3db82c1bf5b725123442b71bfcb61b8c37bdb1f12446b89508732d488d948926

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05a6ae2d3e91e277d113c2f810c7bf19.html
Size

601B
MD5

05a6ae2d3e91e277d113c2f810c7bf19
SHA1

8cecf11a354d0fef3b7fa996c737c70c9bf8572b
SHA256

3db82c1bf5b725123442b71bfcb61b8c37bdb1f12446b89508732d488d948926
SHA512

889c1665331fa079d929961b95ce1250dc95b2b9d6826aa0aa49b75bc3472749079054612932b9ec89c144663173f39cc0d2bdfda1fd1639f77c0fbb0a3405bb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41588611-A6FC-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e3ee04093bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009df81f3092e49e20f4d61459ebc8c9cb24207ace9f980b283854f9203289f5c8000000000e80000000020000200000006f2b890ea5c39761b5d3c3f3dc8485a3760eb305b7da0489c01d5ff0875b41b99000000089408b6c9ac6c1c0f029b660b55635705cc88e4337f3fd44ccc1c8ef731cb4b9c366862bfb6eb384d114e7426ac2469c93ec3d950b191126cafdd6c43f4a28472dfa333fd39613c2250f5f7b2c18b496fe4375319c32cb871c8325814c8280296cd31a0d8fa7080663fe63591fbe25fc95c8d9096e75a2db77b427db4245c1f080f4dc3a50da3219bc1731f03a6d2e1040000000c6bce3046cd2f54fb1f0a6b9802b1f79e2b55480d071c7dd13e6a8b86a9d5eb0e5d8e3f771068d95291fb1edd109a5ac0cacb3ee10480b6197da99eb5070e0ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005aa380680f597131750b251019845c0c704d2208c277c99c3920869225be8480000000000e8000000002000020000000fca862f143e063544cb3d8bb6f6b82baf4ea20baa0774b0485f98bef8370baf220000000947f916ae09aee0fea1a0891aaa904de630c799df03a46e95e19b53a7217fde24000000072ee654465858911b62f56a809ae55be0c5b2710a054b45f082ee75cd5ae901d7b3298f0e476f415dbb35f681949aba6e9bde8860cc36a910af194426c45822f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410093158"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2344	1656	iexplore.exe	28
PID 1656 wrote to memory of 2344	1656	iexplore.exe	28
PID 1656 wrote to memory of 2344	1656	iexplore.exe	28
PID 1656 wrote to memory of 2344	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05a6ae2d3e91e277d113c2f810c7bf19.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
671ab2a4305a4ffa929176b4a634ca5c

SHA1
35d080172f4a06cf437f622ef642482c8c1134a4

SHA256
f00dc34ab4298d45dcd962ac9c557eae7d69df528fa720da66ef12bd49ad00a3

SHA512
9a27c498c34e98436133769256847a783c6a77d0a8cf790dc4ec2db84892ae4a270f11628184cb011b6e4977c6e133bd5b3540a597fd9befe5a5a15cbf6813b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94b5528cd8eebb840d808d13617ac423

SHA1
8c214e8ea5b348967a5193689999fe0eca33f083

SHA256
e1149ebfbae70b4d3cb35908472d410f227916176e8608c1e8cdcda553468ca9

SHA512
7f340c048dd71d88116c1c877f913c89f3a53beff51c796992d6f2777e6f16e1c7908ab60ee047bbbdd9197645951a3537b3647348e442103c53d01cd3a4d541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7109791eb8fa4dadc943a3ed1e312f01

SHA1
5795edf0ad66aa7a399528c16baea261762992df

SHA256
61bca3bf56c58c4a2976f8ad4e0b4288b7799fb7a8fcb0efb547bd7870cd6919

SHA512
e847063b05dd56c08cf492341d85ec9804b2bd0780227711fe9aa21a118ef672652fd24db512955d319d8f4c3874c08815d4a86a88a5e1e3b6ea2a2b81cb5d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bac32d4a3458e0b8fafc6a07b3248c36

SHA1
4c82cd759463ad806617f86b2abd5b600e87dbf2

SHA256
1c9d1aab7b9e8d0d7c8cfb8214c3da973c3971e5c9d8cc1832d03eb3c0de65c9

SHA512
ce0358853fc0bb52d2d26ae48f1f5484e8552246134fb0a4b09c69418eee1583ab8f4182454661183232d458e941cc1f8e59c6dceed33f39ddcc7d95791ec719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efcc7cee4b8ebcd29ae5f843ba68ef3e

SHA1
7d8ff18316696a4b536458d6cfb398705519e3ed

SHA256
f03b6667c70cc801527a602b8e84badb72c2b0e1d224174ebcac9f9ec13e96ef

SHA512
cad9e7d172048fb98576d20d6475faa23c87e968f1267d84e91fa829bc4f02d4ba035c7b810d1090903cdedfe93285410eec9b5844d77bb6b3222573ffd98cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1814b75a373b46e39f34e32fccbb44ad

SHA1
d0ccdfb14afe5c95a31971a651b4f32c545e94d0

SHA256
52a55fd1243456ae65eb9470ce5b75b307a89c2fedd14b10ce72e61e15a545ba

SHA512
6e0c6daa4a89ef5e82f7196c5136a97b4125904cf7a75ffe76e89d2b8179ec5b7a04828a4879a51acc7ee171ed9f2d66c6feb7e5ef68da72fc723654734decfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dbfe125e357d19d1d32c34cdb9cea14

SHA1
17f000d6fb8ade6c3c451386c4a8e76e23e370d4

SHA256
9960e2c4d6b01d3a654849ad3f7c64afc35f3d0d696c4db772f100813515e932

SHA512
0750d1d882b1735a39e9ad34792388650f799dad031ebae3a051f8e2b3060499846c62235129408b0ab41ab96a15365c5c485e08e994df62c5c0bced5bd5b8bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a31fe98e292a41184c975537e5f3090

SHA1
c8c9cd4fa81a63cfeb5839329950d8c00f40e74d

SHA256
9c037622a7b7529c1b03545703eca47b1f32d0640fa1fb13db9e5a030c59e7f8

SHA512
d18c00935907a5f7d310324c994eadbf27675b3b0c3d45c74625f9908ed8e26b76589a78d0a5712370afddcc9e55df8cbdc9890941b566548659e30e38acf42c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8628b70c1c38e2ec1901c274b8cb0b36

SHA1
ced26e3a39545b5f456b01bf30b70d69d7830084

SHA256
61fe270194208974ed5fe4c7221e467f82e09dee4f63e02d023210cd455488aa

SHA512
37ef8c0345ca9f8f7cfc42fd0e719e3742ea7993d2cef01c4df63c93639f6a5432f8098ea9b3e3a38339fed13ff49cb39881e2a15c5b71caec7f798f392912f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e11554d3d123db1a9acc271786183a01

SHA1
f87b90624a016abcfa3df64e292429b2f0e80756

SHA256
4e3fe3de9a5a1c4ff770e5738e8ebc04f9669f32932bb7467ca8e43e1dc4a6b3

SHA512
9f3c20c4362664d13992a206f12da82450a61cbffde39dd47805417c0184763a4baf43322917101b1ad18122d68c29a38ae4b1d143446f6f9f053cfd000cc579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65e0bcac7ab0436547f3b65dd2fa6991

SHA1
0ff1c2de30a6a23f9296e9a1739478e3cf1ca536

SHA256
140477f64d1fa1b21601fdd7eeeda9fde4f345c7ac43ae8e7f6baec89846a536

SHA512
6662d6f961f9f7c3ba040cfb14cb52621f08afe73a0fb08bf2ff9025584c13e24e03b4db5b547e28170ede3569488004f3836c854328ef610233905b1a9778f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8116c1cbd929df539846cc8608d8f0e3

SHA1
5f7b45eb1725afa35a5a3e83619b9fe4c9de8c26

SHA256
b8a2922d92a06e22d39cc3aed594c6a22fbdbad107bb512244e87d658bb8d806

SHA512
405033ee36dfb190727373530c43f1e1bcdca7a2fa1a1387c097e0ddc0f8c5d054d2ccdc3a798ee32308f7f58247ad5820ee34176845abe180fd029f092f6c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4385504d7f2a695aa71b0c975c6d0b3

SHA1
75378d78b1e71434581cfa2dca967c77f1d0b6b5

SHA256
6000ae850d2c0507f58c682e79676a6260a4f402430844db7c3d5d8120d539a8

SHA512
81064c6ee67420de4f3033dae5721aecfbd2b883f67e5202b5eb14eef914a081bbb1a3ea5fa9def45701db9381b6c43a4843af77298e77cb3ea262ad12140e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16DD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar179B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit