b11c137a319e5eb0391774afb078af4953b521ccc0bb09699c45482cdbba4f69

Analysis

max time kernel
148s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b7afe6899463f60465fa5ed8ad0c949.html
Size

895B
MD5

5b7afe6899463f60465fa5ed8ad0c949
SHA1

6ae3121f94e51d1975cd29d542cebee6f415641e
SHA256

b11c137a319e5eb0391774afb078af4953b521ccc0bb09699c45482cdbba4f69
SHA512

49ee3eaf84fbb36768fcb67770788b29f44db8d785e0a9bd59a9cdde17e1def01d50d844935f17b976e3dfdd055020f2a756b912a9e40ba5418438e17850018f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000fcd29ad8e7a12298b6df11e690fbcb4946768fe3a933b26921220bbcf5bae605000000000e8000000002000020000000fbe4f4d3388120781160b669b25d8fc41b9959f0e7b06336d8de13a6ca31678f20000000bfa3e2cb2b928bfaad68998fc1362959a9351528780f821800ee868d48f9fe004000000043533b2e020ada92eef05bf8d7c2bf132cbc60b9b1f4b0e650625837d600418f6dca0eea7cdeafbdb290c30c8cfe84e41adf15bee9635490f623a1290dc277d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000071df2569747d8462c71e3e83060546f1c727ed7c45cc10d9c2869bb408b23c38000000000e8000000002000020000000872a3b8c0989e274a99d8e4b049aa6215ce9b3811a889fb7edd2949b04acac3c900000004bc7ea39728c62f5fe2f0e92d457027eb073dc408b861d0d90b0f3b4cf7222e1ad053eea50cfa6777d4425be94b82301c90465f5dd43f5c3b1ddc54b98e5f8cbf454e767bc4b4f40e5e3f63b1e36bc2b830a47a9a23bc6007423d4fc6d8ac770fb4fee4c7ae124b4a597c9fb2334ffd6548472345feba3709cc3139976bee6ac90144f8d989aff23c6803563843aa1484000000070139145d288d51b070fd7088bb383fc403a6382018ee145b3f1b0840f415ffcd4beb8dab9e1bd0b91429d1d91c3b37440528255f015656006b0ffecf4b29d90	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d8a7744c40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410671865"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A730A421-AC3F-11EE-91A3-4AE60EE50717} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1780	iexplore.exe
1780	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2472	1780	iexplore.exe	16
PID 1780 wrote to memory of 2472	1780	iexplore.exe	16
PID 1780 wrote to memory of 2472	1780	iexplore.exe	16
PID 1780 wrote to memory of 2472	1780	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b7afe6899463f60465fa5ed8ad0c949.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5b4fe86de5d1acd4b053c9438e1ae96

SHA1
862488aea34f9a83f9179688f2d9444f35682f06

SHA256
a3f922f03094472e7e40a7d3aa0dd7386835efeec677e5302d33c1eb86f6f011

SHA512
0923596472c968fa3d655bb3110f920325b5cb8d617c9ff677f66b259cddb5fa6c4f82c2e0959fef915809f165909d976a0dd6d44d9a74e2ff4c4ad9a07beaac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be6d6f0d2b0e38351747dc0660ecc523

SHA1
a6a71817aa5cc811d255013149c82bd4f517dbab

SHA256
1fc818575809648851cacd142afe69cdf8f1493356148f22e90d8a1bd2812755

SHA512
917dd8e7dd03926dbc1c28c907905d8c762bda745c479f1854069d7645f36f6df2bc821bef7ba0426d73b981f19df9494b3049e068e2f087f85416c729c550d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4206aa8ea046e986ef791a7d6cef1c5

SHA1
0230f3bb34a3a270a185b236a5f3d3170c47f86b

SHA256
a403eac899ae74907d384d173dbf133f79aa38bc6fbec586833089730c179368

SHA512
7c331aa635790ab8dd683c891a7952f8dad3aa34942dd9c11f0783d8e19e8182647d59b07524d7503907b240c2a99cec1d18b13c00062ba0f16f82e9762e8556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e423fc6db7f8d96919f2743fcb660ec7

SHA1
241617ca007f01944a60ccf7b15c5ee26476dd91

SHA256
605dd682cc122f6f42ca0895a3aa47cf86460acc80521f8df1fee6290bac2b95

SHA512
c72a6cc8ff3aed38d15ed297655f0a3c2a07c8925b20e1294897bd299e221de9ebe7daade569a47f3371d4be86a15e33a9fa3f4898f8f35f2b0558160e3300e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0fb34a1647362f1665706aa26c9bad8

SHA1
78396d02400b925e9fa58dd3e0bdfd2029cd38e0

SHA256
1d5a3c8b5603145a73ae60ed111f258c45de0b5884bc10e82b2c2a86482669ed

SHA512
c401a46ed8abfff61dca24e1108fa9377e88e2903c8e7dcb0c80a4d935588c844fd510064fd227f44d97ef3cb4c6e5383be010edade2720307becd2d9380aedf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
472d9752d30fd6bfca79352f68220b5d

SHA1
c0bf1d96e1cc961ee2baf1b5e09a0a857bc22bb2

SHA256
95ee50c851799e2c4d7f258456b72a2bf46a93cbe78dcb08db0227c9c95fbce7

SHA512
3a134d36183dd0051a142b60949c91ec211b7929a1c6593fbef3f4023c9f23b903f22400d32c250ebc98a87088a3e2f0ee72ff3e06ded3d22517064930e8c904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e26ac3d48b9090d8a71659db91add35d

SHA1
fbeb24d2469c0deae42d87194765559c7d37e98f

SHA256
3f23b0e7083a8a1932982fce2325770bf2c6978c714b738865af82af51ce1caa

SHA512
7f8826b885b6def834ecbe38512c66b858ba0f29a9411730dab4ea7a661948a7321c9fe47807c46092ce6507707f2423400f0dcbd2326f06bd3c544540f069ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f9303a70bddd4b3eb8175657bff7eb6

SHA1
2b1dd56c0819f49e7511459b7336f259b3bc806e

SHA256
a74f4fcf6eb55ea82a5f596bb41e9fcdb13f40023e1e832d4c2c49196070baf0

SHA512
7b88bc58664899e34f8dc7187d5c14cf1b91c23c0efc6716ede6ea21171fc65d8681fca0d0cebb07295d19af799313c020adf81d3b0bc7662672f5740f259dcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5336cad137ce0107d4c647d81c6236e9

SHA1
d892bad302eb4dd568b133a0aea5013d2a1b59c2

SHA256
2efb9b9212e45482038ed163773e6e41b3a23111f1f32b25ab5d31dfbafebeb7

SHA512
1971664a56b5c62e3ae61af9451d27b53d5ecda92cb18e601be399160bf278fe66a0ba9805a8df91e328d088c047fc3022ba4379500462b63716658d90cf86c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14a14eb18e7d6053597b251c500c7829

SHA1
5fe23e7bb638abf2be4ed8894f96e744ebb2ed77

SHA256
6c4f4042b962c0d4db6dcd62d80a9f9e656a9524e580647048956568e68c27e6

SHA512
43fb429642e1828023f5f721f91d3f6c70e3a9e3a67902a057f669f0eb317a744dd6df25f97f7b8e219c2f63ac083dcc97b962aae8639ffd110e3df6bd7e1354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d69fda4a0b1e1e794a7345accc3ec11e

SHA1
6459c27636cda3c0fd0012f983aa75bb2620af73

SHA256
e7108316ef41a35bb98b9a53b034ce2fe00002528dcf33943d10d86d7b2e6dc9

SHA512
46625bb09b7fabf3ffc5947854b9ca8640b1e364f99cce9df27a30fe4529a05f21462697b55abfa51fe10b99e9ec096a659777057b96922aeeb373b7ed0a7f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2a77c4617d6d905e6215f48b35a281

SHA1
501e26de54f8066d91cb83f1bdad0b45c6aecbf7

SHA256
6fa90b41d1fcb405b9e653acecf289562a5100495017dc42adc7c216568bdfe9

SHA512
9139025587a1513c9806a04f9d5efcf80879455242db91937aa9bcf7063168323669c8a633dc9e5c2ad146eae4eec78c5430ced7e1c0c670f805bfccfd915260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85f44b4a97af55c8629f395f69f8adb9

SHA1
57ccd5edda8e22265cb9823f1aba86e4d57b297d

SHA256
9ea274d7af6b7cbb90c18931be146bc94570bc51ce7b04b70aa1b3d2a467466d

SHA512
c94edb0c5f9a35e2581cb891d006799b3d2a6280cbe56229559ce85bd610cfba82751a3d497d5ed9119e662af8f67c16bec084784d9bb3957e4f2c329995a94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
500046fd8bcdfa528912d6a3ce173a8a

SHA1
84e4aee28c5692b1e11f19be10e59fadf4aa6bad

SHA256
1d6061ada062d3e459ed532d8e0b20e90a7b476b837913edcdd8ff56ffa60ee0

SHA512
1670b11f6fae3bfba02aa4a55864d625ef186ceb8bb4390838035978c07843170414f510721f411313f8a8d721736a40954201246732d4fe634fe4611cd4043b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\02cy2i9\imagestore.dat

Filesize
1KB

MD5
5ea10a32f1bc322d5efcaf0100097552

SHA1
9227de004882576cdcb7684f3652b28259bb1847

SHA256
967adabc049fefc373919fcb207adf9202c69d4886e0a400f4b3073b5baf3318

SHA512
01126ad185229cb18b408f409601c4035a29bcf49f30c43dd0e3125593d1f479bf56d2291ceda0faa0ec55231fdfab21fedb1564494663736b742e7cfc4ef8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27AE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar280F.tmp

Filesize
93KB

MD5
ac61eaa48255890d137c13baaf731c5f

SHA1
f9ae28f6c21358660ec40239618f6ef9f6b333d7

SHA256
a1535f48249efcf97d37e825a27275a4e0d7e4ac51bceb4ff1262956c6e48c2a

SHA512
e36257b46ed34c2ee03231464ec70d889d35ea9f7f9255ea8bdb062838df8a4331fb6e8808bcf52323e4c26d6c6e9be8af4babdada794495237fd51f75b79449

Download Submit