b2fb81c7f60c9081c07fc6ed59998d3de5c21def024f91c78eb22a8f71bbac12

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

760ef59d1452aa568524fb33aead4132.html
Size

2KB
MD5

760ef59d1452aa568524fb33aead4132
SHA1

b4ae68ec84d464044d079a20d39e1e483388cfac
SHA256

b2fb81c7f60c9081c07fc6ed59998d3de5c21def024f91c78eb22a8f71bbac12
SHA512

5fa7295a062a03fce2c4767e872223a4bbff0f1f3630b5b8bb22df8a9d72b3fb42a88604dce3d8f8d30b964ff3a5a5cf8d77484cae75c588b4a6f2d64206a2d2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001cbdaca53f76397befd5955aa12e133e3c135e228b207b3c8b7bbaa02fb61c81000000000e8000000002000020000000fe0386298d4f998133e3048bfee55174d4a042795af7d2ce9577b91112126e80200000008cf9f5c19cdbd89b75d558c4a5b22d773bb50eb465f174e93e3a4e3ce898fe1840000000628f0373aa7c75a9914710cb10d1281f458ce323fc41337222d23dc797d1b4da1e9c2e1e53149683546d23eac49403a7090c098c4fe20e5e2387328ff82d5529	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B8716C1-ACB7-11EE-AD84-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410723309"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608c7e45c440da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ed22a7f59102365dd1deab323194c621d16ffac478d5f1dcbfdb3746379b5fed000000000e800000000200002000000061d0a509df4d9a43da5a81f3c868ed77897d3dc846297dddb1de477b671db5f2900000003679797aae429a0a91156e99df31445ce00de95cd25dab63c6ab0b38a51dbbc371f4642ea8ce67ebe5f7f916e068ee5877a5b5af77ac1608e14a3a90ea22f209a2ec746cef0bf9e64a2dd048738ac0b1e5a1c9b040f70a9b49c7afb0a90ed40413e112df19046639a92b045a23a2c913c2424a32ae486ef3c106571fa2b58622c844c0a183884040e690a88a99468d8b40000000c53949b9dfd914394d55d543f15770f78f22f0d9d6e910b4ecfe3d5cfb8186a4d67fbd249c72322fe0badd5cf4b4ba733644cc781e3e189e9cee943426e8a071	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1364	iexplore.exe
1364	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2448	1364	iexplore.exe	16
PID 1364 wrote to memory of 2448	1364	iexplore.exe	16
PID 1364 wrote to memory of 2448	1364	iexplore.exe	16
PID 1364 wrote to memory of 2448	1364	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\760ef59d1452aa568524fb33aead4132.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a23e466649ef9ca7b7814d5710cb2a

SHA1
790cfdc6422bb7ed5056f98fb1843a4503e53230

SHA256
67d67e867e864b78cd7dad4d5a2dab3c4d1e5c952c3f75ea1a561bd35ad3bc15

SHA512
d2f61d43a213f7438ad6dedb7c10c630c73990779948a6f6045e41311376dc0e90f428103831f15e533d1e3145d5fe2d96503ef8e5eb5e8a4d0d93074c23db31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a7c24c32a2944aee97759b617d23711

SHA1
a5cbae74e0318422ba6dcf02bd0b9340bb2a83ac

SHA256
7a8ef725c74e1a42ac42da6885af86fec33927020667d3143c6d07533f1d84d0

SHA512
c4490da7c40104f1d06cb8844f816630673b488263c9eee91e69cb28afaf89ebceaf3cadc09c5a6b47182a46863dfaf2ed5a9ee6b82d475c08c40b18b39a6b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f336801b043953cb37f0cb3b660b1b73

SHA1
83463e1eea29fdeb1ec8273cadcba1441c80b473

SHA256
2e2056386be65af65ee358961ccc00f8e042a65b551127f5213eaaf5a156d58e

SHA512
54452144257233d58f6d933a00d6ea64284c1e8233f8567b45a252fafe77a9469980c9e34e8261c34dd1a103eb682e1c8dd246ed84aed99f90622a92c607c5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18d9efde1ac798e55efa4838cc4c7785

SHA1
1799c1cd01ece67082f61c5d9e16cca0a32f30ab

SHA256
6781da356eea30b803c45885e408dd9480d937e0190037644fea7e16f22c875e

SHA512
6ae2e7e3cc18e1868b52dd4d334472a33432a33828428c6051d6c03dfd1d1d2efcfa5bc8a822cb93a0d31e49a205861dab6b54655971a7605c920c50802fdf22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50808d9e0b08a03187e2e97b32b8f1de

SHA1
39cac0b39564f54dd1f6e11e9c1f5bb61d5bc66e

SHA256
cda931ec3334f1f88145756b708e831b4647dfad3b499bcf4dd3372283377c82

SHA512
6751ef042d1cf0504333f32cd4e86ebed8af2364a3917f541b02f8634d2c6393c33d6672b579958b2ac1d76941bde9b61285407bceeb3e0ee00cbffd94306973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af85b5bba228f5a24163b4c61fe232b9

SHA1
cd79e81375161bbbf4b1cbeeea762399366de98f

SHA256
a57b905b08780b4e2023841c4f4cb83d5d7bb17179edf5bd386e6429aa08c7ed

SHA512
d2a3103f7eaf98a98825b861023d2b68b0ae85680612e0cca9d753ca15f4cf92aebc8e66449babb1ad653a2b85fd6a8a7de572c3fccacc90c0f5b498d9731423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
024c85f205798b7ff5534506e687c9ad

SHA1
f91633bfec60644f21cdb0c632e93ea9e45471de

SHA256
ce2895628c0479cb8b21fca3d7514cb66e750c6d1e493bf8aa481bbd6ce3a6f6

SHA512
ac3c079cf5b91a5d8ef1b486ed7d645a4d30580855ab895308d278fbba575a78c2eb3eb70fc2c92fe2d4664f37d5eadc418b9e4ee824bb0dc5a4fc59919ff8d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d7955903ff2a7d4b669e44a48235867

SHA1
57b4ac5512c24b2d7b864e664e34be87d190997a

SHA256
fee3f022277f80ee673c2aeec08f69b4b8eacba9604989e0c00b2b6d98c899b3

SHA512
d776a170e1c7bb7823198a2849b1eeee96d259b45153355423663d53908682aa77cc8a0174fecf370466df1f6b1099ab726c380848e65bb19f6ea79249c161e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e369dde4060bb506e79f23f7921f7bd

SHA1
d286e93b37aa9e3f525b7a38358b741e642911b4

SHA256
b935bca29540ae05e29154c5b9e210f2fe1da31aa3bf9e903ebfea940d4ef7b2

SHA512
20e2308fd5dd6105684d052b38bc5c7bc6aae71ecd0786bba20ef3a4dcd088a91e0d1defad36393b83a7bc9fb173663b0db3969652a420ba7e2ee97cc9712cd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae2230d08b49e5b4434b33de18fc1a2f

SHA1
b30303f43e433614d40f3e94d58c639fb7474ef4

SHA256
d5774c77dc63293383f3e04095a168920726ae1d1d16741acb6891137f3eb6e6

SHA512
4db5166c6182aba0f26abf408a58d112ab1487ae0f6cb7108a3e710381592b0bbc95f9b1851179f0e987dcfa9e963ec62390df79bfcd6dec771817754dc7e6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39d6d1f8dbf2e02d5e9629ecbdb609d0

SHA1
1bb35d50e181145a7686cd401931ab0e27c6696b

SHA256
4254b93ae804d929abe11c0d58a98f9d64b8f1d5f548551d8f7a6aa7ec80e1f8

SHA512
9efb55038cbdb58d04d24973007532b1039c79726d8b1a5bc52d481d4f1da399916322c130a036cefdb69f3af1442cd4f4db0e6e87f0d74a81245549c19a1176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a1809ee2f3a148f86f7feae7f2a061a

SHA1
84059e4c63e192f399d4639623e0aee298660284

SHA256
622adf9b5dbe6f49872c682430fb402eec8d26428f7d081ba4e1939f4a62130d

SHA512
5edc380ae86314de279c4bceaa63334343119f53cdbaa8fcb8cbdb3c58ad32ed510ac6f25bc7335dac1b7250f9ccf5d1f08ecddd95c938205dd3835c8085e3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8622.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9959.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit