9042a3b979ba4842d64dbda8e1347cb7ae5a1619b9fde34e0d2d4955e2ca4829

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa2c5a6e55fca0b34d5ab8400123439a.html
Size

1KB
MD5

fa2c5a6e55fca0b34d5ab8400123439a
SHA1

7b60ba3dc1116198b3d140b9f7b7798b25f9e41f
SHA256

9042a3b979ba4842d64dbda8e1347cb7ae5a1619b9fde34e0d2d4955e2ca4829
SHA512

c1b68c00491f0ef7c058788992ea8fcd8c8932f83ae1b755559837d8f5da229cd371db081213cee384f26984a032ac183153bdebe0d28f7a38b1bc724cfff4bd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000423160da1f5d7bd95719456c27e3444c53944498476e6880f5c98a371c74cb44000000000e8000000002000020000000ab81a2eed01f84515fb758fa6c9b77f787fb9f22c82def697fa88ae23cc85700200000003b153b09d5b0c31367b8c0b3c37ff126d77ea786376e6f9360d0677e04b6a2a540000000c4f1cac2ceb2286baf1238271a3545f49d22010281272f511fda0ee2452dcc1809be335f94d087c116d972cd539a98fb9a967fe4e6ecca9c669001e4613b1641	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000054c902941d38e7782006a6e98293b3d05b9414d20bf92ac7bf4e6d7dbf2e50c1000000000e8000000002000020000000926612ad2c13cf0166d9ab9c8301d5baa8d18bca0c503c4cb9b4ad2d3c07fef990000000bf81fd0aa74eaf8e53e029fdf4c26a1c159b869731a23853894fb75e9e43fdf77f495911135e190b01c712a5853b63a370ba9b1c482c3d4e844005c2bcbce671f492559c6261924a63714e4fa27777759051082e3a430481b8a6592c4c3ad6dc3b62acd5f04f2c6fbdb73c167553b56d76dcd245c6cbe51a57b11aa9076070f45abb3ab3022f458094152207c81f03c24000000094cdf54cad6bb66e8dad88851ae3ee88969c7e60ebd97e3277cb7a9976b49e9ee6a196a8c7edb5a2904d3ab4016e23aec5ca62cb101c61e201f9c0b6fa09ffdd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409448041"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50316f052b35da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B1B0771-A11E-11EE-971F-6E556AB52A45} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1836	iexplore.exe
1836	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2272	1836	iexplore.exe	28
PID 1836 wrote to memory of 2272	1836	iexplore.exe	28
PID 1836 wrote to memory of 2272	1836	iexplore.exe	28
PID 1836 wrote to memory of 2272	1836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa2c5a6e55fca0b34d5ab8400123439a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d48073855ca1ffbf8a2dc2417fc3d05

SHA1
72f1a1c6575b187770e1c13ca9e1ea552922dfe2

SHA256
3334bf92a2334d8f233b5424e602696e5a6ec3ab862ef10d90d90d079051aedb

SHA512
9a447c63ca98665722cb4e10a5a1639161466f4c8092b1dbfa13e81efab53238754103f6cab1c7fbbc6d67c2bbeefcfe4d4872f623ced8d0b9f3acc32b462fa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71b799ac4e9d7630d77e0871a159ba11

SHA1
cd67e6b91e86c4cdeb01896d3c4ec7686a0c5a6f

SHA256
5fea7a6ce24b77fdb98de7a4ab3b4db7ac8c200cbe9845e25d669b088dceee14

SHA512
c23ef6147786fecff2d6d77783fe9a7ce1b2cb78d07a3417c93aaa530889967b259317944db2a67abfbc613ce0f33c9ea03a6160f4c42d8f3cd00778c82e53b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e53c13754be04076156e1659dfafc5c9

SHA1
89bc67df21ffd471376915215df22d1c84ca63b3

SHA256
96d09dc4825ee247979ca5e39dbdcdd7e28c36123cc947efd4ba9f69a4f3fa10

SHA512
94b3fe327d3fefee637be0eeee7d9c1534cd0767c3532c3dda8bbdb6f51a45618f3e0bd287ec8d5957bd0e5c93e8d4ee64b254f413d3249efd4c71a0337368f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc014190c3b48325d85acac1cfab38c

SHA1
da94812ea45e7452b7b8a015b3442b6c2071ebd3

SHA256
afdaf393aae9fefe28fa772a54345ce1a261d459acdd539c91c520e2c6e08ee0

SHA512
25e7e89d3f289b6f693edf41af339c7195ab79f27eb9d018486922c0ac22d284327e41a9799f626df6588610703772fbf0a0f1c7275aedc1c8e0aa3da38e3c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94488ab0887ce84394fd13486aa9bb64

SHA1
2016c9b1473f2f7db9a1becb65325316ba7904ed

SHA256
bf6cc8ad814c8019ca5f69d141a9649738c84d5585ec8a91c5b67b9861bb7cfb

SHA512
8c919d3952dfc6824f106c726488dbc9b062894193ee325d3a2da96b455909d0f24e90f74916210bb1acb42614e7d30fcf95b7c7ddecfbfe7b0b6ef416e5c5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07815ef7d926e38258b91f1d5946fe12

SHA1
91542e13d3837e85909b3a21af769a2f7895620f

SHA256
c81d5b98a7a974ebcdf64201f58679b117ce7181bf5600c3c7bd321a05ac64f7

SHA512
dc57f23394e8a4297b05262341355163a480302227451725a8bc9c487e5dbedb6f47596cd48411d644ed8de4c8dbaa40387292a482dcd83cd529922f351e8651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b67191da1837497312a0575c41fac7a

SHA1
d8be410a15fa179e1376dedd0260f9ed3669092d

SHA256
a6d9d0902f6f59ce90196496849e96331afd02e63bc5705527cf3b1926a81759

SHA512
2443e6fa165142169a97ec92b9a420342865ac0ba30fa796a3e3466e0c1e9ef6e0bc15390f80ced6c567de23817ef97e65eb7ebdf918d06ce45e3d1b8809b788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f96b18a6261ba33c0f6aeeb4d0a5a1cf

SHA1
9c56b3ad322e57aca99f2b99fb8805df3d553c2f

SHA256
3e1a46d9c1ff965d68b4edb8616a9a90eb99320904985e34ae0cde2f7b0baee1

SHA512
33731770e7713f6d5f9a8d6b6a21bb14968529141eaff681acb1a484b7e56f54f6e86a523d733e4f0f446660b5417e8ff6e17faff4500912fce785d376adc827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ab6c1a847eb8415b989fe739392f412

SHA1
f10f5af663213fcd5e09cb6403696c202f79f997

SHA256
dc3182328ec984dc182e50e697725969c50e6ba18eebb2fa7991c86c79ac1d6f

SHA512
e876f62cdb426ed6925e2391213c061e4c8a7fbf085bb62baf4e5780e55cf62b3be8e427e619acc4dbc9f3af09e64407946c9301b7c5c56a640aaee8c6d242e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f8704daef01ac8f29829c15f7b8c481

SHA1
e442e7df76663cd3839147f8bf95a089436dcf0a

SHA256
b1f56f2de79ff8653c99e3aa5b581e7f1c59a8a5f15b44b1487c2c0b95c5edc5

SHA512
4bb470656ea1774b2309c541eedad6137453f08e17172217d27d4cada165296081bdd3e72841d0833ab62e47dcc759c1c6a9fe5cfcb3d4e4fb09ba7b4dfd1c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b472e2af4f14966651b56a250ad47c2a

SHA1
b9bcddd657599f9f377a933a8a0f0abf7a32b96b

SHA256
5deaa53ed249931fd45f6e8ce780115ec0fc4f3060ee5d39847d386144a505ce

SHA512
01dbc5b9cc117aedac9d12be0a71ce6293da65e626b2bad23092e7caf3383150a1ca8e901ccee7a02509137c4726f31fe1a3c3a8734345799cb645ec118964f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36c510d8d8dd8b7ebc03fdb2d2b6c251

SHA1
92cf29325b8dbf548b322d6b3f5b29cb8218b70d

SHA256
75c93c251e0dce20bd049d14906fbbd9b7026e9703e1081d4afea7747c99437e

SHA512
f0ee396f3010582b8361478e30d6c4dcc511b8e97b025c9740da5ee4c2320857a838ec9de4715aadd012f4327b00da48f508d717801f4cc7fcf620b5ed373b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43fdc56dc99302429ed3e1a863b73dc2

SHA1
9b2ad323aa84efec6a94cee65f0224ea965488e0

SHA256
135d1c856cf0766aebe90d4f384ca23841e6b7e7c94e6952518072a7a6ddcd9d

SHA512
39a5cafa4e560e33fb30b2e647ac3592b47fa0f3c5e3fd01983a7fde02372271f066b1635d3e9dec213c7ec0b53a0e1f1debe23542971fae9ea4972489563d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7994.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7AA2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit