94cced6dd637e81578d0c197e9fef2f544981e007f1c127289c921e3e196812c

Analysis

max time kernel
119s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44c5c211b93ed3dbe625daabeb8c3a58.html
Size

981B
MD5

44c5c211b93ed3dbe625daabeb8c3a58
SHA1

0fda8da9ee7270a91bcdaa101e688ef120d4ee3b
SHA256

94cced6dd637e81578d0c197e9fef2f544981e007f1c127289c921e3e196812c
SHA512

75d8a8534dc4fea1a478c5fa9c13665979a4969c9b70cb69bf41d488fada7b146638ec9242b7c0fe790673204b95d8dc251f6de33798c14255f76c4861647d22

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0559a853b3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410334713"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f32da8e0793d4757a2ba9aa96191f51f99b5e848843ca695efbc0d40ad9e31fe000000000e80000000020000200000005ade83afcb2ff1de23ca29f10305de9afec5c311ceeb597792cd7232425fa75d9000000056c97f5fca559d74c920f04ff99e7225bb4541155fad29b6f38de3e371a6c2e8089fcc2681165553fdb487f41ec0790d332dd004579a10b06326c0427988b92087be3fb588c8f75a31ab15f1c73b6a4c64411acd23448c5004feec3623764b1dcd3156071849de8ec0973ed996814ad2a958642622a254b73c45771bd1affef5ed83ca2ff438f1ed501ef96fda15e2b840000000242a0dcec5136c4e9302ae7b90d89986a31e00d9498770b9c8ff19ceed350cbc37d0750f097dc95349dc329285c39a12f758ad610dd260fedad380f249309442	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACC1A651-A92E-11EE-A62B-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f83a377df2ce525ee2fe3daab02196450815fa1b29cfc3605859506984283320000000000e800000000200002000000049fac52809a82935aa3f9309fc3a5a80708f7f72c3c196a682a0d8d3c8538790200000008bde32583ba71ec06889729e1f0c1813e93f80c311e394124ed3c46bd13dfb43400000005fa6debd16190113463aa02ced463962c115eacd26e8ea4e472dfea97c3302290f68a16b273eeb7422ce9dc32ac54241b6e50fccfbcb5b09e06e5544229770f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2712	2124	iexplore.exe	28
PID 2124 wrote to memory of 2712	2124	iexplore.exe	28
PID 2124 wrote to memory of 2712	2124	iexplore.exe	28
PID 2124 wrote to memory of 2712	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44c5c211b93ed3dbe625daabeb8c3a58.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd018dd9ed3a097652f2fb65ba20c9cc

SHA1
3a02a26a24971bf4af3ea43c77154a2142b56818

SHA256
5464bbf35a000461782ec7287b4be4c7b69599cf6415b4889cf545715b4cf0ec

SHA512
0d02e9bdd60db93d48a4a8144813c112b50bb00313ca24dcefcc35a3db8e9a9adcf90abd1f3fed51f0240b4afefaa34c0763c7834773fc4354289158f17ef244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ebe7c14825b5f43636eafd648bacb95

SHA1
82f13e29e9f25b5b61067a615bbef7b811e83dd9

SHA256
4bb2afbbc25b12ce1cc40565b764a832b5e46b7b185af56dd60b738fd6638f07

SHA512
d73c9f114862dd940c9691351a3a1f7d6b47b418f81ca325f0bc78a74f7c0a574db198a0db19a1d7e1a3bdb157f3feb600ee866ca115ea415e5850d7f514c4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0ceac599154f97ee6ea580fb193265d

SHA1
0f26e0b9daef50fc43934421145e7dba9edf42ac

SHA256
3e757ae1071f37e32928e6185d782465d215b8e23b508e2ccdc51d6c9849267b

SHA512
78df2f6ffc4805c611ea0f9f238b4dc00c8145416aaad671aced580c43df362bf6839edadcb4cb072e17f235a990dab3b3b05824efccdf0a70748aa97ac53610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95e23296234806119ed76c7c9199d057

SHA1
d281b80c1131f9c957852d3a318cea60df830de8

SHA256
ee47abd77d173b7a757a6718bdb76de53bbb6864db8e41d16e6a0d38624674c5

SHA512
e65c422773567cfa439db936561850e52a8d2d4d7996885a58b79d8ddcf72cdd21b8233f1b676e8117af10cf057d46cf8f46af6aaa71bae7a0d34a0f1fb45157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ab9c484b7ba5b894622c0e2bc3710e

SHA1
e7de6c535c0c661e44ad83d45d65652e47704368

SHA256
a8635efaa78e258f1f9224d9ed2f0a28a7a7fb1b984c4b1bd81cabbc7c416f48

SHA512
3304a2b1766010c002b3a719987efbd8bc4fe0e9fc5cf4fe75120c84154e159d62b70ae71611b09f512d1378476abec0d1947524184a6ca3eb5f7eb62a00db7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
629f53f4394257400071f8e4b9300066

SHA1
8294fc4f44c763e9cee15582eb3b76e785bebea2

SHA256
f8c90bff72ff18221804c7732d44cab9bcaf06120d644c111e90df29d7d320f1

SHA512
197b0b20486eb94164a383c16b179dccdbfd77ebf63cd46eecc2e9f0816a6fdb87b374baf0a852a12eba42699f6c63be5997eef19a3b25a9bc4f7d10cffc8f8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd79d3fa3943e65de79280632992950a

SHA1
abf110827bbd3430b4db30d50e2e5faa5e1269e6

SHA256
c456fb57049bd9d5a9dfb91a5e7455856fab7cf2f710d2f217067d6f18075a34

SHA512
c4e3fbc7ac76579f57b80fb88e21578f245b562a1e829fd404e0755dbac01e41224d087955a7c66eb8147cf0348b05bde85d7080f28a31003854c33344020b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
592fc9a11e56b52f9029f6a7897da4c2

SHA1
eb69ad1214af7b08c23e82ba50b33be131cb39e3

SHA256
2d5edc3e3700b6760374ed8f2c9eaca75f9d57568a4898eedca67aac4d21475e

SHA512
59605d593a8837ed9b8b27ad0913e004c751c13c14bec87d7db1562b311a3f5a5ad34e613d1807bfb66c47a7fecae724f0a77904bbdf928abfd8b088f27daaa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5682cdbabd716d90512adda7c8c40604

SHA1
c564b412ae41d4132440bd5cdef180ef2914dc80

SHA256
0ab90b03e6efa7d2e7b9490200aeba9b4737e351ab308f2131b019efc924ec13

SHA512
52af618d0905991bd35c6399b43cf861f3e3e787f1e6bb32099454be72824a0dafe254c621f7818880183754c95690f58fb4bce48d28257be073b8cab476afc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ccb0ba630cb3eb43058e97bab7ad965

SHA1
25e9ae1a41738f1e0018f63f8883ee65bf62ae96

SHA256
99c126f68991315157a9f5b18e9e92a39a896f024df60a97589c79306c8d6040

SHA512
0785cd7c304aa6e633f3fdd95b4c502d818b9c5fb0a2a6c42e5ea49be23800b0478d4f623fd1848156221214b14ccc752d6bc5ea07b1c368f706daa4cd6c1d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9EDF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB081.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit