15152188fadbd4c5709ca74308451e8941ac57ef703101c958a77359a2ff1215

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dc6e0aa79d242839948baee499e270f.html
Size

1011B
MD5

1dc6e0aa79d242839948baee499e270f
SHA1

da207599fa7ba2faffd51423eddaec26cdc51ec2
SHA256

15152188fadbd4c5709ca74308451e8941ac57ef703101c958a77359a2ff1215
SHA512

9c1a85a5766ec1f243950318bfc602acbd6555033f41b7c62fa43f6a4e1635c739bde63e19294087d0f1c8990cafb12eb8f63126c14dd7e27bb2947a45468963

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d033b0b1863cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410257061"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCBFF1A1-A879-11EE-B517-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000561b7d407333217c81dc218229556d0f9fc95b274207055ac8f42628a38f272d000000000e800000000200002000000038fb810b3fd2183d50d419ae11613cbc04b4389f78d386f1117cce4b88e6682c20000000f6065a4297472426731511343e8564602f7cc8dd26e4e8b6366f94faaadce1e84000000042d19f22b9f3e5ffdcac5e0eceaf334a5b57f4e5f1f8bfb74725a30d8b60c093ccb62a165534e031056e04afb7abda43aedbcfe66cfaafde7eb5218359e038dc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000dbd0d35ae2ef35c22cc313101ed3bc8afe9da694db26033e07e0b760c310858e000000000e80000000020000200000003644c695a13530b6a1e934ea2769e9efdd067d8e4e2735b6cc6c6b24aa0713759000000053c59b21123d679e027fab97c45441dbe0889fc97b8a83c37ebe5881f55a8c1f2a42bcd57efe5d5138a249d173b1d4188d0f4c750f86b7ed286b1c1a18b756c7a91be0abf03cc8d42bd9f9dcca41666f528f44ef145380c85e98ad2ac22c4ace231e02b633cc7dde96d5c96f436bca022bb05df167a15efac5d249daa3fc9a0e4f60c43212fcd509f50cf0a800a4d992400000001d3575158c6e8d560228d83631bc8b6779ba65a0b55de65e51f37a8ba4fd6b5b5d1725d9a6ad95c14fab0127fe3c50d2d5c55ca86ff0bed5b4d0eb4379bb786a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2392	2124	iexplore.exe	28
PID 2124 wrote to memory of 2392	2124	iexplore.exe	28
PID 2124 wrote to memory of 2392	2124	iexplore.exe	28
PID 2124 wrote to memory of 2392	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1dc6e0aa79d242839948baee499e270f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61bc6dfcef72472c687b90f13e4af6a7

SHA1
809a2f50d384f2ccd0a63adb098d2f1d4ee52f4a

SHA256
3019a47c48f02d08022f62493b1114b03a65f780801d9a206c764f2cf8be4f65

SHA512
93960f465964cc30b3653c177989e2c33eeb2bceb586fc73889c9841230fef370b8946f6197be336b364eaa944a3c7d382eb3448e9dca3e0f5f31f79bfe2f1f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e5ad9356eef56e0c1489900e27f38a6

SHA1
bbba9e4cc05ec500a35b89c11678224e33d28524

SHA256
1091bae804a99eef238d5b8bc3dc0c651945010b2d3140d109335fe5f9fa3aec

SHA512
13fdd9581a4cb938b8870383bd347eea63a43570385ca526ffd6fa72f309d68494583b94c4a71477ba5a3fad3457810600ccf681d38ed3b8d87aca434711285c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a75df29a24b514365b3d94b992c09cf0

SHA1
469ead0e8791e725a5f2e40050995b09839133a5

SHA256
ec78e3c8841e11a966844f3252d765c69e04e6d3e2b52a178bfee1ad9c42d4c9

SHA512
fffac3f70bb1f2eda092b3a650bf2b49b597dae6b6dcf80dc6a77111cbf5e839aba1ed2aa77138cd46e5ecc90bdccf767839ab32905b7b88b65dd4f7ea6ce0e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4e15537a4a6c011dab0fed918eb2ed6

SHA1
2ecf125abae164ce6b67ee5feaedb03baba02de9

SHA256
43a21bd469b2c1d5deab7ec5e504a6d048fccb8b6e6e36848d269fb8741fc2ab

SHA512
7f72e1153d1930c507cc6f4dd4e5cccdde0f3ba311b02adb639245aadfb10d5637ff2e34fde30c30d7f0b51869561261a1fa9ce71bc211bdf949b9c4f8f0c0d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
664b88ab7261bd79c26c2f26e49dec05

SHA1
da1fffe793837d4952dede56da4079117eca0995

SHA256
0d39aaa0d72e53cc9e0fa0cc64fb6b8ed93b2699af288d45f6dd5819c13e2513

SHA512
6a2885c4cce4ce9510b8aa999e62a2ecfcf1b24a4e481f47ed5b7ce9ce4c3788354dcc48eb28486f191f680e6ac5bc94b59e1b8fefcf21a27a07f9ade16fe9b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eac4ae3f5ce4c53085eae438b2be41fb

SHA1
88b33b8dd1d5d2ba554a398415569007b36647bb

SHA256
ddb483c04f9e2711b5c8737fe2900ae8d1322e4e4dca61c056a4210f348b5411

SHA512
c237ef9402896151f9cb18a0e51453fc347c11f7fb3f9804f19c245329219545c0ec1c9c49130dd9c41fa7c6f7ac48972b67b6337ed4d5df6c8e6a727c2e2c15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b07fe67a98855c13668af3a69d3e5511

SHA1
90ac10f5c1ac778dda4f359f41a64231b6362c67

SHA256
b00fc2ade52ff3a56c2aa26415adef206a554325ee8feb3b571d57ea65fed976

SHA512
a925b1109e3be6a3d907a7e39728aa80e864553a77a6f63607074c99c01b257b218a50cb54c418d770fae846e548670a0c8b86ce707a2794e454fe3066638266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae8769fdf62f1d2f8f381198e55dcb4

SHA1
d8725e5a2d6ccfa4471a8f48358f04d9df4318ac

SHA256
21e3586996f12983d77452a909ebb22c01c6c7a1ef2ba3d6ed8fb64caaa28a0e

SHA512
f809deee3d77b99c0531b3e744ca1d51cfcc977c98072278cd1493ce23e1d6cb33eb674895f8c92deb174ecda56d75466892241919826ebcf4f9ce552749098b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar94D6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit