59bcde40a568ecaf3cb1aefbbdedccf2950ff6a1928ed371819d4ad70a044e03

Analysis

max time kernel
121s
max time network
174s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1daddd57f0a80ba715f648c8fa64738d.html
Size

1KB
MD5

1daddd57f0a80ba715f648c8fa64738d
SHA1

12fd2eab60c1cbb2f718d3a3dfd7a6875a8a4297
SHA256

59bcde40a568ecaf3cb1aefbbdedccf2950ff6a1928ed371819d4ad70a044e03
SHA512

11b0c33ab0a00799a5d028efef56221c321ca5491e5c8f58856f676d88caad5b5530abab78f3c53e931e23ce9c9e6e5429bd1e4ade11d38dbe432003c8e2064a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E1EAB31-AB19-11EE-89A8-464D43A133DD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000059e06ed27cd37d5a970d934f321d6c69efa920e585420a680f8483d0fe18e611000000000e8000000002000020000000ff3e6c60e80123101e4db3f87730a31278d25b3a9e879591de690226827dc69920000000e1f1aba27ed7a01c200f395a8fc9a74a0945333a85b472feedc7be128997d126400000009776d76f928c1e741f0ef0156f74d1529acc70e7d4f40067f26555f9e2862297c2819b09a67dd5d9c4ff85f7a86ba429bea359818d37b02c6409ad6900b6d746	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000bae464f75085f27f8ab3184970d39bd3eb4659ebc97b9789be440f9966249ebf000000000e800000000200002000000076711a72552fbbffab83793655ac3b88e64a34b1dea2e4d1d28693a5983fa38a90000000f605b55999c83bf4c3b36373a18850f60ab3e53cf6d9d119c6465633979319ae9e38eb8325ad4e53771e2052c6488d2b4c61c298df3e6c49cd93cb713472854c8e7201a55cb61d3b8f4471e73d318f09386b7c65e1ae0778eacb8cf0b3265ddfb43b86cc60c18c1e33ec0b50bf206221d6932a74732d4e505c50610f144111d8802b0aa2ebaa0e5deabdcb4f9d65139d40000000138761fbd7cefef9cf7c84a4f20091ad8add0fecb5a4b9b74d8629e9b27df9dc437d79ee38fb997605bf4a2a20b5daf5f60d251540ae69d2a683694a22368472	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b7e603263fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410545397"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1384	iexplore.exe
1384	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2352	1384	iexplore.exe	18
PID 1384 wrote to memory of 2352	1384	iexplore.exe	18
PID 1384 wrote to memory of 2352	1384	iexplore.exe	18
PID 1384 wrote to memory of 2352	1384	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1daddd57f0a80ba715f648c8fa64738d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01479c5e4968a33581eb7226bc653ddd

SHA1
7546dc3bc1b5a6dcce8e62d4a3883d8387ff5604

SHA256
97c8709bb9c7c770e858942014a6bba7ba5ee3f01cb37b03968868ff9baaacbf

SHA512
b109ef2f2ac50c84041d3342d4a9b2c3ffa0435d0fa616abec91b956d2138ea15de2d1d16704c8940cbb7bdd50619e40110be4d5c6ff4bf201791b77611ea377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0732ef8d84f26c1fb2d3c4635df10d9

SHA1
29d571e960adf28bb415c56c701836fe783851f1

SHA256
d7627fd1b7899f87564d7f98122e87ef5827541c6d3e465837a77bf109106f16

SHA512
cba366a08e4f4992833f840f435ea5cc3860e80f92d0f04bbde870d536e7ea1ce8840b484f38ec778e4728aae76965b7d1fa08089676c10b10a9d3ea8566769a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a105b832aa3db54a4a7c37d1669de8e1

SHA1
8417637c26ee989cf31d9d03bc1094fd185e77c8

SHA256
fdfacaf0d220033cdd2253fe34fcf5b325f02c2565e31f774060f04660bb9ad5

SHA512
a7de037e4f1497136cb57f2d306098d8240af1a1d4a64ced671437301e6d0938c13f9a7a26216b533f19b1944339f2fba6ca5f48895c1ec8eb88dfd0af1d27e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f18208c53a47556801bd7c6b83d68d6

SHA1
0ff0dc11e0375aefd286708eb2becb259194a15d

SHA256
896dda62f224db001634415f5df09535a8db0950dfa75808ed80564a422f01a2

SHA512
efece78fa8f5cf47fdffd2a2a9d3455e7ee353012b2731b21f7afafb1a59c78b1991a906b25b2fd80d4547f66e765deeeca1451a5e77e9e310b4d2258fa6429a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8575594df9f78d78ea97dbb2d9180989

SHA1
7da6a47efa8d542a58d192dc30f03c287daa53ce

SHA256
a9f08b7087c26e969fef5d9903e194bcc396ee43f99ebe4e881874af1cdf56ac

SHA512
c7a26b7a5b89749c9d654927cca1c1a25781f6e4dd08130091bda104800c849b9c4d0ba6ee3352f839c6b5d595d34ae0c1745f584d0d3e9b7822b328aa873255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e2fab8d1c29478fbfbe819e2d5b3c31

SHA1
cc1c984ce5927197698cf58d686bc0a43b55b980

SHA256
49a05a8b955c4508b9f54ce8821b782fe842755a72af3f4fe3d9c0cd77c69743

SHA512
f91e21a12c7e4b67b0292082859fc91c86701390719c54a72e0eea3edc66bd326a6dae1232971b65337b98d399c570b0df009dd9f5f92ccd7508e574a11912eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38898f13db728e06a994c99c09feea49

SHA1
37824ff5062fa2bd4e035de5c4b8e8d2bab1c4a4

SHA256
d5bd3b85ad2709a2d2d1bcb9715baab66dc9e6f820b917254979f7c9ba2c79de

SHA512
84c4bb1853463f0dd67ecd9b9087acc39c82436fb820adba5810c8f2ec06b2f66e50efb497ba675f2d275f883e6d89157bfbfd85985e2d5b1556cda31df9fa61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9a3a2c74724d29ead7f2de73b45429d

SHA1
3d0b775e59c79d66b6652af3ed687e7637a4fb9a

SHA256
f24f32779760d021f42e59c6fffa35be97a1ef59ff28e7b8cb2a5a1e2b4253a4

SHA512
de0e55869051b9d5292ab150a9a6bb6b6757b8f34901ee2f756de69a24d48234c7b360da025648e3c882ea3815f2d88fe6b22e69be31c0bdaf46919829e889d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f198e922da8b0b0a506590f8b3ed8867

SHA1
c9b30304f32fc383e15b7cec8940a5b1bc7cb93d

SHA256
8ad83a5a4857d8a7fca81f57745192298574ef28537e63fc34f67b06461ea7df

SHA512
dd8de7f2a7c8a17d2def732f18b3968cdbb6f56274d74c484e02fd5b195a08c03b36c2fa240ed5c61a4e8a1f0cd88b719e40f38556644873792ddcb17a5bd608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91d434ca45d6abfa337c25293cbcbfeb

SHA1
e5f111ff993813e6e8edcc975bd649e9499826c4

SHA256
d4edaba49cfeb6cf847d3cae748a8fb0803f04df4677912ba5d69a5764ac26cf

SHA512
6afd050debf90689fadbf0066b279f2af065412954a249f2932093a4b1d57c07eeacdbaa9acd69bd5bb79b3d36df9672f672bfd2d33e2b607a5d1f2826f81bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed634eb67001984a0532b91a8c8e14b1

SHA1
fd4db28c4252e48ccc8321399574d704979f95ad

SHA256
a62d7c59c87076ae7dcf47f9c04c845e4c4a1840d0e4cde63952af1bfd38482e

SHA512
b50fd870152a55b596bac4da90690c2d97443bb84d452fcc29e323cc4688246defd6ff9611f7fc1be5bac486ec5e03d2f0ff64bf0878bdb5e14a1f302ba05624

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95F9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AFD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit