b01c1a56b93c371dcf0128e945452c46cededff1a5eb8b937fa255ce4eaf3173

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d2ea0ce357e55fd78d7a60def1bcf1b.html
Size

14KB
MD5

1d2ea0ce357e55fd78d7a60def1bcf1b
SHA1

f8bf20de93d605c9c93cc7c94718ca874a28fa05
SHA256

b01c1a56b93c371dcf0128e945452c46cededff1a5eb8b937fa255ce4eaf3173
SHA512

2dcc60de64c6780196bfd85578aa0c815ce7f70213edd61d8f992cf4acd84db1be29c6a0b131accc443579ba028fddc3fa0bfc95e990c7c2ae8e6db58d21d850
SSDEEP

384:ln8uqnGDnW0qayZ44rA1HoTy3QRULAwYz+5nPB8Xy8KolAAU0CWzz4qVqFprEbje:ln8vGDnARHE9+/G

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005be98b0a3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3B290C1-AAFD-11EE-8CB7-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004a5e9cbe28a91688486f050552c2f7cb241be39e84d0936f0329568b13cb919f000000000e8000000002000020000000e5709d5041c0c1b00044b3f45c99283cd33c375be42532f350b785ad70b898f1900000007bb046521d7b4af4e097d275b42cd8d553a4ade778a4230a6d858c1805d0df4e1b5413de77e09027b5c8b407ff0db70f63f5af3c23b92e75b4a5a60f9fc7b16473d763ddf454b1fe4b1b0ad14b956e516bdfb67471191df747cd5f0d26da9347bf5680f4370655e48fc867c5653e034ecd0d5181da3e28909e2d6499022b0acb7f4f2d47e46edb8f49006cd11a93c12640000000d16254fdda1fe8e33f8622c4b671c59f5ef0ededc11e14ea988f8d8ddd16b413bd90cbcfb38dd4d9f0b6dd00e336b4aa85cffb96202b0b6dd9aa7a07d43d7a0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007e46dfb992e4c1d5659dcb9338ead7adcd80624bcabb3209dcc1fe1da847e8ba000000000e80000000020000200000004d2336074af8685d73339256e299c7339d5585d7b5ee3ce8fbd90fcddc23000a20000000a77e235e80b1ae7b627ea0dc67db185e314074ea1b18dbfb984f751a9631c5694000000051851970aef3b1179093917e95bb76634d268f9e6d7a5090e93b152179442630a64c5c57a688bed7f3eb84ec3e4fb5b7f2ef6bbf51c344abc60c61a668a2c0ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410533604"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2360	3052	iexplore.exe	28
PID 3052 wrote to memory of 2360	3052	iexplore.exe	28
PID 3052 wrote to memory of 2360	3052	iexplore.exe	28
PID 3052 wrote to memory of 2360	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d2ea0ce357e55fd78d7a60def1bcf1b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a467140fcde03a46341ad9c1433900f

SHA1
6a2612b669d8de3e44a2c1f26d529096686057f3

SHA256
0a93116e27fde5cbbbd56b45e5af0437358d62af4c903841c79adca6d7001260

SHA512
7e0ed1e6a0f42e6b0899ce86253e9b65c957328ac6e859d2319c8fdaf90710e1306c3e8565f2e30fcfa390eb5fb991d2df8e66d30fe7bdc11e134641b6eb67b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f2550949c60e9065bb5398d7d112fab

SHA1
a9b71883864b183180ad234ff21b0efdb2dd6d71

SHA256
a5c0eb5ff463810fc856d03659930e54b3d70894a6e54ad9d5c381a19a8eb250

SHA512
d1100185221b5be0fc4bcf8f69741575fb7aca6c38f688ea5eb660b74062d64d69455d12d9f1d8537427d2f34646e6d9aeb449de2b6f679bd016377c887dcb96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a00bc3a24e7bf010641129c6182474f5

SHA1
2b7fbc427f8add2e2604e7c128e888cd1d54e648

SHA256
754f55fd2eae5fbda04218e35c33839c4ee19b8445ca25475dd80684ffb60cdf

SHA512
ef40dfb0418a96856a0ca2a73c00a3809dab238476e6541cd13e1b95de0afb26d1606ab18e6f6e3af228d368986d9a4dbce6dfc732215c5fa59132cd7f4c4e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34d40cc14066aadbedbf859996ec21e9

SHA1
ea15f72cab039bf0d2938052cea22fc279a0cedf

SHA256
d1b44e13c9b7b8adae0f7e63aaa8d8791b3e14465dcbcde50ca0a2e31ecebde6

SHA512
c33522f61b935f0871f8066aeb9e2786121187e685d04f76c518b36edf9029787517a9fb03d3f6b218a3ceffd0ae8eedba84b727e3cbfc135b46c6a38aa515fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf04954177596a0ddf16428168f1ca4

SHA1
9d978fceeb9a54434264e40435a5b4cd3461e696

SHA256
c3ba013d8516ae4af3efdc4cbcdf5cb11e0a3617b52f9f503481e95efc0ed6aa

SHA512
60fff4889694a4af572f687e8bfa6e790a69a139c346135f4499689970403dbf97c12351ede11cd65a2496ffbcaf9c3534a7624d3b96257132a83808635ff3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6e74d5a4db626cc105f3e9f802fa00b

SHA1
e05f2dacce1f5d85bd611c2b442ea5c8dee24bcb

SHA256
1d00ec88493b578d00cb5e92dc619dddc6d1cf7f3d70a7f969f05ea0a8d6067f

SHA512
d5d0d0933fa27557eb5081e66105deff8e4ca9922d131087d807d314c1ffaa66d0a7243f757a5c535f0a52eeee5b269e7ccfe023fefb22e0d68ce43fc447807d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
650fbf9602ed18d3234a668302574a33

SHA1
41c48e3b1e91a5d23a8d7e74b3f7d0441150fe52

SHA256
220d2ab34e0101921a4eabb1854e2e34c485f515b27b663987226ca9cb7ad245

SHA512
93455f4297c7e42d67609920b958159ed2392bc40df49421fa63d52b8da5ceaa200ef0552b976e7565296e0bf4dfa8bd6895cbf49bfa22fce6557118aff2b1ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b38ff2d210aabdcd56becb2c73e6907c

SHA1
a515a6331acceeef303885bf4e87176a1d79d36c

SHA256
14d2a11ec40eae620c826b8bc1a3284b15b9b26e23a6781787f5397287c1db85

SHA512
9151b350fad79eba915e6598e23d5588892170331d10cb092c366e48f4c1f41982de2ef904eb40f7a197c978a16b0f072792d603495e9d47714d180b9ee48980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2935a754fc52509a245a8214c58abe75

SHA1
efc6fbf642635bd4b5608750be877c524120ee5b

SHA256
1529dc30d6d064258863798b067f81c00dbb68b17f83900389621729c560859b

SHA512
efc5ee479c427d57f91f0415bac4b9f482cfed3b074b172a962b0588ac01f497ec7c413e488536b97714f391e58012d32b9d46d43a092a5db91a2e7480c82bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c71c14cb3ebd1c2ab5d79d3b120126

SHA1
ec78b5041e1798a26051a1d5636444c509b46c21

SHA256
f2db0af8e80723e2778a483112ef7980727b92f0621c49f25d70e628584f26c6

SHA512
cab3daa3f3c33f13972c39ceee64e33c65972a505bb1ef0bfa715d18926e275de9466a5d76627cd85e52ef122656bacb13491ec9033c1578f90b984b75c5a5d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
603bc2f8e6bcc420125e088c68ea3b32

SHA1
d1d5b2608891856a46796cb6791d7d110f24aaf2

SHA256
a2845e2804d7dc6a2eab9fd1dfafb96333917cc5746ca67dedcff58230d10c29

SHA512
9b42891ffbc3923bbe7b1afbb589058b2e9e0a294518adbfd6ffdff1c9c2b79371a51cd9f44904fdb16e6057ecd92dc7400a18dec8664da380dc2f58d989b2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d3696dec9556d2a293e5f31bb6bb24a

SHA1
8706b98cd2eecc429b05049410a1c03b09a52efe

SHA256
4f8046bc9af5aee5f2acdf9da9e9235602cd87f3b4d485b53e1ffeef0d25e106

SHA512
4ce02bd663b6f8556ba4c24ab5d17257993564bcba38fadb1c7c7fc17d6010fde1aee4f94ff4101eace38baa77a7d2c4fa81702757ed7b6bba07fd1d3d572eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bf93f1528923defc0dfdde7a6029e7f

SHA1
432b3199da01abc193a0904a3a4d215a291a7b77

SHA256
ddf220962ac1d2d1b274aaeefac2844899087e83b96e3ff3b8a7e9b2d4d2982d

SHA512
869c6a1c625db740df949c43368c1968a325d3fe8b7d153fa91875f673232cdc0505a8563d617eefbeca81e98504e8e75b846308a055242839e28f2205188977

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab88C1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89AE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit