035e528948056959f03075bdfcf4d2dd46f5c18533ef4d6a79629d2a8e1529c4

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edda174f4d09ccbb4334d77005372d37.html
Size

1KB
MD5

edda174f4d09ccbb4334d77005372d37
SHA1

397d09b5878e0044029d26a26819ec197b52c5ea
SHA256

035e528948056959f03075bdfcf4d2dd46f5c18533ef4d6a79629d2a8e1529c4
SHA512

a09e40f1dd5eef4406c80a75c0433e85e3f8fc63211e3bb3edf61ec25c7f959a809a13834d95fab711f30d4ec75d05b09db9e38edd47dfff8cd0cef870faa154

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F45C0041-A114-11EE-A675-6E556AB52A45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000007869be7dba3c879530f2f17fd1982c2b393277bcd9a12ccb5a2c0eb3b1a8dccb000000000e800000000200002000000005e14e02d23e99c72ad49cb86677a78ea84df58e3465a7f1076a46a47b9a1d7790000000041062cac997b53f82ce8b7dcb541366c5e5111fdb5bcf86f07f299e68e42b5a67466e89a585eea3cbefb9427e3479073551af31ddf0c463c215dab54ad75bc85f7ff8dbcf7509ef5b24f511c9faa0a86e2e7dfad3877414b6b8c4be987ea773824557eb466aaa5fc1aab4e66c5c997d278ccfbd1155682127a013e0e380a8519df3a3c87debfe51d50230bb519602f340000000cf60532153de20c096ac2e86bfdeab8d8ea15872b8a06ee8f880bb61bc6ad3b5218b0c20069e4a49b691c207137c190ef9afd2d8de401060af34869ef39b983f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2023e4b92135da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e36d5d6a137c31842e315ed015d33083fa334ea5c1b9fbd3dc0778c3cd5950fe000000000e80000000020000200000000b0967f2b0153bde80f5a051ea70afba74ba019a2f5112355e806022c9404eec20000000aec20a26b776ac8f6c22b52d4c5fb09e235fc810612f86e743b74efeb45650bf40000000e1f1d20a83829f2cc468595f5771362f1d53962b6fe6d5b460f0d33aad4ba4626e6f7c7c4aca69dbee27d97207c1d9b567dd6b5dbfedc7a74727014cbd7f4f19	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409444080"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3048	2100	iexplore.exe	28
PID 2100 wrote to memory of 3048	2100	iexplore.exe	28
PID 2100 wrote to memory of 3048	2100	iexplore.exe	28
PID 2100 wrote to memory of 3048	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edda174f4d09ccbb4334d77005372d37.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89b10986a42bc7a42c6d686bfa03013a

SHA1
61bc6b78d95f1b1b2e7d33da0fdc97ee8f15b66e

SHA256
d74ed0af19931a4a97769704092f697f179f5be8437f03fbaa12c63035e774c8

SHA512
8aab8b4207cdfc7fd26a3713b2d1292524c413551eb1f1a4f5ba87e1013462ecd5829b0eedbc244d0fb01704ab43536bffa1d527df190864c681b6e96cda0cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed7df51f1b5f5c51d0c906e0ff84e730

SHA1
fe765ae52dba27a7e8ede5fee65bb84344068701

SHA256
0e3b116ec4373266a1b488962e69f185a899465a9fc356393c8a4747406d1720

SHA512
d482d80f2700831f1d5295f4b691f06b47456908cd59e8497af3d7e095ecc35f00be3db07de85f2add478be0e2d7f508df0690ec4b2241fd6c5ef9cfa1eb7265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03a7cb9c2d774edac42d8012ca67d039

SHA1
84b27f87613e199ace5266a5040159b08a4def94

SHA256
b19cede25cf1b543ae2220838c7027e2498f3161c658736df7af56a991ffa3ad

SHA512
a8de29e591758770d587368e1c08da900ceb024951175f6bbbd11ebce56917e14eb63d62d35554d5088fb80702597ab81557b905cacfa9e026737bdce72dcd1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f7cd305a09cad7c48d0e4168767a8e5

SHA1
2ff3cb143ac724d626a68500a632bde60fef9711

SHA256
315c15d0a1078af13297c8b90a9fbc814cfe9d2aa5c44de4b074c5031ae87553

SHA512
c18310cc70832afeb5510b5b9bb12fc46300f85cdc440e5f3bbfc5684438c472dd40b9af87820dfc289596dda425b3dc87f40306ee4f62882e9e16fa307d313d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
084c030675b9c844fcb1834f27490ed3

SHA1
5c9668825b417ae0f222bdf6362c71c344bdc6a3

SHA256
69433005ca61909ef84a80c19c3d7763213a647eb9762f1c13f48a615602d8c9

SHA512
8bc7dd8a14804cdb8a97e3fa1dbfdf790e4983701194fe2981f78b3e67cd93633564b799dffb2759e1ff54db6efbe85adbeb7332c16a4aa55bbcc2f42d76ed3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed88fcce2c23ef70f9a6e7626cc2d586

SHA1
b3c4ae9d633774b193e7970ff68baef30f5102ea

SHA256
0796e4b085ccdcbec27256c89533a9b124e7196dba05482ddf4c25128b8de83b

SHA512
1774adedc3a508a7bf4166e0f3bf49282ecdc61664d433b6dfcdedc7e1d3ed0cfbc70a7ec6dd8c596edcb2c299f2b0efbb9a6bb4aaee24237344a570a550ce38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b80cdffee5577044001fcdd46171852

SHA1
26a9d8093e5315a564a5410405e63dca230eec35

SHA256
c1512d7a8fb2c90e71e84bc75e69e15aef3815b2f5ef043ffee905ca770da3e5

SHA512
dc8a95c5c555d8e930b00672a9307908fdf8fd44f8cc6b7844bdd1866c622e631792edf7aeb03520cda373c9f47665ecd0c1d4659a996f280c7853dbc03ca2b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
672026091f369d2442a0efe6cdf09e60

SHA1
d2b9ee44d0a64c3d2fd13f5c205b346b7c915de9

SHA256
6746e784de7b87a3080f3c3a64577ad7918b5f5ceac243e84fcf133135539819

SHA512
4e67c4a273f390caa13a1f731f411662b7fe991ccf47644b133a387dddfaf0523256ccde8f45a25a5c3da7c2cde8b9a3c7c1339efc04a727ebb32eb4127e9d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e46da890c1ce33ea69ed0757e8f02faa

SHA1
b7c2dfe030da7f23d5d85bc71b6858325ad10cf5

SHA256
52dabd37890bf211bec5c62e693f0b0e151452114a31a594897f14347a194ce3

SHA512
50381fe9895e60477dc0edc927903fbf1f91f0a092b771e49c396c5f0c87b959a6801d027af7338cb2b4fa26748574b76044177293856975eaf9da64083ebe9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4535848f74a7d4096a1d066d68e537ac

SHA1
fc15b1024832270c41228abf1641cf7701e85d48

SHA256
7d740864dd8af1711f77d0b593f54bca0b3f71de33e91ee9803fefe044fdf60a

SHA512
72a92af7f467157ffc70d212ad863cf52bb88cc71fa21ded3327e6d14b71e75df2c2cdaf28fcbb44d0487e0ea3d5cd51d2b833fddf3cf63890210a52c3b10763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0466a0a01789c6cc418fd4a64353f1d2

SHA1
dda54fd253a7491c4c3867be13d66b20472fc367

SHA256
1becfa8c2f74e12092299be9cff939ee76ac74b590b8147224d0e089e30c779d

SHA512
0d1df2c533d40d332660705ed3393b56eda8a6d9a9fd52920e407658cab9bdb07cb4eb26291fe8f496d1a178a4262fb287c6fee6626d82f29e691c70f18e0c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb48825b392c2c9ff31ff674f3c1dc4d

SHA1
74b00c378c34437d4205d169dc0e3d2f44dfb9c4

SHA256
c1e30820086e722e03fa32afd6635ae6f12a63f073d2a5f3b2c8bdf9496c7438

SHA512
1b66421f9a781d4be53e2d0908f496512d184744e45a9cde7d4bc5111459c7168894fe0b02187b418166bc0a2a2cd54b6e6163e447979990e3ddcaf8a14310b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55ec8de8d519cf55b9d06103b8f55a0c

SHA1
4d44ea75d69eb1ec2ffaef6d4db34b01da95d8af

SHA256
e283dbfcf40aaa1f336682c971f47c40c4a82c05948c6e4b5eb32701a71eb059

SHA512
97c0a32bd3eba6472e95a91a386532cb1e45e3dcd7bb0d5c37ebaa8d24464d404bbc862d83ff47f53684b7ef55f77b711449e7dca9239982ef7c5894257f577c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77D0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C66.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit