fa080b71b6675ecb247ef54d950cc8f83b4b1c0239fabc98ccc5451e7ca06f2b

Analysis

max time kernel
118s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f525bb55bfad90cab9ec3945f5ea8f3.html
Size

2KB
MD5

1f525bb55bfad90cab9ec3945f5ea8f3
SHA1

3aa99607b1dfa53eb884841b4f350be87d1b653e
SHA256

fa080b71b6675ecb247ef54d950cc8f83b4b1c0239fabc98ccc5451e7ca06f2b
SHA512

51b55494d9f1a2b171d88dcc121c995d3fa66ebb1b62bdb3d0abf15b6c0125cb4ca3f2bcd3bc75868cd211b2d24f1577866b1befad8e3eead416d442d0b6904f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6083ff263f3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000cf16c6391459ee77566e8060d217e706478f18b27a5cc50b3de4aa69cb10bcc0000000000e8000000002000020000000aa63b56774328b511ae29c9e1190177a73ad1594d0aba82b9532e2861ead3c94200000004115dc880112b3a586c170c399cbb3511398414cac105692a91472eb919984b7400000002c5b7d1ae94bfb2b9ae8add824c997c3cf4e3e6768c5b3c1bfed461b8c3cd756b7a61a3a8f76b040bb6b6b255e1604de2acb7439f75b2acc9874cfcd44ced4fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5254A6D1-AB32-11EE-A586-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000088582f5331347f3577b2e88445c3157d97635d7fa919bb5c2f9bb67c65e197d9000000000e80000000020000200000005ed620693e2df03b4ce5e91742983c37cda367c75a64b7558dc279a6d35092bd900000009fef4801c8c75f734f89e7d421f58c2781736e46a8a4a20656b4bb908d8d68fb2185d257268c057abf307c3f43dbee9ddd16d943075487b9d0aac8f47345078d3b53b8cf49ad1d8011745b01d71305f208c4535eada4e0f160abf0b416e7676793ed1fc1ca4069f0e7d90235ccc810d6f673dc2e7361d0033ad32bac304ad358db206e68089edae5801f5cd537c876f4400000008dbfb01bfc5d589133c77480c865d8f561f9b8c6ee556da5d6e1748859a3eba234db7eddf7c28b0a4d63d66916b18b7dcd46095506863e48d16f3762d94c3e37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410556189"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2304	2336	iexplore.exe	19
PID 2336 wrote to memory of 2304	2336	iexplore.exe	19
PID 2336 wrote to memory of 2304	2336	iexplore.exe	19
PID 2336 wrote to memory of 2304	2336	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f525bb55bfad90cab9ec3945f5ea8f3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2b347111186c7d759a31ca6795a166a

SHA1
c6d57714775bdda5fec4d93a250b81ee6d31fb6e

SHA256
0503f62a0e26ffe4c10f424aa7201134e1ff4c1365eea3bbc1078afada648172

SHA512
f2cece89fcc992ef7257c48797d33011e22bb034316a256a8415933e8f1f1341bd9214533c5299fac6635854612ad22d87fa8c4a5b7413dcd94337853d8c01b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d1294b394b9e9c59acb438476f7956f

SHA1
bb2c6a2c822a32be8a60392be3ff912bee3b75d9

SHA256
a1d40b7c30900308afbd13b46e0d43ded114c06bc4c493ae0089af7aaf5fee80

SHA512
e686192a15e6c5ec7764d88db73906acfca20dbfbfe080fb1c64fcba6e820670048ddc6dc6d28ed44371ff7182e0c575b456f969bd3a2eac5b1deac137b0bb8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37e9de18281aa93ee976c8ed1152f1fd

SHA1
61cfaaaf7eca59b6bde5fd03fc5da057b8569edc

SHA256
be3f8a1ae362957c6e3b447c7ebac532c2fee9ad380dafe4c097be8adfaba637

SHA512
d89f5e4bc1d8fa363d481949dc9e6ae803f72d65f7fed7b3b44b4647d8525f709616446bc6ab3ffd1fcbaba03d4d41c17f9697476f38e1b206e6f660893c049a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8ce81f189df1aae4766ec121479d91f

SHA1
26506a05dd2d638a7770bc63fb24a576b715fdcf

SHA256
85fa16792e2fa4594e4c15a19c1078977a6ec62e930227f7c35ca293a43ed858

SHA512
75a0602b7022d07e05dc1701109ed2612d48307e440b81edf87fcd831c009b76749e38b66c682268e62e9914c2f7d068a8456438987bd6948b16a5ffc7ad434e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e61ca412454f13560ccbcf9564c21d2

SHA1
40259f53bfcf1e5fe29f0bae8027757bbffaa456

SHA256
0ff0ac1752701e5d8d784108d9818c12799959d1e20a89016c0072cbdf511b1a

SHA512
0a36446c3b2bd2d0845803e3b40df271b1936260f1eff7a8eeac343969e5f4a759c27bdfda5a5e8d7bee12010e224c18075499b607128a8a8e290317d77b6324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9454071eff54de9e397ac611b894e56

SHA1
81d2f640b89da2a55577f28b98ec94e31a0aa5c1

SHA256
e424dbd6b61040ddfd787bc27c9349230f4e5c769f8aba860d037d6a7b52968d

SHA512
1e1925c7cc7b4eff5f7fe8dc9246d6b0f271df0df613b2a7787fc5d939b0b8413bc717336a7c2700ff3ea87972e2572baa03e926bebc0f05ab7fecd0b242ccfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1aee897599194224f68486f006b3d29

SHA1
cbdad11d8d3c436c2db590f7f9b9208bde50d56f

SHA256
60425883311bb82d1343da8908391d09e17745436ef4c7ffb38caca877cdccab

SHA512
99b2120f593da5b664d7ee8d44575fe4a1ce628d886d17852f631a4483966c4f8a4be8e40654b3eabf4a94d81485c669e872e622db4c095c2412d10c9f2d9ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BFA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E1F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit