b06ee84667fa0ce5b482ab86de25e21436b0b29aee910a6c00fa5bc596d1bf37

Analysis

max time kernel
150s
max time network
166s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e063e0452267521538e8edfdf2cbb3e.html
Size

1007B
MD5

4e063e0452267521538e8edfdf2cbb3e
SHA1

04c501d93393436cd5f40343cf088738020a21c1
SHA256

b06ee84667fa0ce5b482ab86de25e21436b0b29aee910a6c00fa5bc596d1bf37
SHA512

e8dce57bdb626ea33248a8f35e9ee951280ab523562994f7b6d6fc6a1bee5728d054e8092c74c29517016883b9b4007584a2816e1f506aac23f5898c05c81cc3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410367634"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50233BF1-A97B-11EE-8CF2-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b6f025883dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001bc257670f7e4cd91bf826b37d455dbb166bfcab68df7170971d7099ee88bc03000000000e8000000002000020000000549b0b482c98011c9e015abdf6d0f816e26aa790f603be52a3fba2a4399d568b20000000f2cdb6c5efe7471d395567bfb10182f29470a369f8f8c6146224096997565e064000000033602f7a80fe339a66b04ebe7fcbdda9406a755e334e911b055a1bcecc1aba53ff7c0be9e111353ffb624e3508aa20ebb45913e88663332d2e9cfdc8e417fb91	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000043f78fffbadcef05ac04c32eb0056829d7beb113ad79e4b3bc406d82e10f408f000000000e8000000002000020000000c7d90915e1df6461098ed160abab426761057713f3a9f21e35878d57eaeb82f190000000d209d05c53eb47b1042d122648671dbae2e0dd27af8fc2813c825f6097a22d39e3c71986a46d61fa93bec9ecbae9b77ff361848dc875896e8113a775ddb248365708dca374eac3b76d6efcc0d56037b6e134dc6657434fb9a20418e100170986b810a99ccd76519b71ca14e09232a1163d9fd3dec244d28ea315928de710cff954a0b777d03592e5008ba3e853eed16440000000de1d5d6212b3c0f4edd9e7bd5088ad33b73385e185a569ad684f7b537dfaa4dcad7874a5240a1dc771e274cf9c702ef2595584880a706272e382dda5beccd912	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2820	2772	iexplore.exe	28
PID 2772 wrote to memory of 2820	2772	iexplore.exe	28
PID 2772 wrote to memory of 2820	2772	iexplore.exe	28
PID 2772 wrote to memory of 2820	2772	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e063e0452267521538e8edfdf2cbb3e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea948a128bafc9ad062b3e90fb81766d

SHA1
3ce8d3522e2390e941182fc1c4ca537b6b38b8b6

SHA256
d837138c282404e1b91bc362af3690faffab57d6eccdb4076606ee4e66931692

SHA512
6d3ca8ae8e41fdf6ecb04204a78ad167732c687ab3e55421266fe9654f5f1883fd61f9141fcfe38f78ff913d5624775e642acffc26a9dd9dcee1657a05871c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3430cbd1dfdeabd922fc3dc6b57c6c37

SHA1
432f4728c10e0bc3500d91584ba9b915bcccb82b

SHA256
9b35380beb2617fe6d3785b1278f361c4e173a7a05f3ae6ca081ddba09e458c1

SHA512
9911359b8b9053b4572a9b95765cd42a1b7df649888b7f2dd79ed5fdb838d9df5419e1a8a1ad341976212dc14f0e600dfa7d71867c7a6a73f962f06fdb95c02e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f50b8b38a69635a23ce3d9b2af32de0b

SHA1
b93343406add118d3387ccc6df9cceb16647dec5

SHA256
91ddf5baf65234dc38e1024c644106a7cbbf9190f813552f820590c582b3076b

SHA512
2486ec42fd513622fe5d759b1f064b1302f3cc1d851dacf7799f38a9b6a756c43d9599c15db876f603121d16530a23eabaefdf4be49375cc8cfa3e2f767d5196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8325a57f279a275dc2ee3e21f79b7d0b

SHA1
6aa4364c14e067d99dc9d51555397272cb5eb1ce

SHA256
85d47a2f1d9992687533a9234094e3fbb31eca2a2c7d4348bd8572228a6f677d

SHA512
70f987c752fe786e91f5a2a5e0017c8b98fc3b3f252e8962602327b44b6d270a6728505bf5fb3b1d8c65073d0d9c35541bd294883f515b788a6904277f49c29e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
271612db98ed4963d785209848606268

SHA1
a0cc5b2c591bae4a08f5066fa7f2631cb6d3657b

SHA256
d923971852c2a4e6705a8727bbaeb7c14a3576e84660ecc7d5dd6d54126212c7

SHA512
1e842cfb9bff9230f10f015628def9f1374764953610fcecc5ab707e6144f5ab887ccb49d37f2db91a5f1f24ad1f21c9eb10340ca2debb5eda3c3b54ef34d688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
862945a8fd0b6ae90b7fa4438862dbe9

SHA1
ca2737e16e00c0977dd6cf18491a8d51db07b7aa

SHA256
f910538882a8834cfc44c9db3f483f81987c2146f7c06d11e329a2d93db0d3f2

SHA512
aa798ef2af5ec660794bd71c9c146c796fbeebebfd0cc8daa6dc4d1e70df5c7bb91b6fcba635824cbe28eb08557dd06dcceb1f3945dc540aac9818b4fbc03eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d95fa7e55e7d33b063963b38ee9611

SHA1
c451a7db72b05e45307497b6a6fd94a5a8da360f

SHA256
38135c089dba9fc2b10a415484b333aae14b84f430fdd064d0f697fd963bf0fc

SHA512
65c32b28e78d4618c8e7192cf0ec257ee1daad633556cd845fcd0f381bb02d98536e419949c12bf01ac6e351592cafe41e38dfb842c87039b084ed7f1f2e371d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e330579b67ca97faf61e1314cdfeb98

SHA1
2c0cfcdc901ac3f2bb634941970095e316d146de

SHA256
46b69c90a16ef29a2b25befaef7991baca40a840a4715cf0f2e34603b14fd850

SHA512
c4ccfc52d4e0a541d55680f5231d468d1008aec6bff5d8bbad1fa5bda9ee06a47986ff2410c270dcc6fed5ff5d24515b37a91042f77380d859abe9660c2e1e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc06453b859927d48a0e7a1f24e73a1

SHA1
e1a317546f0f180ca1ac8969e1d1047f677ee5a0

SHA256
e7e429d5a1eb23b44a8614ac3dbf69c47c0ac6de137c59a619f016ce159f5358

SHA512
34a1ce7ae9b93efccc63081bf49c8e620e263e2fe43988ab028ac02f80589b9ae8138c452445a3e6d0c6d4ae6d68941b15732c255228447ea52425cc42a006e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65d76abe0cdce803ef10a676301a0928

SHA1
8886ae0c68de399d5bfd468301ced5a9269f2c38

SHA256
85472e202bdbdaab12a9a2642022f6093a2f852849896f9e8e9109f006b23715

SHA512
28438891af1c08cdaf4e7cc32a199280882100ef6242065a5a7b84a15f0b36ae75aa3b9606a4c3b84256d9d76d4940349e23eec2be888dfc54d277b32d5078ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f8c0179197050cfb3b54156577aa02a

SHA1
d3bddcc9d93f628bb21105e123f0f67b5e62184c

SHA256
64bd4d94eb455d68dae87ecb0f451dec5df69ba89cd7a56936392e92ebf984d7

SHA512
e58d5262863ce8607b38cf894b44b29fc2cf46e2c919a15b37dac4fa0198927db3f8d9ed95a9c2980199c1e1b91affba9a97282223b83ff24cde5fd5d1276c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c706435c27ac9f1d58d74c1f3fcc07f6

SHA1
b236d731bd617310c1e1a155ab406d27884daa6a

SHA256
8fbcfb07ef506ba9e9f7a6b5e555ab365cd0b95684b8c56d2b23ac04a64b2eef

SHA512
57e86d2961e219332b5ea5d0ff50b2c00433c5abaa70048a287ff3191ead70597f4b9f264fb23166e418db0b3b4a83fd822286dc0133cec59fb6d27c1e911f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC69C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD31D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit