8000000002000020000000208fe88a99d1c485e476d2a756f08e177144e77cbb2db853cf7f125d730116249000000018017264e7d4e5d81cec028b60ab00e8bd5e0230b421340e42fad8718e5f592fe7ce44a9ed6d42dd991c9219b12c6e435179324fed7bfba5b3859b3156a0164777ed7931a77e64d45362a0513dcc3f44b421ffeb065cb11d7ca7d6288477e5f4482ba08e4d3865663e67bf9a93a3af555f2fd623e62e16015a4aefb83ae1320a171cc829d00b31670828009a5331893840000000f59820475c0ffafaa75aab5f7f853fb85725f9043dcd5301cea6c3bd22e0fadbfdc9b5c43169a536efd1ee33c714235fc7a92c91d68563f4c8c30b33d60da34d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409435015"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f9724b595ef16d3a7d6af9ae23b4d372c4f17c1a355d42f9cbe5ac2f24c4678b000000000e8000000002000020000000592c191deaa9987c7dd5d6418eb956edb28974db737e783d976ed7a0df87aeda2000000010ec578b4bb55528c50c6be5644c93365a847c77c9ef3dcae2acbb9517bd3a3840000000ed9f519eb71c35336a4c3aa9576a34b6a42f6ed8aa601af80507bc745ab9a0bee0b5d7be9d7a9024d2f60682a91c58b96ad433ba025a295280b8d991812bd8dc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01378b00c35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2876	1940	iexplore.exe	28
PID 1940 wrote to memory of 2876	1940	iexplore.exe	28
PID 1940 wrote to memory of 2876	1940	iexplore.exe	28
PID 1940 wrote to memory of 2876	1940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2e33e4c4abedaf43456bf17d2976784.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc5c1b746ca4c49a761b37817e6693e

SHA1
16c9a32d6f3e9813a117de9c9939daee54558828

SHA256
9abf352a9614dc38c97822f79f878d42c5f44d7a6d4d1444f755c554320d4e3f

SHA512
9daa7cefcdeb6f510ac6e48e3b07f51698c076b30e24459591511222d7635a5c0eedc5132b6f1816647fce22c7542820f566f348c31ffedd7dac83fb0312e2ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e196e0401613b3228e6c77351963fb87

SHA1
85708087d3581b5c17b6414455caca59af96b3a6

SHA256
91bd8c2e1ac46c5c53e8b97f9c346afb2805631b93c32acea08791ac45d02d64

SHA512
97b29be955034afbe0ea11fbb6848abda8b6b0e2cc9b3f18b2fc58ad2837d8c0614736321d495a5c470e9f289d4866abe71a086ed388ae3f175c33f0ccea9d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8effb8466a44d35ae0ea643a0c146a3c

SHA1
0c9ca51b942e2429b8c40433ceae5a1834adf3c5

SHA256
07107fc3a668cf20fe26d13b6e9a1bd7c33cda8fd9b404a4db6111fc71e8b2e8

SHA512
46c74ca4ced15620bc9590b0ea5cffaad4df5f4dac55d204ac753bb008db3a0f28a6c9e1f1c4b6299e62114949234b6860b948c5177f7db7d44b8f9ff33f7f2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce0409e14064ba3c92d69745f8f5e5d6

SHA1
b1a3c65f55d9cb3635204a658d3ae32d830b6861

SHA256
ff0ff29bd33403e9598b8eb3cdd81de9108da0d3b1939310046888da86d28363

SHA512
78868b6cb1631f782c590c2ffaa7b2b28096a7de008dcfed7bb25ce3b62885a52cd34dd2d0d17655a0c0793ca2682c8e2e0424da5adfb35bb3dfdb7aa4a29770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf553df5d64d50bfe7bae1cc4d4157e1

SHA1
38c910e045e902b564dc54de6c2d6251128ab90b

SHA256
b65aba8afa6c1f46887b0abe4964ea7fa5cd4a88c25e6216175ddd3dbc9a0a4a

SHA512
972203d028d7062d85aca0203dacde5ae5afe187e4cd21017dd4ac37246ab968ee56d0a7f5c97446bd7aff76f83aa504c8e4e9738d37f7cdac55e471ac27efe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
179764851dc991eddeaf5164c2ba912a

SHA1
edd0b2466c6a6d5b90de213f88ca91b5b24ca01e

SHA256
299c5f9ca5c07533a18693c6f68752e66797de8c7a6b7914d198e85dcfd05a1c

SHA512
49db351a6b9670dec07a1328f9c9deebfba32accd2e92c2258f309ffb313579fd03469819d1092378ab92bdfd623b1636b2a1c1317cfc07f4649b75603b71b1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bcff5a9f13edda5428e1ddc86d4733b

SHA1
f07cac7bbd6764072edf62bd0b2686cd63338446

SHA256
7f55c1a5962c9f9923fbd491871bb3297d8bc40db5a13119e9a2eb3ebabda060

SHA512
531a0254ccd22f3e7a5863b990f555a385eefad5426a5728db302c908328d22483e539f5447a68a5a99c3fa955de53f4dc3ee9208f2f00cb4215861697d52b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f305422f5b61c57fd2c8087cff077aa

SHA1
16c079ddd49cf92c0710d52277b49ab4e68c47c3

SHA256
31f9ace887f899e57af7a79eea1732f1a65f000960fb5e762813d2c7143b6490

SHA512
b214b05c2225037d112b60e8d9904fcc0bbdb1434e21a96ba2608ffe96fb6210fd5fcbf001d7ec0967c9f1040673a58f7ae57d3c9e46eb4819b96b0d2bdcb3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6025a55958f7734b437f43a9f2ad6bc

SHA1
f7f698aa4870b6b1a80e0b1b522ab39d2a9af223

SHA256
5afcce903ed3c9967b223fc2d88e1045f9dc44d7689a1bb86a6c84f25e049532

SHA512
661fe15a7e38703563c16af186b23fef68bac3c1676e7874087cfd5246f2e1a0ffc66f7c9002d9e23f14ba356f295d0cfc1ea5bc1465f39563d0b4e15bbb3746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9764df9980871029b3df9e5cadd3c37a

SHA1
77b4fd14729a05f87dead8d71c89d1b862a229e1

SHA256
2ebf51b5f94b91def225b0c1e7d84187457fa4d9209ef6b3722234a44627a322

SHA512
87aef0d640fa4fe7df983a0fad96cf0dabfb3a043233bae4e9ee09929cd47f7f64bae408429066ebcfb4535a05ffaa4b97dbec25bf8b3d34f8ae09bce8bce8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB8C4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB963.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit