0ec1803f497a1893bc761483cc16a86b9739a802a2f66ab0e18915c2c0e42a45

Analysis

max time kernel
139s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0154739540e4a28ee08c02e8c647f96c.html
Size

968B
MD5

0154739540e4a28ee08c02e8c647f96c
SHA1

ff874e440fdf573555a9014ea03da1e78d3dda9b
SHA256

0ec1803f497a1893bc761483cc16a86b9739a802a2f66ab0e18915c2c0e42a45
SHA512

665d6663b2c582196ef88a15cdac4783b768b03e19bb5e8366f9a37c1188609f128922cd4004b7bb9340f295f3d2d81001b2b20c254120831c39cb2061fab4f1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C2FCCC1-A7F8-11EE-BA23-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410201462"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000195b0c45fe6d8f475566e90b04eedf2a1cd416a29805f4e4b4366b93bd565b2f000000000e8000000002000020000000bd8e0b0bd0b1f27745afa6d91439884e9d0977fcff865a3dd82519f8d0c0beb4200000006f71aef1773f7bb7c6a91e5956a556f4c5d44a490858dfb23bea4adc2189a62c4000000083cc2c6f1f1ea04d5ada3fa56eadaf4db47b01f15d4bf84f49e081c654f98df84fa0f2f513c7cf9f66e23978ee453651d76e9ea1bffda3531445cf86ddef671f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03e4341053cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e00fee1362e26488e90951dcb505593fa5f6bc7adf64be0e223a97bdbfae7876000000000e8000000002000020000000289f82be1026dc3b12393dc842bb532b129dae0486f7b75dfa6019fd46f1bda590000000b879763165de0f5257ce77fd0b90a7e9203022ce4cef3a482d091aa86437caa4f9f5d7f139aa5c90093ca3211d12081c70e7a94e08b93ff093f0cd1498998cd89bd440373f5b4755ed6922b264f77a1e4e3705cec341aa036e13b346dcf491963fb8ca7de62b237c7517527f5addead78718bc034f5a94da47f87e7fd89a0d929079cf516a8f78bef9211397f70d9fa840000000b6fc8e0f4e81a394a295bf21d2b74f94c959db38f82f11cae342e36bfa0db2f2826979ac0d4de862dd84d1313f4bb1937a5a81ceb44ad9833347a60011dca87e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2876	2956	iexplore.exe	28
PID 2956 wrote to memory of 2876	2956	iexplore.exe	28
PID 2956 wrote to memory of 2876	2956	iexplore.exe	28
PID 2956 wrote to memory of 2876	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0154739540e4a28ee08c02e8c647f96c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c60f8fd726cd710f0f5241c535b418

SHA1
6cdc728e56262d891e5cdd91862ed224cca0f99d

SHA256
52c4cc0d497315557945a2ffa29cb357be3b07cb98488d4395526fa17e7c53fe

SHA512
76a48c3887677c76f91bc5d8333a4ca031595c0727691f7705eb20da8f00f76736f203f19d46cabbfc56bade8171685b35d2c65f750929ea2c5b6e9b5ebc10a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab8d3fceef38aed7b9f9b54d0d7a28ad

SHA1
61d8337fb4f1831b5a4ff1c8b58b712b0dc95de3

SHA256
bcabed03bd89a353765dfd163f0a92de0ac88809eefd67c91597cc42229782ad

SHA512
921f969e2f4fa15a44a8b9fcc75fea0bdcec9248ab43abfa817e4a7b9c2c2502709271dd502e9b9f90efa1598969b4b0c870415f647901f7b41f12a95ec4868d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfe921a85a296fcc146ccf96ac6d8834

SHA1
886db556186a0e1d1bbfbec98ae4ffddf6361b58

SHA256
e7f213da05c5c5e088ee79344c6f6a5f73dd026da2ba6051e0e993b052a55abb

SHA512
6a3ccffa5760edcec6b6ced5ba63a2f1c903891f13418705b7037494c1691e08c7bfe628f5df434d0ab3269951986711dd8f3e73172e9674df950b37aa35b3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c29176b76e6a690ecc0dcf4d95df823e

SHA1
bd5ede5ef95af82a48bd21158f6a01199a60b7fa

SHA256
e632b50246627e6006499bade73674f3b75a90e18acda0de34deced496fdc234

SHA512
bd7c9eae64e077b28ff2e2347c8d84985018a8fe4baafb02d57e1d37e9522a8dbb06b66faecf357e2b8db5e597c736f23fbaf691eaab2245cf296acc616eee6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
704f9259e35de4b3e0b781148f1372af

SHA1
ed275b14be07b6a6b446596ad11af80dff8d92c6

SHA256
c78894fad213aec04ef9096ca1ec3da2c1747cf43f86ab3ba6081348af358982

SHA512
88155a3e6ccc9c1d5cd3558525fad282fea1990a2378db971a159710e4feff62eeefc211e7bdac19e04bc7686958b8c961208670afe77c29d02e733a0be31682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c0ba768735850f346574430d9d76f76

SHA1
d39a29d43479102671cdd8574b0e99d4efef8ca4

SHA256
be4d4eddb34b2bb91c448f37870372c28eaed6a24c5df8b18175006735d2e247

SHA512
dde10f741a5b1ae78149223449223efb73dd12439f087bbd48792831eaa9c33112619e8898ffc4191b0563b69779272c4ecc07f9b1227f5356cb22da12134512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50855341a32b70ea7e19adf0c3f4acaf

SHA1
7aac0a863d40a6c941d59aaf397f3860beb6f536

SHA256
d626ccf578305fd653996f3fd159a794ac8539f5209caaf6553c2d2753191b26

SHA512
f4851f913f76ff5fa56b59751e58be1fc720f35f80c93b847364ef2ccf2d52cf98a9f0077a1bdacdd44717cecab80e9e0d444ff609793d08e46d428c9a337b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2571a33e84855bf861bf67b8e0a79b4

SHA1
5090d0c2bcce25c6b40e5522b720b769a66cc2c2

SHA256
f462fb0b1a0941f01f471fb8eea823f361b0e38a2b4f9703cc43aec2ea8c883f

SHA512
cb9675b3ad5194d546140382d06e21da71adee2381d91a9482e12cb9e8b2ee9d2923bf2e90228eeef3705089009ee4be1263b380ab362b54fc1a7b48d5e28b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
402d0224c2371df376bbd6cfbb2b650b

SHA1
8649083057fac6554a0490c057f80ac89aa62b54

SHA256
9792377858799659c3b2decb8cae6f27b23e24bbd272fb6d6e1f342994588dab

SHA512
cfacdf6a5546175f636858332b03f48cfe557f67c398c93a3e708acc97b2e21b86fd643a463f5880c3cee9120054abb4f3750403daecf62207f8cfe1f4018f12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4257f4fd54ea548f370ce7ec87bfeb

SHA1
7a9208f00696a78ab7693f3921cf33353120969a

SHA256
deef91d91d1d38d7a7c6f4620f0a3c2faa79316520a9101b15d01a640ccf2a0f

SHA512
bea1b38d42b673d8634de704284fa1a404e9d0398b89ef00ac2e9a8286de87a5f4984fe9bc7732e12bfabb41e168eaa485d0964a946e36b4209adc9224037d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7421150e765aebf0e3cf70a0a97f7ec7

SHA1
f49b7d6a6e4b53f51646ef84396a43aa76729409

SHA256
72e1796440a0ffba3806827b16e4c8541b0e9db1835137694bb8ae769cf4eb6d

SHA512
5772f9f9cca4a8ff6dec0d48a4570e7ba230d0c6a591621a3a178931fa391199465484ad2543b5bdb3ca00f44e75233929dcd34f55d06feced67bfa4cfe13dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2216a755f764ce5fffe7e1fde8355d1c

SHA1
871539cc36ea218e2993cde4c897873c3dcdc12a

SHA256
00be3783a0b66a55f89cdf77a3ee128117b69de5826200ecc74fae9c0953c593

SHA512
e623cdf9c2b89ff8086c2213d6e3a5f24f4db3e0a2302d03d5c1c1a62e2f9c8ec39b55eb17c3aade1b54a25c904ff283d51f46b84e9b7bbd974df97df3dd74ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e614e4751b8586cd9ed3841374c4dc2

SHA1
af4ad3315d2c820b7ed2fa9dee8d78d5b0bad9c3

SHA256
607a952cb07165ad1dc3dea7b247b9f17865735d17ed8e18d42730be7bcf29a9

SHA512
40ac41e406a378b30e5635411a7113cf32da3e4a13509f01ead30620c17202fc13fa28f21c0a4173b473666ef34789f80441af744ad5dd2231c656e56570f03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac1bf58aebf74ef9f64615d2b2e5beb8

SHA1
f4cd84d0f2eacad4c5a33bf1d84cc65eefb33887

SHA256
d9a2ce6a06cca3ae8eb4a4ed11cf1ba2a9a78e558244a43b49ec6f9de90119ed

SHA512
8aeb3ab5d0ad9e0fcfe080f2f182b926ae327f9339779afd4cdad73ee0f39f75eaa693602a6ab0f37d446cbfe2f9c278f4fd24614d571e1ba3473ba0e5479464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de6644642d8cf4450c88501c81c91f1

SHA1
765524dfb36b27fbe25c53cac96c9777632068f2

SHA256
6066a09196d7da0e69f5e95d2960d8bac996130746ebd9cb954f714f001e7e55

SHA512
65f9f6e0eb7031c76f0ad6034f54fd11be1c14da9f0b83cf7b7d2f92ef77621e5e70d3fc101cbf102bf940ec945f4a224fd9ed3572e606601a0a2920e6a1dbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9D9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA0B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit