42b3c440452d2a349c99114fde6bdac7a64ce426e2b8c19620e88a09fe3d11f8

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13b2fd13153fb9d8de872ffc91d72747.html
Size

658B
MD5

13b2fd13153fb9d8de872ffc91d72747
SHA1

9b12b4eaa84f370b28d6bc5346cb3cf88ec1ab37
SHA256

42b3c440452d2a349c99114fde6bdac7a64ce426e2b8c19620e88a09fe3d11f8
SHA512

88d1b311696fb43a5b33df7a9bdcf9870ab673ba9d5153ff876782c3aa9e613e35f91d6ff2d6a3bcf5cc138ba2f0b966bfb444edd49358cbdc19a82b886d95d3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f4ebfd439e29269cfad891a66b611e0d785ae218bc4456723b86ba0c41b79dbe000000000e80000000020000200000004b98db27f92d473d2eea9745118eb4b23b6a94be63aa3a2b2b1e2763b41fae44200000007d2237d9e76d7ef142ab13ea421a394299392f6730900502e0e5e8a29544814140000000d5fb6f923104c3ebe78ad7b2cd04b4e9d4a66ffa63d3697caf86817ccfed249147503b2de68ce2c5e4c464c42a982e5b245a663163740112384d2ed92b539491	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409635990"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10223ba9e036da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000066c53a18aae741bacc661e8a1fc4aa5df214f972553f5261deee17de076c2cca000000000e80000000020000200000009be691b167bb4b4b7039e8a711de8876243cf38a0b4038500f532f4aeb155e1a90000000f1a2dd261646366d55317ce29c03cecf82c580d1b1a94473f33c136ab160cb2115f9c6700b011af87470294f68ddf1580bd19afe45a170ee3f8120e6963399d4ce991e9a147340cda76516375a8cd37f324598a44dcb71b134873a8741745ebdffdcb0db17b57674d8df1c943b354b4224694ed86eb8ef3e9eb68357ef1a79d1fc0abe153d48f1dff110bbcd876856b84000000066d5481d1e5846507f462fa51c35c76e1d7bc60af3ed339927cee07b46c20ab9fa016c1087727b140033d289985f4d84a53af6fc7dbf3a97726a4ec501bfcf2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D30918E1-A2D3-11EE-BF15-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1896	iexplore.exe
1896	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2368	1896	iexplore.exe	28
PID 1896 wrote to memory of 2368	1896	iexplore.exe	28
PID 1896 wrote to memory of 2368	1896	iexplore.exe	28
PID 1896 wrote to memory of 2368	1896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13b2fd13153fb9d8de872ffc91d72747.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ca4dc62e571f091d8098178a2efe801

SHA1
8b63b24057ac0374dddb2a05c25063e6f8675eaa

SHA256
d125b210125e70ab1c2473eebb9170edda60b9bbb75e39ae1366b89dce784f79

SHA512
2fa653c2194c8d477a727c169818af48299a10aa2ae0fcdb2863d528407525cab0408e9fc05e685e71f47c6e48edfa970de28d58b457faf6b34257cf3872ce2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92917fe2faf97fb809948d9279194828

SHA1
ef7b156c109e27becffd8703c5c4d63ef54d33b3

SHA256
f9b55216059697caf56b472ed6ab7e829770e5cf949d5d0e1efb17a11a8ed4d6

SHA512
9f717ff5c0c8b1f15636b9f888d1cc3b3c8b6ec7291c256cf324d40f96d0d7d13d7d6f8cb61afa82bbd4de086e3306fccd52240ef32c0f00ac25c549f49e9403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ffde9396736f4a476a83038b5fa3784

SHA1
75789516695729d93edcdbea90b40446aa8e494f

SHA256
6f12b2924e5d34b3d74445067b619053e9a30867e84eb2b48faab5d9191ed9cb

SHA512
6613604c3a78dfb01feb124ae7c58d241e2e0196e5235fa0397665796e5cd634caa19a8e78de50403c50b64ccda114723a47c79375a57d18e86c91cdf60c4dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03a970b7aaac3f0110b1b5844a5098e3

SHA1
942e824d5b83be38067590fd10e4cfdee9035f6e

SHA256
65f336c1b593182fbd657d5474f1785453b941b63b66b4945eb147f72436bb52

SHA512
de647c68312e7eaa0b8fddc5fdc95d0a9cef8a254789b00adf6059f601bae45d73b252efaeb7d23a6bef48647f1e44b67143a0904e2e2b1cb55ab7ff8ab60280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db5795bf9979c90e69fbffa228d50494

SHA1
7bded3656f39d9e82b7f5e2654963c9485567130

SHA256
37e77fda76a9cd8307ff3e6fb9ef65aba660b45c6d90352a9b62c6c51d38fda1

SHA512
d11defa714581d01fa05868be455b0b6b117683acca6828af73ec8e8226c1e66399ddd06d4e33443218264494356a76e22a6fceef8ed19b20b8b2d273ba54c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e297e5c772abe869c3039947cc9fa82e

SHA1
a1cb9048f38e841b9c147bc82364166057c1ca82

SHA256
07cac7fecaa6fe7196c4e14f4172789df62ce81ef02de4a81547805d61197595

SHA512
c999767d70aebb7af87ff3c02a1422ecec1b8934aea2c8029bc92b691fa1d1001e8c55acf16cf136e52b77eb127edf7ce9edfc3c38e722db22809e0a9b0697a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
326e12dd010362109c6381d368a18522

SHA1
e4da50930bd257398c734c24cce919f63e37b924

SHA256
d395943a1837eedf4a5605952fea278f49b1f030b4fb33038a25fb7ff356fb62

SHA512
b04da4b483bc60ab0c5f2fafcd6898a3c0d95269c4d1a953b46b4b2cc3f32bbb296a0a0677e988d387325821b59456a850cb61bff22b8574cf2c2dc2df39d5e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f05374b7b9f16ecea993cc387eac31f7

SHA1
e291f4db16b81b2c94279d99b86359ed20ca7d01

SHA256
2b07818311674713b27a076093be1290f44666929d713d00ff7bc81477576d1a

SHA512
ff0856559e412fcbb6342e46b255f6598024d0dae7895a32a5553dfead0cc5cb08ecc3e01e8e98f5455b73585f522d8a6d753e54f0414244e72a1cef292bfd3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C62.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8627.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit