42b5152025d592a4aaffdae183103b23a1457898f77adac903695c4432bcc5d5

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

272e43f9e6811c54d7ff6a82dc6d9517.html
Size

261B
MD5

272e43f9e6811c54d7ff6a82dc6d9517
SHA1

61524529dd8d777e498b5c469f982bdf48aca992
SHA256

42b5152025d592a4aaffdae183103b23a1457898f77adac903695c4432bcc5d5
SHA512

e5f0fea604bb12c6ee5f453bfaec29495c65f153d84dacfc18b3275d00245b660fde73095fb1525b173b26c3f5f3cbf369ea9412babd63e3d07a5e49c9fa5b16

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6FBD431-A5A0-11EE-8CD0-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409943971"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000801619d5275504be36f0adab619a869bce562c31924c4661c321e6559d692541000000000e8000000002000020000000289835f48fe132028cd83dcb3fc51105b807c35e248e5b02bc1f82395b258e66900000002879e3708b29b79a9b5f647ccbf84bd4f7a6517b1631bd9c28d02319d18a7b06c7e1526d23a0a63b08fdc9b760184a4ce971c46b9c746ccd6467e0e35330f0ca3daab2890045a466248c47f2c1b2d78ed86509ced3d1d06f44b5c0ed36afb35ad29b79da00f677b23105ab5ab9b7e72f049a37b19ded6c95421a17a551b8b5d35461902bb8b104410d0b1e15e3d974d540000000b8ec5f11362cc1931b22064514839715e7cbc4a5e4f735d65bc12b1cd420b8de0073175149434a8350c8e89426e9cd7c9827900f38516a12f9db262d524b270a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904279aaad39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000006a2f3fefa6bf5055c03a35a6d5af51390d08742ff47d521649e494247b59de5000000000e8000000002000020000000be099d7952f23c85eb954a53bfd80885fef0b591f6b2b56db2d951cbcaba02ad2000000038250829f532616f51e38f47881103726cc0e122f6ce4936d4163b111d3b52b640000000cfaac4acb5f8bf280179273d6cb0c9f17c34d6517aa5c395e58b8791fe25550e4af5e53196867d44ba30048ba21b94f6d45084e03868471ef6cc354c2ae5b41f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2648	1728	iexplore.exe	28
PID 1728 wrote to memory of 2648	1728	iexplore.exe	28
PID 1728 wrote to memory of 2648	1728	iexplore.exe	28
PID 1728 wrote to memory of 2648	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\272e43f9e6811c54d7ff6a82dc6d9517.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a13f15de8bf52c84c3137f5299566c0

SHA1
05453d13a9a2c4f8ef0c3acfc0be2a0c18f78095

SHA256
4fecf403b5ae61b1d804f416c7ff316a687d0dfe11c6adbd8861d5efe59847a9

SHA512
86593f1eb7bd2d8fc34c8ab1887bd72b699087df738d2dd543c57c21577f453222337deae713e458a5de8e7ddc3d3114713dc6f8a187fde1bb576214d632329e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f57ee4e78912449aea88213c647c0610

SHA1
410d5b76e8f4483578e92bd60fb4278c6031f27e

SHA256
ad06137a88a7f50fb38ca26206565b8fe30ce7b3281b3ddec2f548c31a96c0c4

SHA512
c8e04305c6073891c5b0dd94112435745d2c7e45834695d32aeea2402e95a0c37dd013df8125870b34e8b436a26067c765efd80cc3756e5b70a4d8cca7340e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f77eedb1e1ae64168cf394ee3e60f3a8

SHA1
e9aa5335d5649b5a392492758ad5943943ad54f3

SHA256
0266e350b7aaacd9b420fd61c1342deb51d90942879f069262d5dccde11b49bc

SHA512
a5af8a9fbb1156fb014345e8acd6515aeea67f149c3dba6d509ee93ecab14f2375a9b644c32e7929d6d3367a0d081f6511ed409589f1f17c3b6dbeb7edbbc273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c25cad5e232babfd16c8169d6bb0fc55

SHA1
f240737ce070e18b32f92bb62fe0e9b4bb4956b9

SHA256
b4a6f78c73db60a221a588531d45a9d693c7aea3f1ad465b8a58d68196a39287

SHA512
97fecf8d88e5e15940b758ccb920c2814657aa2d32f8d22e3e16fc6ca612e873e3a49662f865d18fca873e4d3d997db4bbada22774fa4656b7fee2c12aab9139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89d4b03aea62ab81e65525436e9fac03

SHA1
96f2a4df3626c03e9bd07999a34768bc4431c984

SHA256
8962ce699a7bb53e2697e63ea9fda0648d35da1d4a773bff10b7651dc8ea29c7

SHA512
a5362bccf5e24d304a88f83cff90262eb85fd0852e96dcda0dd4ddaf81bf02e65dffbd15976c0f84442e71d1880c9a9e09fc212da604e45fddd291b2f35f5218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
331a28afec623179ae62e0aced8b0514

SHA1
0e20b4295ba76d16c8e61ebe3ff3167ca9b982cc

SHA256
5f16154d02fa70224671295590089eb4006f19c3b2a00438ace808b49b8fdaa6

SHA512
5ce84cd969d1b2208b4522bf7bddddd63402aaaec512b6b86678120b4adcb0ab554bb16bfb846ecddca84b15c171d2c04384614c16b30d38cc75c5f197a94af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea2751b58e5ee62bca719ed35c4d67ac

SHA1
42dcabc5ad1dd3261fab6a236ebbbfd02ceb8e30

SHA256
51ac2e2b4b2c46489ef6cc4c6bd284897622463a69c372adfb8e6b501bc6480a

SHA512
59464acc228095edd02605eb8aa78c78ec126cd0bbaf26158d2079cf574d64316a2dc717341a5e89a9c49c3bcf2a5d6f1cef03a3868ec526e093047d06fc22d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd44c62c6edb538b2ff5c9221c1056d1

SHA1
c0c4556d0aa29c33ed29437ff69126332520985f

SHA256
d9e72e66801ca70a42c4be9ddb507c6d030c32328d9b4c9036c2d2edfd3be3c1

SHA512
940889f2e042ea51e1f7cde7861de1053f402b9fc5ed9cd1803a1986d5e479ed6c9ebadaa2057317a43391f43126fdea247fdae4944f751bf2e8110ffc68dfbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d9e26fbdfd6f2893c3f95d172e76890

SHA1
8e0db83ee73283db3da2ea9fd87aba962430da48

SHA256
31aaf42a30225dab7706773aa7eca3f9a614bb6760c72ef91d6871238a27fb1d

SHA512
3cdb7b93e3919d6bf85c0669af088e3c82b45a07c96c0b452339f4497a8909cfa07d9f8e00722ba0eac3bec76faf4644f00dc8e493cd65882b89b834bc6a6185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3790468b937c74dc0f0d29382bb10603

SHA1
b14c47ab99efbeec02fd978be1cfcee52a7dedf3

SHA256
b7871aa16dba0499ce82dd6b0381f4ebcd5a4de47fd93d60b130793fda8fd6d1

SHA512
870f523dbaa48ee514b7854f44b5ff82dde4a774424f61d66cfb6f4b6df1359c92c235927d7033fdf2198aa52227d29dbd16bf31dfae79b2573288bfcdc0465b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e18e07b8993d67b4763761918312201

SHA1
acccef8b97cd88316fd39bbc4216c7604ab0e015

SHA256
2034e3652a3ada128ceb9a24d632b842108812078aa7b3d0d373ec366ad7f342

SHA512
8dd110e299230308e455e7d85d29fe2d3dae3ab353b8efc88035c9fcd0f7a965a5318b507d0934c7637302dff66d9a682d85069a70f92f4459653d050981fc75

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA66E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB53.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit