f867ffd0269315603343e89b70c2670fd19037bec693a21b9a67f543e3766083

Analysis

max time kernel
135s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72e2eb552d5b48985cc4cd8b647fa9eb.html
Size

1KB
MD5

72e2eb552d5b48985cc4cd8b647fa9eb
SHA1

b27d2d267485464aa413fe7a18ffd8d5fab14d0b
SHA256

f867ffd0269315603343e89b70c2670fd19037bec693a21b9a67f543e3766083
SHA512

91d83652f227f8c5e6fb809d9065735362fa5e833ade4a0013c730e0b266ce1f2378170ef88d91466b3de8ac348eda581d89089fc1b0d4cd635d1652ad5c154c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009cbab30f8e772977e1b154bc57e85284950815e5f502c248cca2f3755fc1ffa8000000000e800000000200002000000088606427ecb1cd2b1e84beb40dab91198f1d3b3610e4a560ed593021f4d37ab620000000bc8044e5f622197426f5530005fa39b0f4a8371b801b8b861a8bf816d9c8cd01400000002747f62613ab938574c471abcdc21fb507e48fd14ffdccef5c52bbc9c5689af37f8fb732d1b57c48a5c4f480d352756182cd75c2bd696ee61dc2f285bbca1e2d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06C0C6C1-A517-11EE-9D00-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305480db2339da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409884768"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009b26bd5ac1016f206713df52c1f30bb0fa5e7caf5dd75f1ec32c3f11592bb5f0000000000e80000000020000200000006850fd3cb4b1e9bebd331d84257c8dbf312fff46e87ed78e04fa8cb82cf1f16590000000de9544f0d8993eb4fe78b4d45a14e50846b2974ff0e44e3e0eecdbb23a1cb087bc5f3b2f90439db0ae8a1867a98325fa76171ede0c53b119f2196a7063d43df55289d4bffb39f1a203b50a8ed67a9f66d3b1a824650eec8a1482b1617d31ede7ad8473e8a6cad9ad06fb5da588f06b0d7ba85857487b7eeda67621308ddf971d2987f9b576ec0c99a8783b820dd5634240000000ae2ec308944e2fb0b7ceba3493cdf17677273b7b6d6e389c665e67c33a74c75e3f85d65954542f56b4acc7c13d970b2ce80adb168f86d75fa35bd77153d9c3b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1892	2236	iexplore.exe	1
PID 2236 wrote to memory of 1892	2236	iexplore.exe	1
PID 2236 wrote to memory of 1892	2236	iexplore.exe	1
PID 2236 wrote to memory of 1892	2236	iexplore.exe	1

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1892

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72e2eb552d5b48985cc4cd8b647fa9eb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd96c6d08e416df3fbce564c184bb117

SHA1
8c7ab0dc3d04c0e603836a9f8fd77379a54fa9c7

SHA256
67a59d9dbae606ce047ee087cde4c79ae16b51b536f95009f846a518f387f64c

SHA512
1e4b0ec536f2596459d82764232479f176df94f5ee1cdccd785912afa4da91c3ad6a446856c527cd0ab313e80c66a2a61df9c607436bd511df51d7929abe4479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9554439e2b08ccf048159160e0b99793

SHA1
7914f13f21c9759af918117f1a780a89f0ebe1a1

SHA256
f407c9dd91090dd5e109f3630f95669e57495c46828441db4dbd200b5fe4a110

SHA512
9c85d450027aff1cbe6d7ea23254061c55af257904ec17ce2e51fc2653e5dfdbdb0ed165da236b6a6198ebae73edbb2f1256d86aa8740df91401205be20000aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2cc66896f7015b0f22305d48c7ed155

SHA1
c6760f6e22399cf476177685fbb3ef64ad3d9909

SHA256
f786ec68ac73515cc7a8bc491664017e3b54e083113d4b27510a351da60ab545

SHA512
4f02203a8feddf6fae82fa7aa1352ced99a538d91c740eda8c387c9b6dc27eba4bb486212b561d7278ac25033db15e97f2674135c548a441b1ca37e228248c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43b6dca3070a0c22c35092bda2b34a04

SHA1
9b50f7fea8786ed490bbf929155c0ab17490a392

SHA256
7a3901a149a529b980372bcc95cb0746220ff2691527f441d04f3d7c0c84f3f7

SHA512
9d866bda858a63806ef1b10c9e19a8e53137192ff5b9a77ae5caaabef4828d6f43e96027417a56bdd6a7d21690c74ee21e90d4b3d80b8e2b96e2af65b04c3508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e91ab9b0ae0307c41fb2acdce2218397

SHA1
8e3b11782b27e0f9faaf289ec7bf7b2af0127836

SHA256
76329086a26c8be7a8bb4d1ab07d5dd9b6c71d6f62556c26a91433201eaa6e7a

SHA512
0f716e0ce94531d97689a6344f31fcca2bb67420eae3254741815faa66ea2a00f2e9f45c5382e4f77c9570ccf3f978f44bacee2e104f4ab14234544218806df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a2ceb3b4a8512e73cb1e0773c9b527a

SHA1
8ddd38ad4e6ddc3ca8f8fa5985f8bfc41a1a43a4

SHA256
69b0c3f22ead87e49cf5a3948b946bd6a555c872e1ef3c57c273a256b609433f

SHA512
5a724704ac94889ad45d7a034cf09fd07336f9898e715642a818d3479789320013fcb83462b92a87ac41bf6cb8187979937d45c59108fb4f883ee065ded88a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86c8c8bca0600b464318969d7920aef2

SHA1
adf049a450912abdec61ee7f1641d9008ab4f4f6

SHA256
563904a558c634c5788ef1ec0b98cd766d6b993c529937bbb4305fa6abb22040

SHA512
ba9d520e9c540c6c0958f73b17c8af2cb0cf1e9953176070621a3280eea4e6ba8a8c4cde5871d04cb8210ac9dd57ca280d87e2438d1563a899e6cd6de8979608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32d16d7521c9840e8b6695356ab4d36e

SHA1
a272906bdaa4125f26fe458120a368bc1df4f8bc

SHA256
4d0687e112ffe18e9e58ff812773c9f0c2949bcd4b60eaf440b06caba7c8cc5d

SHA512
e2a2057644b2cf76d515fd03bc129923b8bc72f334534d7c7d4f898a49cc05d6e914ff4c7670ede3c536e741f6fa2f4eb9d186db9cbc39818343d7abc78b2b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e9914786bfcb24ec0dc0ba57e96a463

SHA1
bddf21d7bd7a50ab9ccba64c4f5fd9b72292d2ef

SHA256
f179f0c38bc2924d44c21dceaed688e3092f175223c0b9f78a152254626af231

SHA512
e891eda1f266d981e34cf6b4c906f67c794aa491f003b83a0b5fab9674f3430b09429b78b3a092acab03d7a055b02e3c1e2eca299785d8bf2cf4c2a23863bd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a6647860ce3dda0ee4a04848ed903c

SHA1
9d623c64de60bdf69fdc6f97c412181b2773a004

SHA256
4f0c4009d2f2b8769a3490a6552ad9505be96507d04ffa43fc9fd02892de83cb

SHA512
4310c3d1c949003824889baf184c9393ef1ee64df946862c2c141917a71278469e95c5b00de82ecf3ca43b22e0381306cf45928c6c03f7e75a1ba2a11baea306

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC49.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACD9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit