b490d04576c5a1de7fcb086f97ecab3eb8047a4da5dae8917d19b0a48e0a0b83

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e760418d19126f499614a5e238c8406b.html
Size

601B
MD5

e760418d19126f499614a5e238c8406b
SHA1

14a60cac40975377f75f0a0eeddc951be7cb45c3
SHA256

b490d04576c5a1de7fcb086f97ecab3eb8047a4da5dae8917d19b0a48e0a0b83
SHA512

ea1acab008cf44fc2c59459374593621a15299c28eeb8273f23fad9a3a7414e809c15c68c4d7d0d14bb37d6490065e22e97ac05e357bbed0d5c343b0e8b6731c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007288d2225524fab8928f89901ef76584862a34449b9f093177179d132c0faba1000000000e8000000002000020000000ea9074c63918d64929c17af6906a37cdeb2464bf1cdf4f2f787def70e096aa2920000000363937998721aa6dd828170ee189338b8683cc026ccf1b22d692e6038a745dcc40000000c93eda99c4c13334a55ad153c48aa043362451a7fc88bc3f2d21c5cab28e0a92eed9e134cb2fa77fb43b13c0f31ccfd6cca1607ef5f0560a2cbc79dff6eec1d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b054d1ab1c35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409441871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC092BD1-A10F-11EE-9B34-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000241e206f26dfb9f7fbf7462c62462ba7c6e70a2d5ae20d6dc12df97dfc460ad000000000e80000000020000200000003d7c8e36b38524b176812a7469c329489e3c96f1627c3bcb830aa1fa4e7a450090000000a220fb8136efc8c27e363755e47bf006823fc5672071c5995aee6de18f8ac4441bffec6d01099a4c48a35b779b65848836420a38f5a1e97f271541faaf98fd41cc9d517dfd6406e602ea02bf5a977ac6fa996e3d6a9540f95ee7dce0fb00dd5043b198afeea1bd3f06417786aca0b9c40d0e27558e255f0e1c13dc4c4d64c91189014b00120b37dab26b80e336f1bc0740000000a6f6cc286853a0b2a69705dd0d2405b92fc8fc07f8ff746e2ccdfcb1bec0cdbca6d48c36a0b298f47529016e8a9da0410a8118ed6da0d003d99b2cc59e450d0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2240	2132	iexplore.exe	28
PID 2132 wrote to memory of 2240	2132	iexplore.exe	28
PID 2132 wrote to memory of 2240	2132	iexplore.exe	28
PID 2132 wrote to memory of 2240	2132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e760418d19126f499614a5e238c8406b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb3199a81402469c7ad68ddf5b931318

SHA1
1f5a601ff23503448b9cf11074338a66a2471753

SHA256
f610ab5bba02dfad567f5cbbbf5cac179b5ca96b05ef2e977825ed5d780df5ab

SHA512
bd6ca12782ed0d8ca4bc78fd33360700b59c9616fff789d47b7ee3855bf8029124e5201802120f56a8fce0255f0ef3a66edb1bc5f82b813f4275114e5b1c7013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d50512fe9c79f508ece706ef20a6242d

SHA1
8d4c6eb5d8206e9f720fbb3739c4927181d286a7

SHA256
57086df53a6f366851af35d55be4d98af45afdc4cd8e2ecc3a4ee5ff58d67aa7

SHA512
003bb28cc32e5ca2f9f815f9495504b495272f02d34fd4cb2daa0ef900c4439d272702d56e803fb000a03849da6adf01e6579732aae765aed2d1ae43a1964158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6efd5fa9165ed1905a02b126ea0ec84e

SHA1
739e7ae081af4f87073fd15ec8d81f87cfccfc16

SHA256
32bd118885321642a44d6ec9af75dc4b16d720a3a14c2cbd9eabb5834e4954e3

SHA512
b4861cdddfa1f65346457c6cd70a78f92583cf7e70bdee9a16ded6678edd77500d86b00953e879f4b81292836d97b556ef37e0bd9ebed024f77973723001fb17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b84aa2f09d0fa4823bb9c640a33eb46

SHA1
e212997e46a8d9258207a9c5771ba67866086465

SHA256
308a09233861cd1f3bc90ef764ab78e3c0cea5e4cb2f83eadc50075d5b604c00

SHA512
5353b5d9a006aaca783084f2f12275b01aecbab48fa1bcd8feb2cc66cf19a5c39d59c4d8150618039d68b7555a95ddd7554081e28abffa97536f697b3a186aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6510078d97f7cb9cbf0158fe28c15b0

SHA1
10f8256b4743ecacb2fb44c187aac829cf97fd0d

SHA256
ffc5ffe621b6de0fef7251a49131bffc208d576c90ecf598470c30f1f5a79455

SHA512
c7bc94e2a24e39de7d99e69ca9a33c3388fed4d775826de5d0e14d567abbe49f163c0d9b96283d9735f98ac338a93f4ef2eb9536adc675bc984f20bce5faf84b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f21684b313a3375f2bc7adc2076dbb

SHA1
90d9486808fa9dd0c711b9e68606132844cddcd4

SHA256
82d9a8d93ee185691730bbed371e57b6126b94584da0090e89ea586a8cb48d56

SHA512
d5a808a0e11347c03a7fa497dbf69244b2920b15962d09b02f63ee4608f8f330ed0217518d91427f3302044231fbe146b22d5c9c023019195cd32136a2af4be5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce6620c6227e74846b35665358d337ed

SHA1
df034a578e18c1dc0c6cd579dda7be6313d6588a

SHA256
fee0d9e57fb255e04e69057fd0cde1eeea28ba5705e66a2080cc06bfadd7093f

SHA512
1f91ecce197d5f3fff26c3a11ac9fd37675fb7fdbc48822ba7daeee18c739f8ccab261ed94e26871ebdd17c68b40608b2a88804153f04d49f21609365b03b5ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f804727c8d36740473c937da418a053d

SHA1
d112be7415e06c0eb69161f7b2c97b218a530e92

SHA256
9d18ef716c41cece2b1f4bead1d325c7e44ac9d8bb23fa053e8a4e36482bef57

SHA512
b1314ee4dc834320ee9fad4fffdfe44d76792260bcefc7a0b219f5796f92ad996b06d2f63216d6d0bb82383d5777100c62d05f8d1cfd8759f211b9caa47d6191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c563d668f6f5662b374c8fb7c28cb5c

SHA1
837e31af6dd515517b6c28f3eb63dc9c63423b82

SHA256
9759c0005e0ebe5ff1a9c55f44b0761197afe6386cab3aa008e1b090514d9105

SHA512
63b76296ecb7b22281ef6fcc7f859390d54eb81eec8bfafc01f0934616b3fae71ce7df7f9d0d0a932364364ba39ff3bd2a5481e723063c512f1c3b41bed3eccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b2622e6a3c17bb57a528c496ca3cf41

SHA1
b1043ca6fd6a1cad76fd9c50304a3e39adbfdb8a

SHA256
987e30315638c460d63b41ee511ebf55884c550fe55a19e6c3d8288d4a6acb9a

SHA512
94e930881b571f8e2e04cb35ddd3a7ac2312da0e0a4f2dcc220c83311eacecc27b921f083e59e27e4d1e54844822c9a390834f0db0686e3b414b71991198f86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68a8f14ed8cf322fb3e16c607635f1ae

SHA1
af54e67cd465f86be9b50412cdde34852e8db205

SHA256
89efa4cf5d0ac54e0df08ffcac0d8a4d1b19ae3245832b82eb03f5302f2bb15d

SHA512
d6ab5e5f1103ee3d23623ecb9a5ca3bf37ede85e10a52d8ad4341d60a69ebdc5e5eb9973b2ac8db7a719e30c19b05154a5eb78bb9958843e289f2f904c9c04b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b7d322743f16a47fbfe330e51e34b0e

SHA1
664c6b9186c9a6058b958a41fb35407ca77789e3

SHA256
5a37c4b3e27955a8eac2a89a92273e1c794d1c6272d65f3b8457d1cec317d383

SHA512
d44a7e118c9dad6a5f05dc1d41b97817a53caf476752c3648f51a73c1f6310195ecb49d618daf183bf0277e969db9c64438c34a692d7b97b87457a857909b1db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2895145874f3fcfb2a8b55ae8fe853a1

SHA1
159239c80987d24232553fec6e8429d249e588fb

SHA256
056a260dafbeb6e7f524c03b4652ed1a44835e604fcb997e198433387d05750f

SHA512
c56b01eb2f5b40dd67c8f0976c7eb1f1fc93903f33e9e3a70dd711b99a5b0372ba176addba2f0f897e4887ff82500b9216a02ded1a2ea2d65cdd7b8caf3daa4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
455ffde4bf8e2e03770c99542849b0c4

SHA1
915af2db1d204c14fff02082195438e822a69cc3

SHA256
3d51c49499452cf5b3bf27f6573cd9f912e4c77a6171e205ad54618e93f5ff62

SHA512
9ea416277f1e7a27ddd073d19ddc4da779ccb9c449a3da28924a63e305c3d4a7fff51d47ff4d35a47dfb119c0175d18ed96623bb7d595f0c614b121d066bfd5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d106e711e6babdd740bd7fd40e588df

SHA1
1a1b0e64e71b52079f24f09979ff2ced0409d482

SHA256
f31f66f29e0af1e66eeceb005ae71ac2565a31f127bcf10a0bede544828ccc85

SHA512
38629193f6065f74ce6e9563dce7709ebda82e3f27c8a67dc44b3a6d98255b158cf24201caca4573303ed954468c28c8979b60441880a0b962bd3879b682399b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
828e121a316fa0387d47df9e14d43ff4

SHA1
62ac8bf146b519374d26a4c309fb9b5094c4c300

SHA256
85c1317cee7d7e07bf0534ee2010b83f9c27fcd714dc5b8034daaf335c46ece1

SHA512
e541a68a83174a65f16d9c6b849c62f574a2b8337a447aa6ddc1f7333446d5728236591673ea768e55a50d6266f8468c2f05c20afd3b4757eaa590271f5d38c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7013.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7055.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit