fbd7d50ffe3b75d468db9ac885fecb56b1ae7accd933cbfb24ce2132003ec554

Analysis

max time kernel
119s
max time network
166s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07217e37161d888184ef09d4b1befa6d.html
Size

2KB
MD5

07217e37161d888184ef09d4b1befa6d
SHA1

6ef3320f35f816819b4f8ff02e8271b1d53b6c01
SHA256

fbd7d50ffe3b75d468db9ac885fecb56b1ae7accd933cbfb24ce2132003ec554
SHA512

f188dbbcd876aa8053344ad929c10acb118f3681cb546a49bedd78eeddd4e4b22b825b30c7bc3f3f8f0f14271beef56bd29a03722971925d7e8bba3dc6d8b987

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a40606e6f6e13a6512b131c84e10c84954d4bcb871457db38d1c731db6ba345b000000000e8000000002000020000000a299febb6f14976c29080c6e85c0e55c373f50df047a258f967b5e7b5fb1b47520000000cc5112b09328e19b19091daccf1acb11dbc1efca8c84e7b04e91bf21ad778f8640000000326fd6fd8557b8da36cf45be20f096885da6f99dedd1a55091479a3f53ee7c36f2661aa5d03ca9172c7fd02326fa26ff0592bce9501b541886ccec41ca3bed87	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410116161"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02c10a63e3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D167C151-A731-11EE-8073-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a2db6bf6ec12690878f959b6e7ba8963628bbd3c81ac4ffe68af034eb1668a7a000000000e8000000002000020000000ea9c94ee7ffb61ffac6112c4c8a372295a3a23d248d5436ec823fc509921ce1a900000007a312c8a304f4a5e81a4cedce2ff6bdbddd8a6190cab52925c0e1a5ea6c08c8950718fa52e2b4f09a06fd6a24a1d8be79ea46d7aeb118a2856570e23488d97338856ad01a9b163c3a27c2d958aed861b0267b48eac672f994908c509bde68f1514ad314a67a81eb9199cbbfcbfa175f880c8ab013b1c7f514b21873e85876e9bb8092b12ff8905c13bc3b165982fed1740000000436a2f59f7d0ea990afdc0e78e28315b356fe60fb84995448507cd3006b0f8bcba8c6f9d8f47cf703c86118b6b32eb4c34398eca35c300c1196fc3485905c36a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2724	1728	iexplore.exe	18
PID 1728 wrote to memory of 2724	1728	iexplore.exe	18
PID 1728 wrote to memory of 2724	1728	iexplore.exe	18
PID 1728 wrote to memory of 2724	1728	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07217e37161d888184ef09d4b1befa6d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f99c56f66a81e188f95679d84fe64e8c

SHA1
5faf9fc3c50d1459915987c1b4f6bfcbf9fcb20d

SHA256
86a8bddb1cb2b8a58e18abe19305c17328db7ac3e00e15a15d9327663503755f

SHA512
f6c1463ccc215f2ee73e6d90e3f63e3aba339f806078abe559b33ed295a2baebb52dcd0b44ece32a06c8b3cda154def1a902eb34858db26d09c6ca3e9e70f2bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f8224155fa802cf8f9cde10f897014b

SHA1
2855cb2babdec25a2e03ceddadec313f813aceb4

SHA256
027294ecf6930d605860bbbba17ccc8d7275e2b5cd724e3f4d8b2b7e13e7a174

SHA512
c4694c32024e5e932f325dbeee6e7d77d2bb07f509394ff46572928ee2496a7cb208a35040f3a30dca5dd3b0fc4cde717c3e6bff7a2426ba6c5e717477cff42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e93965d41772f194dc24b98621566e

SHA1
02b417ed5c6cc6b5c169d53cc604f501a9a1a7c8

SHA256
1204abe7175690651442a84dcf6ea13847a683fda74c713224d68f927451257d

SHA512
b7d368ced58f3994167991ef0907896b96e535abe4a1450327fef93aafd9ee51cce0e4e9bf645cad383be85d7f608627c918b91d0c8bd9f04cde9b476bf4436a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb16c4e83d60eff58d9f20588476f614

SHA1
6180e8991011819427e2c40d66c67252da4673b6

SHA256
a578b87f852feb6f7fd8e36ff93f45c8b5c76066315e8a81f466d53b4442e050

SHA512
b3cc5b383961876d7228df53f29b0b3c0df2dd9f52c59659db0fcf1c0ec13e5947a71ac8a9eaba979abbf67808d8f4cbe40fc540e6395c5547d97d6ef40852e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1efb358135fbe65c42d52254a59940cb

SHA1
be8fba53031882cd6f13fbaf01112be5e59bdbb9

SHA256
ea7c8e730ed1040700f3a47b7b01366b387489e9e609a16f7c05e700529ac9d5

SHA512
cdec67c5f08f7c5aa10a37e731ec7564311c1f88add13078c980b100c1b6fb170f236dd1a40013d7aaf218dc2759f81a7f4fc851d2f6c7e3f81c6f63f4cbe1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a50c35de20c979af1310f0f206806863

SHA1
ec3234ce3c115fe4c3a1f187f3c05f6a0b72e30f

SHA256
fd7a0b190b0ba6b0ce1cbdc56ed22a72ab5f60f7947a51595ab685d8e97671e2

SHA512
5ab9f7f4a0779a7d7da02221aabe0b0cf7bf671dd1c072da69b6e29955b516f8b3714e189aced4a1aeb9487642ad3d5dbd9bbf77c37349794cc6af8f60756c89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10ac6a60a89083484c813cc0f41e5a60

SHA1
bf36c2d9b4bcf951c9f80997c4ecdb585be8792e

SHA256
bc7015e95771492b4e452e098123ebcf2894354cd6e1ddab229e07aec8a2647b

SHA512
7ab007a13b529dddb2cdae00d136ef3bf325d878aa2172c7e3f04df30ddee22036fc8e729c0391546360fdf967e5d6f45289d7e36e496516d5ceef5e310e992c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a0823818a3f4003050a7ea13216cb3

SHA1
6c4307ee7dcd13ac90b643634007bfdb9bbddd99

SHA256
7dc0673bf33fb96cf8bb678b582af47ffe2ddd7adbfb6e94d3f7e55fc3140fe2

SHA512
1f7c0477680cc05ba2edb5d54cac396e3d38644b6e98306790d6b8391edc063ea136f953673256b7955442b84f370fc975afe98c405bca8d4f7dd28ab6340c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1c1b4b0c5415ab9d77594c6e8dfecb2

SHA1
b82b7e666cbe421e43bc2c9a66cfbc532a0def3a

SHA256
8b10310c44e2a61832a30efa0ace67285ac7acf22fa30b1d3bf5944a6c3faa6b

SHA512
24dfa6ec72d0042d8ee10710209a6e39b93631494c952891b62b8e1a6b89763127311d2beb529de6dbc7cabbbfda21e7ce1520a8cafbc5a772fcea9a7f161b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d468e79ee40be63b01f14f0765416c0e

SHA1
11df07b04169689934d2249ce8170bda538fed0c

SHA256
e35f8f31e45686a65e606e4ada20f7fa4691e10a0752cfc95c3d2af3c89880ff

SHA512
e7201d4f71fd2bf9d7c44da9e8308c97eea2570b1cb66c05fd529e4d3e5ea8ff528bf2e70220f54611249acb7b2b83c37f493f8a7d6b225c99752501cb7a7666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2748f594c736e3dcb3ee3636e37ff8

SHA1
b1f5d37baeed5e83e97a3b4210f8df53c7fde78b

SHA256
73a3707c54463c88e148431c286ad8c91498aa4683437d43b6dbf962429a6167

SHA512
ccf2ac67338299b7d366a8b2f4a99ee64873824767c25f490f2efd9985863c782b03536a774f4e217b8f190dd3b0f61a3813c39be6e484e3acecf97583e61dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5abd483bfcc8e3e7ee4ba2657ad13ab1

SHA1
201bfc0605c4624d3ff9788b56cfde4ad8148248

SHA256
2a4cb38d703f0938b3a823c0f974270efae8e24f78ec21f8adb499928fb9a7b8

SHA512
f900a88dee4b352c1e6b598c7d0327242d8553e15f3161f278ccdc775e6c7adb90941ca7d19dfdb4b2a3ffa6d40dee9d07d9026afba9beb39c209e6502886793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
813239febdc7d79372787526084e4f5f

SHA1
0224260ca96a6cc9745c900c6a1041c99790df8b

SHA256
adaa1a8fa4fee1031c30a58909e6ae48a5237e57f3051a86a9d382c1be5860c2

SHA512
d1210ca8681f375237043745fdc4436ba7202b56b6bfbe28770c9efc3f793f7882125441d060484e4182a25bdeb16bd5a78b403587f84f9a763c0492fe49d660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
850a21e012184640ba6237d49ca0eb32

SHA1
36beb44764379be03fc3293f3a86f755a24ad223

SHA256
8b929e2594d88a42026fa1c20b9772be4fa726af48bb278856bf7c47a2273154

SHA512
f6c0a79d03c411cd35977346cd7ebc40f84b2131533d1be5f916a73a76fb9be1ff4fd50ae6d0acc88f8c4bfe267dc3a0f63b3c3088ede5ba312d318919b69a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f544d7a0a53394d1c12ee49e85c3dd5d

SHA1
392457d6013643b586b1b99b7c5cbb4b139957f7

SHA256
43fba44d2bae6a4cfa6216497f8bf45dc38b8095fe45603da2f1d6c655635d2b

SHA512
6006d4238e265c7e6068f3cc27d58470167cdfbb9fbff8748f581ead89aecea96e7ed118fbe1aeb2fb16a4d32351d8a1164cc61845306c1df57e260962c87352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b4bdffc28ed5ad265f1fcdc0909605e

SHA1
a8ee1b86fc77cf5f16ba5fa442fe2e22651587af

SHA256
4665bd6b1fd10da7bcd8eb1474ea8763399adc4ab24c1f2e9ec4fa139109d300

SHA512
8e3d18617ceafd8f12697e8efdf6379b69b61c0ff44dcc8c5e3692e25e524091e7de871e63082f4f44f14468cf383640356e41d97f2ebdd0c8d68ae74f6206b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE967.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE9F8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit