ebfaedf0bcdceaa18e9d0a2f6ea33db152c6d6b40f3fddc7d1640dbc29f0fceb

Analysis

max time kernel
138s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9e4a9f6a8de1d9d3e36a6efb062d94a.html
Size

979B
MD5

d9e4a9f6a8de1d9d3e36a6efb062d94a
SHA1

fd215d3c4fd23061ada9e7e0fe7401b566b89a63
SHA256

ebfaedf0bcdceaa18e9d0a2f6ea33db152c6d6b40f3fddc7d1640dbc29f0fceb
SHA512

1b2cba9c6b0d6983ce065887e924306d59e6c4aa2ba9d396c2d8ae2f092c9e3c638f17c874a0aef6a03655e38290a785493374c54759ffad3147b03342573e58

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004046e67d869a05f6a021ccb86fcc34f77d48dc216a0f20153a47f2877013e683000000000e8000000002000020000000653fa590e90846abbb7abb73376ab02ccf78ae95e5ffe09ab12abf6fd42ffe0e90000000e72efe2824eca90dcaa99d7e8ecd0bd493c2f7e67cdf4a9978ae584616ee95a0a8746851bda15f042e02402d977f46f8e04770a83f9a940de86b9e68b2d85ffe6de3cbdef9d3321ff0fb1417d2909301e899e44806ea8d62ec302318da14316a3ba8111f30477e034efdc86210f42b66cf593b838b5756bedf0575a0c68438c0edae8dc9fe9de6d3550c74d2d0c6fc6840000000e4ab3cbf8cd8d54e14132e08305545d36a14eeb725492d47a85c83f408476108fd5f76c9496ba1e7e8ba886a01c43ffc025719e8caa59a1ba180e7d7db285ad4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B41EA641-A105-11EE-B0A9-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000dd5febaef74e625437d23fbf57269641cbd71100dcd02bd95b2408e5ef61f232000000000e8000000002000020000000c73eb1f36852c4e27e7e03e924c23184a291899cffa35d899f8342ea555b1346200000005a58d8dcff02f3d4f9349c24d39bd3ce07da48cdedff637dcc84ed95a328e504400000007add8a53e61e5b574a2bf348f40a42ea48b169f81e06d2672827c2e8d6038a5847939b7da74a5594da67df17451ddf8b148acf771d82f3b65943c0678623d646	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0efa5931235da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409437508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2736	3016	iexplore.exe	28
PID 3016 wrote to memory of 2736	3016	iexplore.exe	28
PID 3016 wrote to memory of 2736	3016	iexplore.exe	28
PID 3016 wrote to memory of 2736	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d9e4a9f6a8de1d9d3e36a6efb062d94a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1518fbd0e1df2804d7909b369a5e33b4

SHA1
bc457937d6262af7d60f2f0160b83539d521d357

SHA256
9b7f600f5274469c5e59bcb0870cf9b4e8bfe1f30154a93978f4125754e2da94

SHA512
c57606a77091c97fe4c481abc64285c47c97ecb64f08f2f3501dd0697fc5179572429482b05db498b76f53dbd6cb5be39ae222fc5fd276a93ab82933304c82e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
075b974ee969018273ae0d1dc1ca58ce

SHA1
f42f272b10609f919dd4d52fbce00a17866643c4

SHA256
d5cf8ec36c9ebc25ba84556c3ffa14b7b5865590581dbd6eb1e8cb4ec101edf0

SHA512
0ff38f2e9e5ea810c02dfe957e4f3d7c42216a6760700b3c3157e4d8eb75d83331bf022f0683fc55596ba77a7bf43332e35079e08f234871fd4711aeb36fbbf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2470121526996752b313f92c5d4682d

SHA1
4b8aa76e6296ecb1ce1c4ebef19bb3eeb8553036

SHA256
6085287d604fdd14e88ef08f86fd40a663e4dc3730730748eccf4ddf0f681695

SHA512
3e79e24670d616a0d9c12ac194d8d3a42289f90f5cc6dd95045843ee8e792cbf55dc0a8d2253c4260b99a9c288abea4271f10c626740aa175f772524c5ebbc5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32015052e9e38165a801e2abfe3dffd4

SHA1
20716118121cb8d7a7a8294294b3e00cee8381c8

SHA256
394cfbe4c937ef0d86d220f7b0e573e2f908e2d5cab9630fda073ea7c607d4c3

SHA512
1e4e2ce000d1a6878ddac28f0deb8e21dc96524c4f25df4db7810d704e8deb24bb7e2c3d0680e3bf481764d1be4c15f6223a315903cef15aa00eac42c71ad65b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3df7bc10d814818bf38dd2a78b61043e

SHA1
745c2cf36d72724bda4038f8f881200f0e451ff9

SHA256
94e84621ecc9d8a80454fa8156eab13fead8de48098c114f4f2cda3e6aa7397c

SHA512
12c638b1788d2c064b631f365e7de327bab453b3c47d676779eff62e2defb41119b38dc454d5071d6e54ccf6364cd72262c8401a01563bed0098dc1c36dc3e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9050bd674715a9785c5c562aa064232a

SHA1
43ff0b8ea17953404b0afeb765f907f53dd6833b

SHA256
d989c710c955bd870e4f6edb43b558e877a334e46e4e9b3883688b1e0a3e4167

SHA512
0d7152d5b13f02dbdffaa1d8a6ac8edebdda4d09e5fe5cc6b8a0c884b74712abace08bf5766e879d8744b764b38e613a300d0dcf8c56d97986c5dbee70c7557b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d54735e4cc99c5aea187955586c4298

SHA1
6f9bf6f9efae035e60fc7d27c097a9da8f9e7300

SHA256
2ff963a71f738173ce326f097ead25260c7f36f5ea98b98f4fe121d09699ddd3

SHA512
a54a8c784b3cfc6c2a637c48f1037d918b07b46d8b4162329c5afc549053127a3339dde96336f099d24bcea06945460c68fc8a7d1c577c747779ec43ae1df082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a83861e68ef63b97c0542ec23fd24bad

SHA1
bc3ef04a82bbee812a6ea4c4ee885c3dda47d08b

SHA256
537c214c38c27f2c8bacca4986196db3abd2f1aaae09ee6a56d21fa5203a53f9

SHA512
092ca34ad66f3517f15c2b66ae962e04850998402786b6f415b390af5a68fb1ddb5f2d3e53dd38ef8522f1bef93370d318b8dfb12c4d69b3dd4d31a774ee8767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ae43b7761c52acace5bff9da1437a1a

SHA1
d2b16ac01b118a073898fac4f4361e1a9d6ea76c

SHA256
32a47243b4a8b5aea66168eec63ab2c45146b943296ee2f2a01c1bcf32313dba

SHA512
2d35db21d9bb9d78d5de762f66c662ee0fce05e09ffcf7c1ff597e9c53948ba24f67b34a6251519a6535709aa0a706028eec4fa6b9a3851cd7b3a21a7b74f653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95ea553bdeff734f55fa356c58f6345

SHA1
7ca44c8d2ce390ad011ee9b1fe1781ba1fdee6b5

SHA256
13f2fe7783b3fdbd4905f711a490dbb68622c52ef16d6da7043b39ca76ef290d

SHA512
c8f4a1ce01ab7e48de69e8ca5880806c52893767a3cf3cf5e13a8d16a251908705c14d6e5eaac5c6b20958e8dc575b97b983045b9fbac981fbd23cc171516423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7841bf6ebd8e1232c8ffde441f21121a

SHA1
f340fdeb182943a4c1e707b24ca5e75a8ea906a9

SHA256
e562b06c5f5b8407e1dbef92029492ea5058adee59c229c4e7c8c1f8c26338f4

SHA512
7676e0cccb5ea763af3a5fe71a5df8e485cf18e18d00b0939cd9cda4f2acadb7af4a1e260927bb67cb627b8d1dc9ad4bb4cb740d4489d7fce443f271516fe72e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db1436bfe6de0be1df781747ebeb6fe9

SHA1
4d6823fb5aa740287e5f6e9dc511211e7eff2dc7

SHA256
5846f38c9b5ea345419720160b2a65618214f00af78a061b8925ab8061965010

SHA512
af22174438d21fad0f06243be9a3e4180cacd664cbfe5d15760ad4f7a4d591c055b06d1a6efa1c53323c116b5d6bde54563a349502dffd1cb1138eeb4b2ad673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2d62ee2eba0bafe53611d6bfb9eba49

SHA1
b886a16a2abf7de92be1b449d8e6762a652191cb

SHA256
fb956c86c670fc8fcc54c7f23fa1ea7e69eb3cb95180153419fe3e81faafd804

SHA512
0f3f3ac55699d32df2f75128c14fe3851b9491a9cfb47491c91fff2d7cbfcc4c8dbc180b0c736d33eb70281dabe70cc3c8ea27a7aee3ba32319dbcebda3e9c82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce7d866ea636500a45f3436f316edd1f

SHA1
b71c3805162c73cc952f9e7554e9e797ce4f5f79

SHA256
cabd50e3864b3a018647ef1756ec8f9be9f74f864935ab52c8c541922de0f01d

SHA512
6fa0582c92ba54ea4e5a73febdee5619ba9a1ff193af925e3f0151b8ab199a9670d6982b7bcb3b0791bb44e2c33a77884e276a0395d1b96184dcfbd4300f4a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07a52b537cb35998cd8e22bb627f78b6

SHA1
6a32c02b0ef6f2c5bbee63f28d109403b25311bd

SHA256
a5de99a032e810a3eaef4e152cf093765f45ca634aa9de714fcb22705a930e44

SHA512
e7e07f645912893858b3c4c992295e92b2b2b77d517c627e9171918709e1ce8b61e4d6697a679eb7fdc281d0eca16f36a156c0f776fa68ebfd250cafb3033546

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab516C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51AE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit