ca9e4f3fb2244218c6fb9329c9b076a7b69ddf8e91c2e2569e51f37560f7b486

Analysis

max time kernel
118s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0450e9512ca2e32107e7ae7f4a1e1014.html
Size

842B
MD5

0450e9512ca2e32107e7ae7f4a1e1014
SHA1

4737370d18ecd801bf91db6d522c033f373fde69
SHA256

ca9e4f3fb2244218c6fb9329c9b076a7b69ddf8e91c2e2569e51f37560f7b486
SHA512

f348d51e9ca558b94438e2688257037f5b56a65d5c7a7b9d27368178396c861126332037327233398f82f93694d3b46f68cc050aee7f83cdf5c7195598373613

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCB033E1-A6B3-11EE-BD99-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000da5b9f8e1b8e77eaf0dd77cdb6cf8f214e381d95ac7153d40ae3b101802a1ef1000000000e8000000002000020000000d87faeaf43b25c3b566ee0fd3b046271740163549211894fc64e29e6bd137b1920000000276c79fd68bba86ae8462ac119f6bcb806cf6497cadb4d588b8e9260eae1c3c940000000cfe090de1cf34d68b4ae4974a719d81104cea946e197f66a93167c65d3f6e6ebcc7d2bd9a2ae456fe2e7a9d0d88ebd77c538898346bebbed85cc8b6e730041e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d332a3c03ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000d71447ca6735449dccc9d6451ae683957346e5d3662914a37cb51b3f3b7b170000000000e8000000002000020000000e464c474f6b8fc75d6ebc480ef74bd2510117e74314a5ec44c186042a1ce07b49000000034754e87c658bec17cdff4e785661b867cd5a1896bfe6a6c4ab8faab00195759a21037a5b2c87a749d868aa115a2e03e0524f9ad674403a15b259a0ef291341634e478f2e238714226822c2b75088a6970bda67174fa9f05781d525a1d25da736e43919545e7626b65ed24358cbfc39a272dce424b055f813c316652785e70296ece11975645645beb856080a82de33940000000ce7c4cdbe913d5d455b23292d40a17da51ce2a501e0bf44717288623ba25feb6f35ced814ff6faf317b9175486493d871d06f76b1838c4dc29672c916c92670d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410062068"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2472	iexplore.exe
2472	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2708	2472	iexplore.exe	28
PID 2472 wrote to memory of 2708	2472	iexplore.exe	28
PID 2472 wrote to memory of 2708	2472	iexplore.exe	28
PID 2472 wrote to memory of 2708	2472	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0450e9512ca2e32107e7ae7f4a1e1014.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3509a8fb7612f67c558b8f6202d1fbbb

SHA1
e7d44c7166301cf38bca6559515a6fcda687808d

SHA256
2f959e56b2d1c4317f44b5c8b28c71bb05665ea7c2f5bc639b3c63326dbf63f8

SHA512
766e4cb603ef82502d854af2200aa405fa14eadebe51c23fcbfdfd41b6cde88b2972a015deaf43adb6cee06cec7a0579d9e375b3e7d990333b8afa80905f83a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
491f1a22ab5741ebb490fa7eb83e11b5

SHA1
f944e17daf5a308b6d36c927848e6da21e1b0d48

SHA256
f431486a2954d784f5ae64f8b14f553f6c7d2951a3e900ee2ff214b47fdaff21

SHA512
046edd320f988be4e69907cf54a657385f86a9437d1d3b624be39204ff3207aa72fe810b810004d7df361b2593dc2b1120c09914011c2287035fc1299370a542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6063c34724a345ac18c6650480d46c22

SHA1
56a060250cc64be393b4e4fee903a0ee6c84816c

SHA256
04e2040a98737b11332d7d555e46f121decafda83568650daf8195b9799c2589

SHA512
30156f3c5cc627a8754237ef4bcf822b49113c5a5e27053e00fd0ec338899c978cfcadb90f88e95aec8332d8e8155326cf9d65db6f95df7bf5c9be5d62ca171a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb3370d77898e1c424c28c37b10138c

SHA1
12f2a71c7e9478cf77d1f1ecae125a8f447491f5

SHA256
4664f58c5b369aef940bf7f35ea3e030fac382caf1737678e640e267885005af

SHA512
953169c32f9c3cf027302fe74bc70d002b96dd26ee7eb1d65c8dd795a0b62105299db0e0f99defb799c1152ddf717aa1547779d68c04870d530e2e62b230999d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b13715fe8a6c7495bb18ccbd48166ba7

SHA1
27f36fc60d04e19675170768791ae1b84ec438ca

SHA256
8d6539551537d76cac21fcf9e840b4c583641913c2c5d085465445ab4f3fd819

SHA512
a9498c19785b1a2707a455fc644d73d2df25f19a1ccc3a3e7c65ecda5dc1a61e37d1b38e2ff111feb39a8f334a74c5f16e01a532458c80cfab4eab876453b8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
563f0af7997fa3e9b76f482726b7ff19

SHA1
7da302b96a3753eda16c412196c0e5a28801ae4f

SHA256
197e70513a58238dc9b81661b489076d6be045d2c5501377357970498c769ab1

SHA512
cf95a8a5a0b439362a386a7db5cf66ac40f79bae11ceedcb8ccbe9c5a87a08e22420a4815cdf0ed196bef01379123a13546c3e8afb11208b7474cbdad6b8d62f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa2cb45705eaa43faa129fc1142d852

SHA1
a81706338d891a532f9bb2a48473edeace6b2f9e

SHA256
c3fedc4524180b02166bfc942c2392c0978bca3e983835b18861f609218cc005

SHA512
f8999a4c236af9d9bf3408efc4bfa735eb7ef859c33fc2f2ff5d50ea0f8258fd248e4d01f44717f4d599ea5023af4c1038be8fb60dd55e6a4bc73393e670ecac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82c0fed67fc169da94963a393257ca00

SHA1
88686d46ebb3bef02d7ecbbdfd3b9af61ea1103c

SHA256
ec995ceeb5e34fdf95ed849a7279a72775749df6db4b9d3895751c15ad13f8b1

SHA512
0b555758bd88013822faf5a192d53496c4b3a1a6bd3e1cc91c5eeda0660a71751ede3aff26760e2dc67e822bdd3648a8418b6786ba2e0bfa30c0ff53bb6aad38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50f2be6f73fc09f6fdf828e3fa54bb37

SHA1
29173dc760c3989ab8c74f3aa401970af8c806ca

SHA256
a328a69b40e45e77a1ed57b93f595fedd5965fb787d0ef3ace545489e9e507c0

SHA512
f4d382abd50da1c7c24c70da9ebbdd2dbe95ee8eb6de4e54f05999f93294a5b039fa07375523c886b9ed2e3fa41ef53f9c3265d00fb9198f9b654aa5b49b845f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d494316ca7afc1886df3595a68e9df67

SHA1
fa7b780b7924903f3164b21a902a9896b78c5d42

SHA256
3ec9958d4853051f7adabcdd8b962d216b43d4363c902f004f2c5479ccc1e97c

SHA512
bf3e6e73cb7eb4658dfc3c491f49d0f662d6307dec1a0ce1eeb3e3affc766e11045af50d8c1f724f0f6cac3187bc77d6cdf9939ac2fa6715fbe825bb639906a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f73c840b78ba07ce24a1dbcfc747051

SHA1
97b99835ee236a2c095f06b690f2fb5b0f1c9e5a

SHA256
0dd6109375e575ade32f8f5a85ff7df86f3365abae6745b7d9b901f3e2f22df5

SHA512
c2b0d5f2632ccf2ee29a068cfb661e5e65411aa0d7bb0b6722d136e2bbd3a5cabfb0c91a28703847659a8982daae9155419455fa0b4fb41ebb6b575025b6c044

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F13.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6167.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit