5a06e2822092ac631e1f96e9d68563eec3d797c92c7f2b5aa2a0c5c7eb634580

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e506d4831a03ea1fdb9b596e9a6fa7bf.html
Size

601B
MD5

e506d4831a03ea1fdb9b596e9a6fa7bf
SHA1

5c1cd965adc8d24c307ba06ff0091dc06cb27703
SHA256

5a06e2822092ac631e1f96e9d68563eec3d797c92c7f2b5aa2a0c5c7eb634580
SHA512

a82cea3fad943376f8c1f884ed043002389db5f8cff1435d0a0a8ddb6b5e6e3abbee3fb26ee0562394edbbe19665857cd4baf87ca8b0f329f6c0504bea5263ab

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002bed32d43b2a31a86b999ffa6b9dc5d85b7c50c15a77cc7d4b96fdfcd6443245000000000e8000000002000020000000bd46b6476dcd506207d9ab99dabb9236a51280d4a4b2729dcb7c035da8e4c1162000000090fefc178a95e39259a28aa7bf0a5cd17d4367cf720620abe05d9cc1c4b3160c400000001fe7bd0df84c4ef84b00918bf44d5a0cd292e540a3df8c14c6d09b69ffcd953cc15e9c485849e2cdd82dadbcd3f74fd7545805fbe86960125c9aec3fe1034cfc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409556666"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2590A831-A21B-11EE-9DE3-E6B549E8BD88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008acef6c393c5be29f63f1b580a8a179b773fccdf5f67f22cfad6f55ee41c935b000000000e8000000002000020000000c57205faa9547e635bf3c846c125de440c8a86ecc945cf4d1c8c9601a0a56b9d900000006bfee44c93d449d831d20f731fac4acac96df83cebc8fd34991869cecbda03b78cbf86a08dca1cf3d5caab961dbc630c2c96eaf0c0323567e1671b512c4a06200d5223dec4c7b58ff0e192aabda45017699bf3c36272a491b16c5219e01deef65620de2dbcd90ad658e896bd819bd2e7720a2a88c0061e34b7ffaee9e7a99aff67ceed2543e2908361d05224c460bacf40000000510eb31f93585212fe9d2226af66c5d279a44bab2d7197546d1da90b319e01f68459d46a170c7a56b06e0c2ab6dfe173e445faa2e2aa29888256eab9568c9ba0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0241beb2736da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2176	2792	iexplore.exe	28
PID 2792 wrote to memory of 2176	2792	iexplore.exe	28
PID 2792 wrote to memory of 2176	2792	iexplore.exe	28
PID 2792 wrote to memory of 2176	2792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e506d4831a03ea1fdb9b596e9a6fa7bf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
daccc44703cb0fa8f46d802319edb7dd

SHA1
62d3d57ec73e593e889b63f14b745e5ff692a53e

SHA256
e063ae0762e30274e71e502950d9922b1ee1cbf71942bf1038e51207c89ba2f8

SHA512
0d6520a2e67f716b1b0d423a8b07e201088f3f22dcb1ac604046dbfd5c8ab5aba13eef86671b4bbcb6ab35a0dafe2af7ad0fb602b62a292cb3ec70c232e221b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abf4ec18d85400a33d5a335f81bd000a

SHA1
9fbb52d6ec5861172d235d3d1570eaf7c3e57575

SHA256
33e16dbaf35818288793b920d234cf4b81a7ca70f84cf3c53f65519fbaded666

SHA512
d7efe55cf92684e210c02c752e3b88d43554901ab10fc9d1fc1e27e026844801c2bf91f49988ad49e4135734e96accc0df64c892b89f8ac78cbc1897f297b1c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b745a284d662bc4ae1ea799e61730d

SHA1
ca1177d28b1678b65aeec27573e873df18fc4e04

SHA256
a1e7af52defcb3fb3ba7323599d423730feee6cdfd39d201ed2837e8be6d75d3

SHA512
8ccade1d80c0ca550cba0c4cbc30c601eacff150488fb9d6cecf188a23ccbacff981cf1c0bcd2e5e9cd50449d6eef8427971c509f0688758a6d5f3f60af3ad9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d28a62ca631bc79126694ad7e09e0cd

SHA1
43a82269203fa8acbf81a6ba4f36c1b3ead75be4

SHA256
e034e8e107742f2013f257324399ae8667999fc6d374e1aae9d47efc6afa3a28

SHA512
af6cbe6f1e89c394e4937cadcbb7af406f29e50c44d3ff1d75ffe96867e2162c394f5768fcdd83ccc2ab72fc950d82a2342e4666ea309041c43d050546ef9c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
160a570a94c0aba19d7f11bd05376961

SHA1
a05799037daef2db8a802fba9cfd0792a45f6b18

SHA256
562d140b97e889aeee40c15c326e97f22332ffd93b6874b8436d97a434a9a620

SHA512
e90939bd70f0d6df61df4106eb3cd3c0e81d06c5690e44fc7a2c7721599f8f56077462e7a4bd73a2b77834dc7fb8ff407544bc3f09f130aae84a50876b1d3782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad8d2bad2e93d571c383996ee759ee2c

SHA1
14151f1a4f44db5ac2681f0613ff8321d030a7f7

SHA256
758dbd0105a580e3f2b9ab61c4656ac05bce58811ca4597e3384a1809c5dba44

SHA512
c44e84c03cf1fd465ee4922296e804355936b001b19784afcf20b12ea97ff9b46894eb3032fc66f1ffc668af535ad8be5c8b3dfbdd747f8ba06d7b3d37a7390f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89969a7a1f4bfbdee502540112755f0a

SHA1
e6a747f7310309c60bc19314cf33679ec933ba23

SHA256
833b58c665d3760243338eaaf25bae765f9ed54a20722d525d119ac0a3422275

SHA512
40d4c324be174d1db92d4085be1c6ee7bbf0181016b3aabe45989c86b7786076ade7c47f48082d380c3c2c21480175614344212a75ffa24559242568f5cba889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
727e5e6b054083e1cba96f757841bb76

SHA1
ba52e1be9bdad58157c9d57451b83328565a19cf

SHA256
2b8b99dcd8444b79a83cb4e42b573cd520ccac1b2fb27d62292e5d80a4a7d862

SHA512
5aa6962d8c6641f20765a0d5b4ddbb9995d90322d60526032b32b6f634b79657edd6644b97924bf24f11de81dc01a072d787677f6d1382440711ca241ce69ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d09d9c0df8e7e52d062978c6de5048b6

SHA1
9aad5ade6e168f95867ce7ea866796b76cebe4d0

SHA256
b12665b34eda39399338b1dd984a9bd0b4e3e67c6464e96d0fe0d685b2b3961f

SHA512
5223b7cfce9c65480a45d4843588f7f374e5eb20891ddcc51b27537a6262b62e0623f2e1f56ea277dd463fb61e04992e308697227e5e752eb7d654899a3a87e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8ec1c706c9bdeb0fcbb3a91ca1bddfe

SHA1
1c54a06f9d2c802d7a0ba37ea401bb66d62d1512

SHA256
50c1fc0f892307c94e226532d8023c17b81b8b9b50e8673da0aafa70da0b66e9

SHA512
b055bab1968b4391d4228a932185cefad7b23da15e1df36b5609110ed468caa233186a7eabcc4460d72e9c580023438714f389a254debfaf46fbd1e64d88c666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe10053f8bffcc69668e3bce4e9f21d8

SHA1
c62f0541494f68beec19145b368a78180c51e32f

SHA256
6e27260c493b8a64d91f9343ad388c84563c070b5220a7b7b158d8635a6d7d1c

SHA512
c882c1f9f6c67e0e1b7bc242ac53cb2cddfd3913eb7e1ffb8acddb11a5d08453d060db5f36b19ae0a5525430ff576b201138a69710c8fc114aa5cabbb793d552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c2520af57122786cd4483295e8ba0a

SHA1
2566622273555dc5c5e366bf2254cf74af408026

SHA256
08de65c82cbb7ca39ebb7b5aa075e8f48fc178d7080390e19e2c63c466b9143d

SHA512
0ac7d352b5da0a9f256b1c75e5f5bb48d45f78baf3ff099d49d38a413470611b6f579394f043673853bcf819c590bc91b624fa09bfc767daab1f0b978a87f64d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b26366bf6a8092af4f9ded78655db0ad

SHA1
1b05ea51efe7cc3947d1ea455471959c48072ecc

SHA256
918821eb5e4ef04241027a930826539dc4c2e3620858e5106ed4fcf4d024de33

SHA512
eda0357c5e5c8af563330c9ed105a3a1f61385f1efe7d2977347b3f82a4c8a80aca15ddaf592c23a28d036f6e64f0295bee721ccb5f65a1d94b5dfdfa2185518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A2A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit