bcfa4f8f0e8ebc5abc347afcbbf7f12b3da94cbeac548fc8261f70e4f95b87e9

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

292754ac6203a8afbe6778426c0b7ff9.html
Size

1KB
MD5

292754ac6203a8afbe6778426c0b7ff9
SHA1

c27e0585bd9df67fc5e4ac5d220d1882373ce666
SHA256

bcfa4f8f0e8ebc5abc347afcbbf7f12b3da94cbeac548fc8261f70e4f95b87e9
SHA512

a1cba2f7a5e1fb55fb110efac816ebea47f3a259394c6e9510167c2781fcdb315bfcc341394b0452e4f63900443fb7b9a050f9451ff1b9aa998f71f8cf45c938

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c0d331903ad050e3a54e9bcd4c0c91a6a55146b5c095042a8e9ef778d8b668f6000000000e800000000200002000000095a557038a45de76ede3d0a557e1358e6e701278c10ca9efac691cf2d74f3cd320000000c8fe3b087a29cc7d4071d623776aa78142beffea0b15c146b7214928ee01877840000000d40df284a622189347642aa356d0e358790643c15d49059cef5fa74107daed5284b1cb6169bb0497270e9191cb3bbd41ded1b7a8ab25c46adcac07f4dbb8a8fc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000dad57574528fb8ee0b31d8eca7b15698ac10f7fec9a55adbf5f83166fa9b640d000000000e8000000002000020000000651d47819d411e29c8e7a3e4808db55686d58f326caece546bafc0c790c639319000000053c95056af6597e0945db43b5c022ef71cdd82b333f1841e1bfb2e80364f2517479bd4c29cb91efe0e6cd9a8ad429cb2111b97f54e24dca41d0a771ac52b4f6d16996f0ec7c99fe61c1b80b4aff7e4d475e76a5cb10198e4bf50c63dba365514100018715b3a9a84528ad21ef30836bd5a8d33a2170a3260b38622e4de45be73d408684682254aa1ccb87ee816771628400000009304ee1ab6d7ee48d0ee8b7a46e1c43d7a36b47cca9067b344049e36b95ab42e09bb76908eabe015426d74d6377852248d20ec187ae1afa8a4c0330d1362c197	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C10BAC51-A3D4-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c79d97e137da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409746336"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2420	2096	iexplore.exe	28
PID 2096 wrote to memory of 2420	2096	iexplore.exe	28
PID 2096 wrote to memory of 2420	2096	iexplore.exe	28
PID 2096 wrote to memory of 2420	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\292754ac6203a8afbe6778426c0b7ff9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c00f10d3de568b7e2d9596e21eefedb

SHA1
e28ed144ca3886fca51ba34ba39bf0a9aae58d41

SHA256
daf16d0cb7c4d06f7250bc7e8e8cd1ca5457f2bd18c1d2341ff09baa06366694

SHA512
7556433b0616358c3b1ad4e37658af08a67a22d5b063559a6802e2d7c0c94d71eb011103484e30346cf2b4a53916e61f8cf6cbb0806b8338d9793e9b3d052438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf21b9852bac1cd0684f7e0581f4fabd

SHA1
748433729301ed3424d7fb32c01799cbafc8b86d

SHA256
fd9b211f431cfc9c371c1fdc7d91a95078a6ee4d71735751b6e9abae97fd784d

SHA512
eb8580b6486a22c87673d482a8becd33c3c10839112d94610eb8442277f037aa03a46522a791f4f4500c3f311e9714f99d6e637b490e137a1336e48feba05a98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d764d6e5614eea0cfa0b55e03c3d02e3

SHA1
cb419741c1447c432cd3f415aaaf59934a201a66

SHA256
5e3189cf3a06ec953c6fc17ebd849ac8109cbd618a621698cac3d4e645cf9c6f

SHA512
c3aff18e6c1076ee167f4a7f446278c5cd6133b510d71460e59aca9481530f380acf0c7e3756f19ca388f63bf50d4167a9c8e8f78275dbdfc25a96041e0ea808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16b5871bc263a0b9d672f0ccf7ccd0da

SHA1
5c85e89332d8ad1ef33b2ad9c8b34614ff3213cc

SHA256
6799579e7e1e792c9080a71f5c513ff150faacf7ee92a4f256e817298e3fde6b

SHA512
620f3d46a791b3c3765d00ccf92361ac0665d676e3b7a3701480b29f31c0ed2072dfe573a54746befa854be700199828d1b2c64c2f122abc459ebc146ffc5894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cae9a337c6f2f584972bca09a2d611f

SHA1
1252d96544d3ba60e22d40204570823da332ea64

SHA256
f4d8ef2b6e7b4b2652fab2bff9d11258e9a5c422b5857b463093ac76d7db29bd

SHA512
298538004ce0db457705f388bc51761c9b8bdc576e2f04ab105e520f5a569a139feeb474f7ebd67f1ce87dfc2004d32e96261292bb0bb8db8899a190eb729687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa708821327efd7bc2834ee7f670f49

SHA1
cb3019f10db6d19e3438a921fed26324e512aa9c

SHA256
4552b2810bdbc136029469c1c2ee2d9e2ab49681fc5357680454a3b7adc54264

SHA512
cc12a8fc93ae762dd6935d49f939f13f2da0da264859c9f9c09689f9b6506d32c3f6e9a19c2a350af222ee218f659b8186359114003e98fb7e41643366bdb135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63b2e07d2e295d8e7c52aefb84efe6a2

SHA1
4f515061e0423968c78ad231cf463e6940d3f542

SHA256
f7bdda17750181d27c49c9fff551be5f2f3a332f298b31b63693123c3162ed36

SHA512
c9ec5784cdc14dee4e5bedf6a5e583fd24d5425fe79505c3a2b6cc5bbdcc70dc0b579d6bc3a44a3f54664f6aa11b60f12129adf87a8a3e8ebf25a8021fbb51b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3649aa7f7c629d5e647d85dd135bed0

SHA1
c849953861dcc9f8cdb34b2b000911f82de669d7

SHA256
2c1580b4aa25bcc9d2ce1cc8c766f9350c95762808ab385d2055ba1882f4f824

SHA512
4a2682cb85b4171fc0eef464785c8a7841883e5eea447edadb53d4a6de3c761643bc0907a4992c3d7d56acf0d842976a121f966165ddb84f5bdd1b12cad57650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af15ef076fd724c23d77089b7205bdc8

SHA1
35d53d49c22994ae7367fcf92b5fda29521f2f9c

SHA256
1c6906ecffc533c41f69d83c2e1a995b65120f04ab902ad8590acd6023f6b1ed

SHA512
839d866944042d1e52e43fb404d7944d93dd2d7a5e1728d1f6a8bc3e49f1328231dbcab0bf75967c37663121cfaeaac19da2058a95695d6693a989d93fb602d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16ff1ca6757fd38642b581eff3e0323e

SHA1
dc2d965d3bc08849dfbc781b0e38935e46eb11ae

SHA256
1c356fd6f46c541c6dcc0d8533c24e67c0859f5b1c53b81293544f5f3abfb134

SHA512
61a9e88fe35b068c0f6c0c9d5d98b51c7cd958c69b183eb671310a616559191ee74a185ec9bc80eef6c9ab80519aeb46606a6394088a98c7e3701a15d29ab552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ced0c684aef6da7661127087063c7e9a

SHA1
01a9f4618e06c0fe81cbd6f4ea9ff570ae7bec10

SHA256
226aaae2f03de58292b0caa762d7574a0a065300b4542bd76c879e8ab4ae53a0

SHA512
8b0689373c604bcf5fe520bba001b9fbe69894cbbce4f21050d4502cfb7a9d58b8e12349746447f7642621f6980314df5e2c5db73a5fcdbe9b3b8eebf1250d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cea17dbf9f88593493cf8acf22606d11

SHA1
f611e46cc755aa3936e92299b0faf0ce3629253f

SHA256
8997f21e7cd56147ee13af03372750b50ee6ddfe41a7001e8943a72af82e003f

SHA512
5ba7281f93eb6a89009916eb21c74e75339c2f8249251e931a5f343f4f944a9d56b19031d71d1c1eef53dc9fb507fb0de17b3f62c27bf0b609de8d5afd9af8f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c14fed13b8ecb06700602f643b52a805

SHA1
e689c51e146c516cb484f3769c5ac863a773430c

SHA256
7688e357dce692fa8d22057cd96ccdf8a5c89bc9930e840f4611224c609a0ab6

SHA512
5e619ff50d98a3d3728cee674ca30238f296a8829fa7a53a2db9e2223aeae9f989c51c979f8224cbe2342b753ec4211b5bdb8d2d2265d06c666469cfe6dc4efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b823f65e09a317212ab4be7027bd376d

SHA1
c35c7fffe4ccc4b3e9fa997a63339a1929f37d98

SHA256
66bf7216604ee728b379654a553c29996946847c28d3a5633cecf56fd990b611

SHA512
86900bf2a9ed4badb294cd71045a418dc223ed5606bf36c0a56d7a73ac7d83cd705238a2c850fd713799df3fda7af96281d9befc402d0ceb4d80769037f8ac0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6892728fc1a8c79939ff0dd024560e3e

SHA1
9dd9ce8a072020a7a82e3e53b010a259adab53f7

SHA256
6f76f46e7a522b6c5e16f6b13237dfe3af636c6d9da4be7ec17afe28762af1dd

SHA512
41bbab1b1698ef76e7bb703f4e2e65fae21545318b06a69634b757299a025f5387699394f35ad2ccdc584263c59b00501dcdc1470a348ef63084d8071b37c8c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77780db6c69a089859e31266174a1248

SHA1
284d2070e3fc5ea5440f563c9919436732023d6b

SHA256
bc95d1ef7a3b4f6c1a3cc140151fa7bb6fcb54a72cf6a0a01aa3eeb5a7e5618c

SHA512
d81ce217cbb462f14e97aa4d1989bbdf4fa20a27c57a5ad5041364258bf4de5275538c4462e7dd3d26e546952880983d93f7b36c8f32267f2916fdded7158119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7EA3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar802E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit