d63bfe66b5f5c6614e7a8a1378af7437dfd911df9bb1e9905e8ca6b9e907c8fa

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01a57364d3515c183629c47ade592641.html
Size

2KB
MD5

01a57364d3515c183629c47ade592641
SHA1

9063669a6bab5af7b8454ed301424cdefc66fa12
SHA256

d63bfe66b5f5c6614e7a8a1378af7437dfd911df9bb1e9905e8ca6b9e907c8fa
SHA512

551535de2d93a892871717d0172bfd7aeccf405b5bcff08ca5ed1961bd0756d87f8bbece8a50399423f74f2fb4cacdd5b50fa67ab0367dbf3760f4b088f62d16

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e6aff4900da7d87c429f935111d2d2527b17ed90c8ee8522bef7579dec9a8fdc000000000e8000000002000020000000f397b861e7777c20e35d0bd386a550639c846e17adcca90061b8cabca98386d790000000a11bc04af1b49d0fe6e178b44f1f2bb66674a5de328b3f8b9bc08d7b04be25bdf7dc3da1ea2771efcba93eb493baeffd0fcc59f7e20aa030d6bd9632984b329589024fee55a43ee9dbb729951f231efd8855751c0a71122b4eb65d085f2b47040c7179d8dd32561c098cacf57536c7a357c8dae8d81a4b0487e46adb7c493c6863b23752cb0ab59980d6f24e64eb0a3140000000b091281301e461aa709ab96e9fd0a7e7ba61c58691da873e3397115e64169992cb3060e103357ebf500d562a5e1dd470945c6a80477fad1c808e8971f1a15e79	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{338F20C1-A413-11EE-AD08-DED0D00124D2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000914969f600e00fae688c1cdaecbb8079103086c669cfae7b0c0c44d211e0cbc2000000000e80000000020000200000007a18ca6e14506f8b2cc81f47d23fc7bc1a571d516507ed339f265d2dcf662cc3200000009cacdc0b52071b910d8fdc6e53eda1212bcf0f8d9b45dc2cec390c2da76be4b8400000002d7103ce887811952cf819f47b4ea5c00c1d592cfb714d04f6339c9582a4b7f8a5ffea449ba9733d0274d37a1f0494d4026b8f81d706de2550fb79e1ae635248	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409773158"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07176082038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1528	2644	iexplore.exe	28
PID 2644 wrote to memory of 1528	2644	iexplore.exe	28
PID 2644 wrote to memory of 1528	2644	iexplore.exe	28
PID 2644 wrote to memory of 1528	2644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01a57364d3515c183629c47ade592641.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ea3df5e62d995062a0ce81342791772

SHA1
7304348dd93cf04f6fb8d81aa72ae1d52b62ec85

SHA256
817a9179c6723f7750032a8938a22d0495030c6d55cf93d8bb540aa88512e66b

SHA512
66775aa506774c4d5a1cfd3ab7bed7ad092de274fddb9e7d1f56522e93f887534f9037dcd22f3d29b346cf15c484b8dfd4bc45657cdd5dbc2ffa4d3a4ae74880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5d3b56175980ed9719d53a9ad2ff25

SHA1
ee173e504cb1faf28ac4c5f066494870571553f4

SHA256
4bc7270fe9204faeb0f4e279e78c70f586ef27891f82975e22fe78819a47c50c

SHA512
3392f49421e75151fd533ce8a4457f7dcdef26edbd3769fb875ded3cc1edee566da392456d91ef782ebd86a0a030c460189e932e972e899095920e268969cb3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea64b0c27386736adc892d58764424f

SHA1
b6ff2f2f059a013777a7345fb8366bc838062cb7

SHA256
86722891f42d0714f9a2f12dcb75d13fd64771d4c2baa0624f4f63fd7a2fc2e8

SHA512
df70fd6ae64c0a81bc65d0135658056afe3b55b29ffe1ecf368c260e3852b528f85354a19f72c546c50809552d1ed4abe4252ce8aaf2b1e9debc694f834a8a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f44be96e39d3476d6e90c6ec1fc6f279

SHA1
eddc0cf08a17938c4d8e01295662f934709e3cc4

SHA256
24054763b7cf453dd28f49d9d9542d078c78bcbd1c571d9d5e3e1172abb039fa

SHA512
4006cef6032b2d774eeb6926d987c80b9041a6b6c660663b2b97826d6df7ffe724b8b23fd6fd0553de799ba936b5d2297d0f83dce180a40275bf24978d668528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27dcea0b0a14a7ac3c5358ee7a45f6b3

SHA1
e36c26f1233dccb7d3864ca10a840f6603c5f5a4

SHA256
f94cc116a8168101e33c150b3493b1fbda59535de3c7271cc541854e6dfff8cf

SHA512
3cb94b23e44cf4e1003af17e9ac9ce2ae0a8da35563282bc82845b90bbd1a67e2b79a5fbc3f235accd93ec619a5e849ecfa6f897f6afae3b004ab7a2a6386cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cea5364400e93ee1409e0aa423ef322

SHA1
2736089b5178245bd17c2c2163cbe00809abb160

SHA256
553e37a90dab6e5828bb832c1411e43f2c3de2b943360dce4447cef0a2868156

SHA512
b13220b60bcc08a1bc283defd58de8b15d18039d4e196378ce604a2be58608964211773e74203555c45382b0082d47c554a558a4df80f5309eb924c34d782bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc1681dc020490a82995e6b561c8a18a

SHA1
03d841a017d7951829174f986bf05825874e6f35

SHA256
4ac2fdb68f8f30a3431438f2c2d143f3e0fda52eef52b3c3e4445bc2301a87c4

SHA512
714ec8539bba54807f11c656dc5eb0ef33961960e95abf3b7d30fd3f43e1413592e571ad5d26324c5a721cd2c313afebe01681d62ca6bb11ef4cfaa5af42a6bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fd0c2ba0e3963ce9e14422e8e89eec0

SHA1
ed5c2bebf68fd9593bb6d6395cc391b999fb2c3c

SHA256
0bf5d1ea6f201566f23d1a1962fcfe889e690e4a0875a6020be6c8c7ccb6a08f

SHA512
67d8f0d2de9761ef5dd6367890a5193ed720f1be52726bd24988bd0a421623a08f1852701549a28bdb4cff95041c99466ccdede149aa4aacf53ccf9ab97c7292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55abe940eace9dd945a83f642b8dae25

SHA1
a47604f42c51dd3bc9ff9313727ff8e11523373c

SHA256
ef428431a977eeee9cdbfa6379b55528847c06c41985a50c0bfb3caaa51aae2d

SHA512
dbb213e2582333f4ce2f6524f4c4b90fbef5cae90ff05d183e401bf3b65bf76add5c554f5b36bcc6744e0a5d5a89317f1783ca297abb2f511bbe965404078638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b2702d24e45e37674e160ed490c12a4

SHA1
77bf258b1f670e8e2aa968358c77956191a2dd4e

SHA256
7e19fed7e46bdbdd3f2a7906a9498251408814b03c4bcdb730f5f46ce9390b58

SHA512
e78ecf3c2ee9d9cd4f86d2e21ee86ca32685e9353858d984c75908e007666babb2a6d61037c14d83fdb0a339cb84ee6db4f7e17f8d347ba03431a1467347e499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11f736442f8020388641a0310cb68a25

SHA1
6b981bd8164da67bc7e4e233a3e729bca44e7f4d

SHA256
741a9d81133eedf6a7d56845161b387985053b60ca076936dfd2d17051187193

SHA512
e2a34bcd3df64c6fe379354558d134df73cfc3ce49d403152a408f8ede6834047982fdfa19770fd1425f9a0e164797cc4822316477f43bf3e463419f04740d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46d7686a40d15dde090a25d15cef1525

SHA1
64a133f5fca7a3b8923caa0bc41fc054cab3ef93

SHA256
6d1cfa5cd4e35f35a659eda740cba98235ab4992b4944192625423ea2f1a1fc3

SHA512
3035c364dcbc1f9cc944e2f5d61f81f2cb8832697f9c99243c19631d947006f59248462c1c8fe8b9cce165388dfbddf6688f4d520f0897d5f05120a876c65de5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab93F8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9524.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit