7244dc228ae565f2e4eae5a68960108784c63f81102a59c363f5f95acd73c580

Analysis

max time kernel
120s
max time network
164s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e40e1f061ae51b650e7b29e741e55519.html
Size

601B
MD5

e40e1f061ae51b650e7b29e741e55519
SHA1

cd7d03d8edfeb9dccebd895081648d02cef07723
SHA256

7244dc228ae565f2e4eae5a68960108784c63f81102a59c363f5f95acd73c580
SHA512

2b82d2a57d5cf90a326f915b940aa4e2e592c8c2949337f9c8e34a61b81d947007cb4f2ed6e56ee64c27778d820eff0e768ffd802e1f10511583b42629f761ec

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4029b0471a35da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c4e7d946981b1eb12d9fb0377f0d0f81e0df5e9c117c1fcdbad8a598d4e430d8000000000e800000000200002000000041266fca083b31cbd0c398eceafcdcf36abea2be65aa1b78404c2ab5f9dacc7790000000afc029a46fee080b597b7e47e0561e210a0e1c99c92c01cbc64a16b22210baa001e2c5fb48fe19cbc09990532ecec95f8ada11dedb17055079f9849da587cb62f3b3fcfc1848c895c3ebfa8ff899c37cbb0421c24439eae43187fafbd4ff4bf456c2382154e14c3d63f2accb6533a7b8871ee094b5368dc7004e094de63aad750c30aae1fb18a3e732b0bf9f0c9ba4ae4000000008376551d35f9c8b81676a9d8b7c8c9a63c3d874807258227ace98806b81ac4c6667f60f53ea085ded9e93e040ec8352d9b540eb5f152a1569270241927f2db4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000016737645777e49a7024739cb049069fffe3d51247bc88ce405a8e0a40e8bba31000000000e80000000020000200000000b2bed12d55a687c829804c74e1538bd029ee91f8ad6cf1821943f02f4e83a0520000000e8b1921df13b403b92c0599bde5f7f919afa2a3ce116e5382a8006e0d9ed482f4000000095805de81c3dc6b506f7e1a3e394e0831b642112a4649cb8a51f50c1f2a549b02d42f4f6522bfc30421834b96a8613f7c13f49fe679ddc4ec881d8b3cf81a7be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D4BF201-A10D-11EE-9B28-D6882E0F4692} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409440871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2748	2012	iexplore.exe	28
PID 2012 wrote to memory of 2748	2012	iexplore.exe	28
PID 2012 wrote to memory of 2748	2012	iexplore.exe	28
PID 2012 wrote to memory of 2748	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e40e1f061ae51b650e7b29e741e55519.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63e99fed07f7eb57dc405e8c284f9252

SHA1
d16ee8905abff10a35fee131cf106ae0a3793aa4

SHA256
a45e5c992be1e6eb1b9291ca12c97b1dc6b4ca301b330ad32b71a117c6ad7cc3

SHA512
ed2a3ab79ea6134b22436f333725694a0c7f9edd4725c9952561c260de8cdd5440586d4734334b2bc727932045346c770541e910dfd1b28cee9088a145dee2fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8da6b885eabf55780ecfc83567bd16ed

SHA1
7e82353b4e050ea61ef00b6aeae82e0e911e7032

SHA256
550c792689a68a65197f64d8cbd505f8c21d3622e5766aa8db59bde2847b47d1

SHA512
c1e47dd60c67a2225b6d43473e0caee4d589630ad3cfbf96c32012154fb6b217f57159e590fc50d464acc196040e3787895968630f600b26a1263e42cf36558d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb0595784cf798e0ed6e8415d40d5de

SHA1
32fed9265dec8079db574469f7d4bc108727cd92

SHA256
6ad896964b5c8b97e0d50663af460ca8f57541d0eb43a6b21efc1cf5eeb420da

SHA512
070b9bfd1d3de16ce8ff1d2744c91300f9954c116deec252bf33e9180605af6cb07c2c63077713722757801fbed7f95a0f77a486b26741e3232789f05d1e3873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e19b4a9d18484cf14c39979c804756cf

SHA1
5c30edacb7ad977164190c9c2ba15aa9cf216a85

SHA256
bca376d74dca02a3121e2b0d64ab61a198766884a9b394697379c4cd1461485f

SHA512
b1054ca57d771745bd0d3bb2f30b856d120a9cced4c276b73eaa26e0939e0d57819e2374c5afb083ebc1fa1f54923adf7d06f0a7355473439fb74c6ef330f145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04d9eefabe70b2558cac182b4139b9ee

SHA1
032b30fb8f2f10cd4ee2758434a1172251a34d54

SHA256
076bcd10cb3cdd721036af997e1ddfab70b13ec6f6e7bb6e33012800d89ab5c9

SHA512
0b50b0f9651116d3591c72e803fcb7a6a664158b33e30cadce3f7938baf18d0dedd020eaac0f06fe9006862b478644ef826385421f63cde38bed74996ac9d233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6c9fb9b7d13acb4edc9dcdbe581a69b

SHA1
7ccb4f8a05934e2fb320ca504094ea19f66892f2

SHA256
32da06eb2ee9af47867542975cac322f58715115558ec8383e950bbeb85e6426

SHA512
a5b94c48c249abe37b96d11930f329ce665a5e4756e47ab0e2c405a3359abe73f561602744a73d37f3516ec8b247b467e67da2727226cff510aa559302228f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ba30bc7d6699d33ddc728195b69bd83

SHA1
e7411c9b19938c3d642025c231b4b32e2e7347cf

SHA256
71a9da5b9012f4f53df2243456a7f75309fb27849463b25a9458fdcdd49f3733

SHA512
3391df235b8214e7425b91efaebdc867bf8f33a11c16ebc724a3c009f730b7a7bdb3b10db0199edafef280bc4545935e2fc83012d8efff2d1506c237c60bff56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce783474031d8da3f03b62eb382c6fc9

SHA1
1d575a6912aca0e38fac838e81c9b2efc05a7047

SHA256
47b02641e31c2326f4f4a60845136c3cdb82d86740d5d2b0b359c283c9ea85f8

SHA512
ae1e6417a1ba84357f6225fa7eb7e38b7e1706f191cd9fe6dea811786bacf2ca856467d35e284f7b3869598d442c781ce220a0ab53fa50273ab20ace3a5a8cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b881bc5b4624ea8751de07ab32cb17b

SHA1
2d0fea8436f2a422e842f3a1720da5303899be5f

SHA256
23860c0e7ed6e402160ce4a30366188cadcf0f49aaaff2e244528159b010efad

SHA512
9ab87a08a1721128909c7bf718859b132b46b985e23e8f82a3799b76dff1c8407e445990ab8d1e97984371cebf86fa629e3d5a3f6f0b51dce7ae1104171ab8a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be5f6ac9d767449b05ff449670d0dffa

SHA1
14f459e8f3bf4eb900ba1b19ae3d71c16a5e33f6

SHA256
41d7bb3d0b30269249d2ac2637f911063efb4464dadc1c47ed5a8130fc82baaa

SHA512
9bbaf894f7d5244b32fb0a02af97ed5eeb97f2b334a952d717a20d5292c288a89b3b8dd60811b2e63978d6548fe0e97bf9e274f7c3ec982d00d7095b2560d798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b39aa4f514c93b4ec80af7317f21a4

SHA1
b013fa4f80bf8db4fdacdf3d7d84e81f3e5de996

SHA256
c0feeff414e68d59c03dc3948c3467a1d80f3e4dcf2cb433b273fe0fd0756499

SHA512
1380e8e36586120ab597f7dcff38fc95ae834e93087ac6cc9a4efdf6df2ed72c79bb910c4f011aa486aa3335f2653670d990ef51eabcebb93196300836a2f148

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6DD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E63.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit