dfa0c1601c853fdaf64f479972964dcb576b2702a055739d5f3dc286d8644d96

Analysis

max time kernel
147s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05fa77db3a19ded0245101487c086f6a.html
Size

958B
MD5

05fa77db3a19ded0245101487c086f6a
SHA1

6ddc139db3f5455e4266403ba87a96b07afb84c8
SHA256

dfa0c1601c853fdaf64f479972964dcb576b2702a055739d5f3dc286d8644d96
SHA512

72548655ee446b9966e17bb5713fef162b5f0dec15f37d80b0aa1ab4c873c3bdb7b30e18b6c9925613b982b4e5fdbfbfeb27c31ca3847348cb6ca272673e24ea

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f45f1654e1e1f0df243d8975ef36b14668ee4807887ae20b876c2dad9d480330000000000e800000000200002000000074f1c4c62a8fa95aac138f0e605e153f47ec9195cb29a4521efdbcf1c7f4839690000000d556ba0143b3e495b6baecfbeada32a93b626abfe21e89c70274fe754da72591d6866860b3d79dc5f4c9569fd301d8bb1f6dd7e03e16a210347bd0249ea945250588f3319b647bf774fe177c9ce08598b02b3fceac0b8909d1449198971ab57afb718180bec1d47dfeae8b7cbd0312bd7a0f00074a3eba0baacaf638b95796ce592ffc2306d743762f04ebe4fb5f81414000000021f000de57f81ce9335cc225962ca0ea1238fe93f00d650dd3582d5daa25510c35f6a51d1d58c925b4e8523200560571f10ca4ee1bf0aa8792a2285986f8613a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D02D781-A459-11EE-ACBB-46FAA8558A22} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07551326638da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409803302"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000069559cd679e991cd70fb2755033aa0dbe3e9479336a5c5985c8dea624914d30b000000000e80000000020000200000009000a964300576ae3d2a3d2b0e46e133d75739824bc080cc4ed379a34ce899d520000000ef3f48cc726b7ec4f3dd4f1c1c1f3dc270d65e3bf7552dd23907ec8f402609e940000000911d0497b2e2df678140b93609ce1cd47deeff0547384c1cfe88359af7350706c902d915268603618ec7564db1c114fd5d239017479352b7d27751c00c2101f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2312	2528	iexplore.exe	28
PID 2528 wrote to memory of 2312	2528	iexplore.exe	28
PID 2528 wrote to memory of 2312	2528	iexplore.exe	28
PID 2528 wrote to memory of 2312	2528	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05fa77db3a19ded0245101487c086f6a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67b638ed258967ba3d688c88997c46e7

SHA1
2d35c61da3c0de1d6de943784582528acf5af61b

SHA256
34b1ed6c7aac69748309ca4f4c69af5c575c822087b75ec099b259f242ee56e8

SHA512
6fc3b54e9dc2c38db91ed828ae9bc5b61ba28ab8a4f3d6c9f89ae52573f3f4b29c212f9d9cd0f8fd85dd1a3e71910e1eb1a292d954d85056cbc81b02f39d8362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e11488470d5aff0fb5c5abe1f0d5121

SHA1
273df93d961634ce9385ee1011a5c79ad9fa47dd

SHA256
1592d5ac7ffd985a276bc0c69c48fddd41a721583ff813dd34010e32fe12e3a8

SHA512
86bec4d5a08d3f511bc2644d81c261d9f3dce0ab274d8a1fd44527e60f042f2ad2380e0dbaa2259c0a177bedab423ff9e2d5f8a9940e7967ffea47cefd3a9b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da108f6e025998ec11a8a91ee2bafb8

SHA1
5028dcd6c733c19450b67bc5939f7b7e8b17b7ac

SHA256
00dc6e7a2db366730fbda855fa9b45d49b245df47bf6b3e9cbc630f5c6dcb98c

SHA512
d17372891dc3d3cd9763a483fb2b6971c0fd34bcc350249f3309741f59630cbba282fdb411557b6cdf54f91c39f4d7afdef86ffb5a6c59f712a0f38e2c048c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb0f14990b79d32bb764e8aaae2b3bfb

SHA1
fc036a61a14dba7beb9fcc0639e8ea289f821fb9

SHA256
c48b7382aab3391a301b072f900f30045e97c5d370c3533c85250eb75f39ddb8

SHA512
547577762c0136e6024767f4fbe7bca6ef2c188534a5bc99eb352ebd9fe3454cf926d766e5641c4a76943b156981ea8f358c46b4d22bcfdf4fa2e0eb18aa33f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
297aab303faf2d0f82739c06e671778c

SHA1
83fc1107b2cf3abac83a718bfd0bf3d9279fa53c

SHA256
0a1a6e23b7096a68c5be8e8f1c03547f5ae7ac0a7dd998c94785cdad3a2d20a6

SHA512
cb34f006e3ff3c80efa2b6c7fe1d1d4099e20869d2343ab0a76393d021ac7233354622092ae2a71a4134e0852fcd2ad31d56c9ee4ad65b6ee7335002324ee7b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
932541039f6916720a3e3f663dec4470

SHA1
0a4486d94019caf71bcc298e492440d35397e29b

SHA256
7a65a27370b16693fc6c58a2c8ec51cbb93d54a1e952a78f52e0955aeb5d5fe1

SHA512
523e6192bd7c94d2afab6efe3b8bdf39070620bbcecb0e511e813333b926ccb64b52796e52d6887983c01cab3beae7b4eb8d6538516719bf447e78511909f83d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
951d18d2ce13931a075dbc8d8a3e3090

SHA1
0c5bba2d85ef336d701808bec46b7829838fdc08

SHA256
fab5a6c95a6ada3ae3e51a2336ef9c14d6f4fee568c56fee73dbd89d8da3f213

SHA512
42be9f2e47fa8f5534c510e222da664b2e9b9bd960c6f02cdf1ab1f559cd3fec60e91d952ff71babc89b60fced37c092839ec5b2e1bb69c6b6e6ea82669b4e8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8ec0cd207a85944d030c88485114000

SHA1
d7257d79979c1fa20c0df1c9123c3d07fa7eff57

SHA256
36706502362bddc2109064f6ad8e8b43dbeb46a31f31699d7bb9abff8d8dcb8b

SHA512
980d1530f21693fdf5fb1e85bf0a5adbfef4a51a4e243ceeef2dad3523157832b149e42141dc8744db9fa8ab414d9a2f3c5d1d1d425a47e535979dbcc10dc338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ae5a57c0b04e57433563b05991400fb

SHA1
33d1027b3eef4e483ccf7deace2530c2dcc8b84b

SHA256
e99679e5ac1483faf8e6c34f9e48f7f8ceaca154ccfb4203be042588c9ae61c0

SHA512
c437aad46e1b84f1a1046f40e855393e5ded8056527de2a87dd520d7cfc123c0f54a9f24850dfcdc9d4d881f5401b1ffd783178cef461e8828e35005d1b33e8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c05b8111674b7cfa4079a6e681a525f2

SHA1
3f1639b1945bb28b3cced5eab7dde28760f535f3

SHA256
0af1413eddc5b10285c7298bfd6f93a8de8e6e3e3fccf88e1e65359f3ec967d8

SHA512
2fac2865c8cfc240943c6e73f775fe00792623f9d959f8fbfcd06dc2e1a979acc8c40b0ee5228fe592f14a723e509a06328ed177124ff83dfbeebcda88d0919f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c082e0f71646f5df61c82d934646064a

SHA1
08ade18a3a019f76a5195e0b87ef425b657695bc

SHA256
2071f0da2e1a7dfa7b9aeb1a35a0c60bb3f1a9b4c3a530f149a4a03eb0e169b5

SHA512
b8315450d91b2842230a7eaeaaaad002bd5e5d53d3289f5195bdfed9fc84ef9939fe2c78d232b98ec3bd9202b4fe9f3a8d2b4cf4fbb5b049d10eab337274a128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8928a76d3df4c9f9a6570f558886b2ba

SHA1
4b5d8b6f15a283fa22b584ebc0033b68b42494a4

SHA256
860de431885a03b28f38e329afa97fe6f8f1884b3d80edafddc520e250bb02f7

SHA512
59f73ee846cef25e1538b12d4ff78490de137fb8cb67b1ec5c798fce03e68e8c6fb34b79e1375da5f2e797029f632ad789dc12d18f76fe901fc5f8f87f5629eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
583a3a5bd1487ddcc2d34cfd4a328cc8

SHA1
a235ef4034c70636c273c4fa440f1d62e29362c0

SHA256
1eb7458a1836ad08fca60d32c1b8a0e870f08a733cd8b4dbfd4ebac8fedde73c

SHA512
ea50952279b9c0dc95f45f3ec2853693136c241db2efee605faab177f725dfef3e40d404bcf75c757b09aea7348bdfbcaab64ac18fb43a6a5ce584df1a058c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a328b01b602528dc6aba33bf5a1a8e39

SHA1
c93203688c0061a55938513c3dd2d184763593af

SHA256
50ec1959e37ed1a285754d8737dbc37c4fb7ff930d2e504719f34f66d0abe580

SHA512
72b5f846a0cbdeeb76c4a01db73f9471a12dc26434b10aa54e7565365dde562108a72952c12c64120e58cc674ec4a5c703126d75065a080650fad89296c8bd23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1a7dc0bff43514a4a196fab8903aa84

SHA1
09562cc3b312c0e534ce830daf45e2f38c050c4b

SHA256
40e8e1c7213a9fc8e9bd9620e2d1ed5d65ac6dfaee91dca32bc4c848cd0e82dc

SHA512
41876c39bfb020b742be03a73fdcac0e519b55a0ba5efd864532ee717bcdaf6e60cbc5d5f20b04384e9d62a4be016821ac1c6538b4a8cec4929374f858580fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a2643d589e169c60b698387c25957b

SHA1
5ec8944de81a69415e4ceca955c1bda451d3ce3b

SHA256
f1a94ffe802ebe0b0b2a7567527255558921e833a19783a90d19327ea0298511

SHA512
039c6c649194b5202c577a9a5efd79876270b633b77b2c68a9833a6dbea9cb08d1bb022c6e327961558ce5cc9771998a0fc484a32afba29f3fc56342fc32437e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a389159fdd51e38b19e70e1082d1d25f

SHA1
a656380b8885ce327a8da6d0b4395be1cafdd261

SHA256
9495409e0340118cfe9716d7e230da152d381eacdc464aa976b74b9abfd28f64

SHA512
ec87bcde3adec0c7729a39cd2bb7ae0a24a241a8cd8da1638ac349cf798f54b696679c11a760369a2bb568d2ea0b0f080ab0098901653367363e032342c32e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA92.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC5C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit