e760b449c746b6d9e0e33d590488c712713fdcc3c15eb34cf5e314b1c0f491bc

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ca920c85e1eec2ed04e389aa59ecccb.html
Size

628B
MD5

5ca920c85e1eec2ed04e389aa59ecccb
SHA1

e2f89fdb5cc2db95b5eb822d984a139cfb94c354
SHA256

e760b449c746b6d9e0e33d590488c712713fdcc3c15eb34cf5e314b1c0f491bc
SHA512

3db6ebeedbfda8a01c1b2d8ba30cab97728f9919da1357c6e9a910c8c5a0f1a59809b472640865471ca83abcd8e71732649c3cafa8a0f82d3f910ec35cec4eeb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000680a055868118a1730ec3ba6f630df607be1a5e6a358c979a896c51ad93f4df7000000000e80000000020000200000007b80371e7784aa2feb399f7a6899c5a661502991bb3dc52eec709e3f8b669af020000000a088f9e93abdf51ad405de474723a4eba95b96117de464e0db2a6be05370ecd140000000b7b894192544aa0908bd75bd5e481ee9299746580f66e0b8b5627f6f8bf4bf452bcb2d88e182eb8aab387aa42b1e4d764831fe6ff41ae95216053819f3fa6c13	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409840913"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000023eada900f7918fcb14d2ea1714fd619f7e3eb72cf4b9f9aff36c37fd83a3602000000000e800000000200002000000048387755db459162024bf88e5e74c5070034b4b95032a227150599dcae4646c09000000083210cf7709f1a57688444cea0d42536914fa249d60d9094942c74206629f90e651bb1dc16565b66d8c1a8211d2cb747b6079504d3a00c3aa0d1a2fc50d3ef1e1b1a6b0a83d45731edeb7de2ba85be00f2f4a670c4933e3d85a4d02c176c31072d51d265d5111bcfea7ad188d6705eac6a30414ae576ec208bd3abb61b31b5f86a7b655831fc0fb10d0c1fd3ea024da84000000013f13fb687dd9567c97727823a9dea5207af51c9ec3c44e9234ba7404066889ec720d9d0875e7c4ad97228923d2fccdc086b3c3d910d6392fa91ee37a53cf3f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1F92361-A4B0-11EE-B683-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d76dc7bd38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2272	3064	iexplore.exe	28
PID 3064 wrote to memory of 2272	3064	iexplore.exe	28
PID 3064 wrote to memory of 2272	3064	iexplore.exe	28
PID 3064 wrote to memory of 2272	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ca920c85e1eec2ed04e389aa59ecccb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa92a8549900b5afb8bc77da34cb294d

SHA1
33f302ac00140db38d0b271adacc3a593b3f6fe1

SHA256
943ffc0e0ab32a22845002659a03f2a6337c9d819647c8291491573aecfda00f

SHA512
758d302091665d76a5f1852aff220ef77413dbbcdaaaf0007266c923c0b418b1d8b21fa68478de9489697ff20b5aac1bfa50d34e2b89f153a14c242eb17208e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5425c383d1ee1658dcae5177132850c2

SHA1
f096119de56d4ce2c6935fa959d41e4188d1780c

SHA256
de63687654c99c971fcaabd138a82355448b2a636f1268ac4d9ed3f09377e66e

SHA512
81be876a0d30be505492a52577c57e44b41ea0427ee1d9636e44db3c5b419ceeb5b01d8888a52a05e6cc97be28a61ca1e0abb6c84f6f574c42f0fa953fd014d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10be03b9028526919b3c9497c47af369

SHA1
60170428ac8402151299afbe865f381f9f813fa6

SHA256
73119a7915156d279aa4f986b64429522ad4431ff136d8a443f32c274b1b8de9

SHA512
62b11d5cf5868fcc31349457dd5ec4324db716ca2640c06dfc818237a39d061e5fd36431d7c7a3c660fef4c20a42a5ad686c82db21d759019f73d9ce88255dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cc71a6eefe13801f1d26e2a1e65b007

SHA1
c47dfee0efee7a027669a1f205d1217692718754

SHA256
35a67b101811fec4664aeaa51dbcf79209e85c6ebf1600935269a33cb68a5562

SHA512
f0203f354548abd36b76cde4bd9d26d827567f8c4a8de7f4d3ba6578bf85df1decd63a4b162b534622c7f4fab099f3e0f5b9217ccac6b93f85e2a9d5a22c5d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da6cd4129a315c8693df5ea948987be

SHA1
3add49a4c8d169662ef70c18419a19bc1f73b016

SHA256
6dd63e929c5972a63fd300a4ce8594fcd4ab9c24496dccbd2fb5a6dd2e4e3fc6

SHA512
62c87e355f4890dc276b1a0eaf78d48ffb6086da2f2b91577b78de2db2e14d3dd1e49c8f586cde804e5be0f8f7f4c56e341d0237b305ca00744ab4eefaedb33d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
509254cbfedecdd5746a3bb5c7145989

SHA1
1e7d20759fc103bf42f6a410de04ca16ee23d684

SHA256
c6d219ae1ad75d2b5daed183d7352f27b9a5052cdc0b35be4cba2a03cedce5ad

SHA512
3f684818ccf14c4495b7d80601b2af77c24f14eb073670cb3d8d654f41da19615d6b6d8718313167589eaf75b517bf2f1e176840227f67d2118d34a1ec3550a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8afd84ce350a8bbe07ccdbb1518da7d

SHA1
826d02f21a84034824f49de9f7eccf4b67f551f6

SHA256
86e714d5434e1f3c1cca782b1f5908f6116b75065ee34adf1dab36482330421e

SHA512
e7178412a2e8c74c625da332a67888f5ddb81d35001c668edeb53787014ab6c1ed9b87e46469e1665e3b5f0fd34f9eedbed0aa0db4f7f9052b669d59827cc275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
249145e963069e47e390211f447354db

SHA1
6b297004ae33169be662ddee797599d63d13b5f9

SHA256
cf1ca12f10efb627161f686eb28f0b416cd71c91d06548a0d1c30437bd03accd

SHA512
377402dee83c1e774645dc9be7bb510dd8f367c7d56430ee53072926a88a31c8c521eec4069f1d123572f9d1c28be9e0aea538f3e718201ec56a7526103881b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58cb7489a754b04066b70a563f01287f

SHA1
ca39ee9172ddc81fcb0f65e958ef150191843a87

SHA256
58b7786b766cd64785ed3e25cf3377b16bc8f9c23f9535d624bb1306b5478f00

SHA512
e9b2a8a9823a976d3772449d61594a8b219dd6ba3170b08a9395ad9600d32f03773878f66dcd242f1f5e69e65ecc4bbc37e93fb49a4cfd0f4b3dc39dbddc360f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
271a2dc029e5e51fd9c25620f34a65b7

SHA1
cff9f63b272671d969135190a3a5e94e7c65de5b

SHA256
f8ceeec83fc9975347cb9116e0cf21124d415d1b154ee567c94086b4774e8ff6

SHA512
be50426c3253beec74eb994f6f2346f24001c1e548ab2012045b0d0d386cae4727a7e275a4754389db24054792a8c8a37fd38d091106ad2dc1b2fd458123d573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24744123a6bee32ae8af4f89cd555d11

SHA1
4bc8586559c6a2eab5226e03ff744bda7a622dfb

SHA256
439bbb60813f71601f78babd2b66f79760d393c7086a2c78e2990167e474e65a

SHA512
8f08384cbb80925cdd81219e28b37a5efef13074a86c7ecf44bf043f900ab7cdf2e1bb5d81e8fb22babbefea1da7f3db5dee4fff95713b0c068898e83efc03b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6b1b0120335d86969dde4303981ac7b

SHA1
cc536eb6569f82408f647dfc12831eea174a7d30

SHA256
422598be23b740e312a9afc07837baee88d406078a344f5e278fc0dff7a6b246

SHA512
23f3ad32b79d0028d5ed9b601e742e4a9f1f0c142d866614d7c17fadc599db7d1041407bebda44d09fb392f81ab7d3f578d6c42037e8ad546de548d8e53c1931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c07b125a9e02790c4f503027ce54973

SHA1
91ecd5049556c1ca24f787689a0ee1c6fdb1ab6a

SHA256
b9e242bfa80e272e0969a00c89b25886fbe8886265c8436cef79e2498966287e

SHA512
d5c90632dfad2a81e971539d1684f89842c3ba8be07306307873efd69c8ee5a38559d9835cedda0805c28ee1e4d649b96be2531870888426ba39e57b0755cd8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
114e1212a520fd6109ebd67407c91168

SHA1
52935026055e3f244b107246eaf591bdc97c553e

SHA256
00597e5ab5f571ce365b9f3fc66151ed717b40ab92b5a74a7c240af80a2241e7

SHA512
29ab968bd7a091bc9f07a7e0a7968b54e76475b800679c08a0c675bf59e7db9ada3a3ad322488780ba9364130ea117156e544f29128df1349523150cc1a012b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ce7f7ca45cbbb14bf08d81d5444da68

SHA1
6f3e650f9df548e45ec3b6f374877ef2c5a9a285

SHA256
26d1c728453539a1a97dc5f0e3471f5f2dfb1bdf56b2920112daa6827ddd40a2

SHA512
e2ad22ce1fb16ee5b67794f28b719f87b963c098ef666140a1f7ef6602d16c8e51d4359df18be17cabbca008bd82aa6c0b3a0052ee36173ee814d6e6f87bc824

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab511D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5190.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit