497853c6c71a344ef47071cf6438d711e3e3ff1fc557e671570686f5d17b80b4

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01f123c0595e8f099d0851fd5441e4cb.html
Size

1KB
MD5

01f123c0595e8f099d0851fd5441e4cb
SHA1

5934f489c88ad0ce39f4b37d5d1bfbceadd67942
SHA256

497853c6c71a344ef47071cf6438d711e3e3ff1fc557e671570686f5d17b80b4
SHA512

45196333b1eb70462851b68df321e1bbf03e7ef7a08b1bc602579bcc3f3503813a258330b8544c23800bce8fc955bd926b6475bcde83250763e5377a5adeeba7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFD8EF31-A68E-11EE-B59C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410046229"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506b03da9b3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e9eacdecf9a8bc6a015c65e7722a02a2f77ae92b7c7a03c2fab41a533dc873b4000000000e800000000200002000000074cacd7260457380ac43e1e8be7b4d5c81e743cd3cfa60550433b48fe5abbed890000000142cf6c0641ee23650757a3c624abc3653f32d882ad371b6def6011e3753baf1222ab5a8b17ddb7cbcc29669f59a7c121478bae86573ebf21d38038a82b98215ce19f55df359b70fece05271b19ca5e8fd3b0796236c064607650fd3c18547df8c1f4547b4712300f52cddb6297ebeabcdb014fc5ec07124664e52ab529508dbfe858d3b0cdd8704bcd34cbe59e914db400000008f65341b1dbc57d0317ed9cf76f065c279b87c501dd1f3cba82ac87b7338c5993ca7b320ec7da7222d8a6db1c60ee07c9551ea392b0fa94238aaf46fed14cae4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000777fa963b23375e9a382d965d669de85dfc3dc8b94cf085af0496a431396b41d000000000e8000000002000020000000954fa14c87251d0feeb6e5a9245ba137c9aa29c8cead7de03508ecbc3fb7aaa5200000000b9240bea33a8033adca56429ba9db16d615992969489607ed568dae73ccbe2840000000b3c7fc028e1f0f78cb3b488a2ee71b2a7f236e35696b02615379563305676eee6cf189c14368a8564519ed9b2dd06e228818c05aa5f716773f2a82ce7fb3f985	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1272	2080	iexplore.exe	19
PID 2080 wrote to memory of 1272	2080	iexplore.exe	19
PID 2080 wrote to memory of 1272	2080	iexplore.exe	19
PID 2080 wrote to memory of 1272	2080	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01f123c0595e8f099d0851fd5441e4cb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f893962ccf63e89c60d3005b79bdf8f

SHA1
fea86f6ebc382437854bd6df806b283622d709f3

SHA256
0cc5a92d8593c79385b0d38335bfc4078beccf6c1beb0b93f3b713ad6e6f69c7

SHA512
b3d4905e8fb2efcdb4ac21a938b2c55882ec05b699db6a2bb2ad70077e7db11525cdb5f8107cab65465a5df4f5152322a883140ebafb4ca25de5da7910df082a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba4d999d7fb66019b076ae3db0466c32

SHA1
b3ef4f79f464f13f0c09a2e59701d36c9b5fe3e1

SHA256
c2a4908627d778abb7a8bae4ad1037b29c5f9c736b88db814f651883f431fbb2

SHA512
9f5782ba908ae2623a6f81588bb8a37e2c53edf4e7ee34e535987031d7cdfc933c56ce6ab8a3af4d806e8a0747f45795e9c53859be90ea37edb011d1f5343ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a222d670142d4a4776b1f3fa20d0e2ce

SHA1
2e7059a7f4a3cea5550ba62d1afcae7d5055aa78

SHA256
a1fde04909aa9548edc37b2f6e8b26a8eccfcfa6fe5f58e9bf5b325add2899b0

SHA512
d050f8f3cadb8ba881a5b2e5d4d2febffd9095698a7af729c92050368f5372dbbcecb1e86a31304adbf6bf037fb5e9cf27399dc2c762f1915c34bd4c6142ad69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a1747224450db4adbde6a39da37b119

SHA1
e627b8af516ed6014bbda59919d567efef6c3883

SHA256
43c9ac8722b880cb2bb2debb182e784ae334a4dced9198e601df5f2eec8fc222

SHA512
0810f16b120a2b428ebe017daac62b78057a4ea16bdfeb40381e2a4726b6ba0012e342918a5aba904b7407e3265c19891ef93a4521725917cc1373954e71aa81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0401af04f0c85bacacc1f9ae1034d738

SHA1
e2f529412c74ff3e8e543d4852b8ee6861521223

SHA256
d18231b952614967aa88dac8943fbe61f0d6c99a2ce01891b609a02db677bed6

SHA512
8ff95717e9d2168b6e7a76aeeba9cc0e23ec34717c5c9c8456942d2f556ddde93bfbc872b911b4d800545dd83263c6430dbe6f4d4ca1c39d8b69f9135e63f26c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3106aaca954ecf19435ec7edf6f1d854

SHA1
392f22882dc730cd164454aff3a9b7d3cfd64bcf

SHA256
642b2b58f67fb3a270af14ae7f17303ad76f430fe536e55eb82bef6f8b2045b6

SHA512
228f9f17b4fd98f8ee7269387f7534eb05088b91c643a969e4269ad9a6dedc23644c0945486bef66f2a7b534f24ccba275df84658455a75936fdf836e1991c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b409f7ffa8d8f6835c0b119effdc4a

SHA1
cc9f8cde5f5e938380ee0f252687b189ce254fce

SHA256
d23a7cc451eaf34579f91c82c3a243bbd3e317dac7cbcb9f20fa40c227fb3bde

SHA512
3cf4259c37b9a3a1aed2e72b30eca6f3054cb18257a57da398e719c26efc3b29ef0c66bb35c32ef18871b4968fcf5ad08ce309f45d059ea4df3799a815b1f5c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
817b2b5045a8a66382daa50554eec9a1

SHA1
9d6dbbed61ed2b4b4ec114b7297565532c753156

SHA256
ee01fa00a945c22b8522b4764caa703005e26473148331126b3893979a470956

SHA512
829b2678601c91cfca9bceb693d4891adfea56b19e1905588c18e3aff70a8957929f12689a50d2f20fcd4874e5fbcb621442cb204b23c08dd33a5d6c102fd683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16a01f57a777ffc25f3da5bd849bcbd6

SHA1
86ffb36f969d191a2b483b0f9012af09d10bd309

SHA256
25b6f0e6a5bbd72bc60b532303df957ac8d45f2fe6f4ec907d79fd5fd09e2865

SHA512
82a45ad54ef51a5f19ef621efcd95942a3998a72787c9891759d4f4f30bc888996ce07fdde7f7e30759cb0b45611d4076f6d6477492188c6a39f60a1e42fe6be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab0c7a23fc403b5c3ca74a70c8372323

SHA1
a967ed822b2a2842fedb8d7008308f077639408e

SHA256
0a24988e5c82c804e90e09c6042cb33f86fb388b4dd1e9b031b5e73dff9d252e

SHA512
a57d8ab01c51c074cf187dea35dd58e5c9b668a22262da10ef3c119d24ff70aa03b20dfad19c8e1a2a7e6fa43f15b1a55dc79eb7789d74b4b781f7224fa2fbc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1e5cd08ea642c9d39f8ea67202a9f0f

SHA1
c093f1c66a3e19d5d6e45058a606e886ff7cedbb

SHA256
70c4b579694294c394bf9fe6f9c1f2fc537f1f64a424e60632255d41b4709629

SHA512
f627fe507386ac53954546fcc93a241178043eb610309b478ce0af2f9e8a17d2b2dceb34f2577b5a5939866c711797ff67417a304ca5d46672a08886f1871c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3b19a0f30cfed6a80b83fe093bd9339

SHA1
e922299c1659cd047f2e01a51fa8d62d68b28cca

SHA256
51089fb8924892827a473227690fe2afbbea459c2b176865f969d00e3101ecaa

SHA512
1c57be5fc847f527a87ae51e100b71d5e0b653b776efdb6c2dbf49334394d072984348972c18fd231bad58702b29650261b8de7219c72fef25a9b25dc411aea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3446f90eb0fd2e8a0bebb10aec4e946

SHA1
be312ce8ed871e8aa13a41b2a73e94a2462da9f0

SHA256
dddeb8f2b1ed6a21b3c27076723241546e58485397a9707de2b5ecdffc4bdc23

SHA512
398bf988b5d2036a699c67cc69cfd879d953523f8f82612fab49a4e7637a4b90a0659eea15ae683e5a6c0ecba09367c18a7ccc53baac36fc207f50d4e3b78e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62f2b0454bf7529db4e37c31255b7227

SHA1
fca00fd37c885b77c61ad21c457074ca97a25d05

SHA256
1ff3bd3f4df0760215271d50502ce27c2d72ae3654b5a7b309cefba352efa25d

SHA512
e824adb26ab1853d84d9ff4722751d9a934b1c538e37340577b3159e0faa153970922ed3e57e5af6524c244d9e9793889076c64ffa7b3a6d18672ed3acdc501b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c300cfc5385cfaf72f2f9116a70edfd

SHA1
9c3ae1a82d73b7b0cb24d0afd7811dc30da756a0

SHA256
b509113804fafcc28ff6cb771127d63e6c9b3a9fe1abd0e19ca8c3c8146fcf09

SHA512
f081b813876ee86ba8b2d080a81a1f7c5f845257bbcfa227023d308f7487805a223125202bbcf74cdc4b3cfd8851ab69c9832e3026dd13d9e9d6859e0a4dc12a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96beb7c369958ad612d12d90201e6d35

SHA1
9ef70cdfb9c890592bdab6e152f907ba14e992c1

SHA256
c3f2aa7de6bbb58db375791b50ce4d642f0de4cf9ff054ed437a706caeb94f61

SHA512
b01fa91faa60c9e1cd9be662f05f998a74444cbd39eb02ecdb4ef1c9149790b652fb5b15f6e049dedbda31fb57ed0b9dcd928dfaad20208848e52a4e47c721fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b60e21fbd7640a5f652dd7c9c6f57e81

SHA1
7c4f825a50514525b95bc155546568d5453a8b45

SHA256
e165925899343158661abd3dbebe156ce32ede9d87f71165573b5ba5304c7d59

SHA512
f2b78ab4ffce728c51b9d558f3ebc03007f5ecaab85dc563143094451598aa194dbbf07d61b7d6850371edcd6d2f4627f085d0acba608ca2f15a76efebd72326

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab584E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar60EB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit