d02ba779cbb0614c6a7da52b973f13f3f89a547a1aa5afab6714cce2962d153f

Analysis

max time kernel
139s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d41511e79a388e31f07732b29870bee0.html
Size

1KB
MD5

d41511e79a388e31f07732b29870bee0
SHA1

5232886ffbe37663b097732e34058c1f8d9f2b46
SHA256

d02ba779cbb0614c6a7da52b973f13f3f89a547a1aa5afab6714cce2962d153f
SHA512

dbd546e01bce9a526bf0789d5829ddb220015d3bbeceb3cd9c07f96f9354d8224d4d3f47380c98778557250eb6e71e188c74b4855ef07211b6c5c82f3ce8c3e8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a9613e82220efd415a51ba760ada6818c65d521819d37a86e1d3d6b678965f5f000000000e800000000200002000000068ce3022c361081a2ef2236eb933506052e312fcf7129786910b99330f687f7d20000000318e4a3518b7327a6cabbc7156146323b1265882ad1fc1c8af3869b79d78a876400000009749068bdc8b48f2a7695174b37385d99370a6132df2e2e35104135c35ef70eaa1913386a868a0bbcc372a2944fb1c5ede7555c4086a3737cd5e851c17ccca5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409435435"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000071008872f3e36a98972b70a55ad84e612e6c95604fcc192c374526163b6855e3000000000e80000000020000200000002c6c6e2204acbc82645522981d76b31dece724e7dba3d488d2175ed3f0a25de090000000fbebeb5edc418b9029c79f9d69a4004eb2a8e7367fe444991db28191438ba3eb173e298838f5f854a14be4eac27a95e2f6c66b08f5d9a7eab6653626918148c5c3a7d2e7b6b028a2aaefb9ce2ac82fd0da14bbd714dd61ba21ff846be61ce49e1f64c905961c8c23dba97529d707de15d07faad55f2d96be6dc4cff9c126e0488090617763c522c16d4e87cdebdd4fd240000000f9bf58f314a4b682879356a16ccf2e58df893e8f6467e23deab5acb0a335dc9d3bbb559991ccc7d138529ed5ccb4d048d1dbd01209ce9404f5f4c6042f8980cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFE05121-A100-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03d30b70d35da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1452	iexplore.exe
1452	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2668	1452	iexplore.exe	28
PID 1452 wrote to memory of 2668	1452	iexplore.exe	28
PID 1452 wrote to memory of 2668	1452	iexplore.exe	28
PID 1452 wrote to memory of 2668	1452	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d41511e79a388e31f07732b29870bee0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc580533d2a7239bd9fb001c8ae0c3e

SHA1
f847845a1b2a0f77b4c1a75a333ba2d11ad7dd25

SHA256
6a21366d067f0064d31b8278f73796bf015d0e83c6b53a8b7b66091e9b135910

SHA512
87e683424104ba03ecf744535dc022f0957fc5c7816e6b46ee26e617119a877ca1518eb1d8fa0ac83a14a8ff7c2cd9e574497ab78db828fc31b01ad46dd39ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae3f378d593b781c1beb22b7ef5aba2

SHA1
9b96b872b2cf7e9af17f78c3969d253233011bdc

SHA256
6e0925989d67d76761d9d125ebd7e3fc6431aaab667467b29b71a6381d776d12

SHA512
a24161456b7c5f606c7165b0e7e8c9caf48e2ae0f4f1c93a2d40229d63bf0298c66abded39714a4b9e84c8d4780734be0aac9ca5c6ecb424f90f189ca6434565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ece8e9d2587f9f9a1a7a286faa7cd8

SHA1
9f08346ac14db43daa7c31512902cd713e4cabb8

SHA256
566ac8929c466798a8f6b1be9fd06c3ac67853abc5582b8969415d28723ba956

SHA512
069c28d15ae2aa1774281d1cf9b346da69b3a90c1ac22ab25898a20e493713e9fc553af2d3a69fd0844071e6d8b36c492d3c49a77675b03cd98d6cf18c139ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36e2406b301e6eb62719e73fe2f4bfa0

SHA1
a9bef40477e169343c3cc789ca6829c8b5f885bc

SHA256
3fdc09e89472432968b004c7b43a4f5016eb1fba4d057c6f4e6ba30bf35c3b04

SHA512
d7cfabc43cd15615dcc22b23beebeb4213fc00f5c0c50544fde4abe874a6d5cb136485175432f003920be4322f6513daf0607c0b6c14f0731c186b7bff64ea2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c7d12efc1e0c67a1b677dfe6b83c804

SHA1
93cdb3ee6da8b1a6cb0e070c9934784ad56d0553

SHA256
6f64d9379398821b08b01cd2ef462652f4b8bd6102868aaab3e9820da40fd867

SHA512
e50f7cd80495d8c615a1f48333e62805f1f7ac1916120863bdd4ad10f8094fa473b7b6054e242977144e66e190d7c597abe5063156e88aecff2780705c65f9ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e2fc40e76f437edc70bd337138b7c83

SHA1
5a3c7f123fee3a84a5b8af9125c1f6af5efd862d

SHA256
0020a51dbc8739fe65675c8c00be7037ee6eca88947b1630ace65a9bbbe65cd1

SHA512
792583d5964c24d89bb59723b90137422628b3eba9087e0655402efb003c3a48e4333ed630a24ef2a4f7a4158cebef099c8942c645de82b29bb97d01d22f7507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b8d28fc2309542884806b11f830b6b1

SHA1
b1508a2e9ae8c10125bcffc21ade0add004d8b58

SHA256
979c4717160fed096c76cc68395e22449db440379e3f2fbe556d29100d3334a6

SHA512
cf3f7f9742a2ed41087e026de2f12fad35e381b3b23c3dbdab4b832ee34a32bbac902ec327bcfccbf525d8eaab3e2c04c8727e945b064ead5406b312218b7c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaf49b87970756c6890b4efab196d78a

SHA1
1bafb77b82b6f84460c243c6b776213986cc4f79

SHA256
08bce633b06d787fd0424a9d76703556bc146a3e399c97e843c05d952521dd46

SHA512
c329dc8b49ce8510d35897f5e690893bac7d8f4e81e0f4513f162e2293779d51346d191e96cc73d24b1f2fa70070cc42744b9bbe6423a2c576328923e8c02560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39af10b794e7e0be58d114b7c6d29e53

SHA1
a902046ff37f170a0aab069ce7c37454bed4fb0a

SHA256
682cefabfe4f4ff1289a46988a8eb2f02e408be51d5ffe4b3f557fe7e56e3ae6

SHA512
0ea03a153c65dafbff273a091dfd5521a5edc3ac5842100fb94c8b9ffce1e997fda12e65124e04e8cbe1ba3db2d9532af796f17b9145c2d5cf5e83f2e07ea1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e95a5333db40e5ad5c68c51fbd7697f6

SHA1
3c7b71453fd8c9eb1e4a04006153ec030e1a94e6

SHA256
9ea235fec3c359aaebc528ef4c0303f3fc3b6e00e43c452574356d62e0cca1d8

SHA512
14cd7ac86edbebdeac57087e38027fca068e02eeb2af095a884fe395ab58fce6bac5063e5a2ceca6de34518d206c4061bf551eda9c6ec4861ba8df19196ddaba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a17035925cdb3854bcc2f3acb31d2c8d

SHA1
93efc5595e933748c7984c1ba2d7ec78782db652

SHA256
dd23baeff972b4bc46a2fc63c920bf4bdfa7a350d3ebb19b76258c6f772015e9

SHA512
a717717b3915b081c80016060a5aa703ebcc5f6bde6618399f2b466e6139fa3070a0baa71924b55b8efc7a8d73bf4f2e49a90c8347fdb57fcce3324a1fe03c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff3bb29d4354b45c80771a8258f7b4c

SHA1
b6414a262269d6857d348c3bc511ac8644bd0af9

SHA256
27f31a9b47cf7d6be23a0ed90c8f1213ca5371f33b33686e798c1661a5e77943

SHA512
028c801bc3849fdd2e256fa309443272879267b7f2d68243bbc396d298149f7dc08d3209eb88238505d30360a14566aefd2bd5937bee4279f50caef71ef51654

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9050.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar910E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit