d6a6bdd52d49cd619ab9a9a3db0583f9c16ad22989b7597e34c477a1d1646a9f

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f83c45b157a76b5070d1f5d3ac91c9e.html
Size

2KB
MD5

1f83c45b157a76b5070d1f5d3ac91c9e
SHA1

93900fd3336ad222806261c2b5cf3c1d51777726
SHA256

d6a6bdd52d49cd619ab9a9a3db0583f9c16ad22989b7597e34c477a1d1646a9f
SHA512

7b66231fd27bf482ef3b7dca5108eff526712471bab6e4f1dfcc16572705a5fc4bf873e7c2370cd1217ca3a22d0fa02a87812a58d039b6cdb49d037ceccaa77e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000007bf73abc027f2dc05301c51c3050d88a83c126bcb40823c60552f7b4b6089ede000000000e80000000020000200000000f010b4d9ed950f43c3d882c7c05cd1820fce26f32c997f1c438a57e4c1b38cc20000000f65befa89da41810ee8546d0ad74cc3501e02570de9fc4fadc1daf0db9728d3e400000002af501055a6c5007522f3a6a3435eb8d120fa4285d69699300f53fd2a0d659b15b6dfb8cd220202935eb58adea041f45041d145a1ae5e81982df7d69982bf616	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60dc719aa33cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410269476"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5E30B81-A896-11EE-9C0C-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ed74383c655391d374f5b8dc91bed25b5831c166eafbe18e8936661f38103395000000000e800000000200002000000069eed6d8f43cc9efbea34f1ef169e177b4b0beab1ac4339159d16fc8686ca70190000000168897ac5decee68d3655a083421a1f13e0b6c24e0eb4201a138228b330333bdd5a7fc83e501c3fd2946c33fd88ac10b84b93625ef1db2512cf563b2ef29e6a6d58ce210d8392de7240f4be44414bb487dd2db19f82eea05ebfece1236cb72f849953d8de0134030d497363252c404ac78a18e6c6d88fbaf53ee5812838899c5cfcfac95f95b628d1fe18b8950062251400000000e765373196dd585aa5e6cd980a7bbc0a37257755486a423d7caab7f789e4cfcc655c2880d72c2ae4a16a437a413b2639ad40beea4f9610a8cecbfbaeaba5e35	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2168	1652	iexplore.exe	28
PID 1652 wrote to memory of 2168	1652	iexplore.exe	28
PID 1652 wrote to memory of 2168	1652	iexplore.exe	28
PID 1652 wrote to memory of 2168	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f83c45b157a76b5070d1f5d3ac91c9e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c31a6079924670e8145043e685038cee

SHA1
bf278dba0c4e94f8eece859ee5b08d0babf334d4

SHA256
88bc9f16f49c67cc5690258c84a8e6dad0a99971990b57a0e7fc06c3d4293fab

SHA512
80768b264febf4dd1e6d0178d217f1bc1dd1429932a2f9cb1929364828c9bc01f55e490f5a1756237bc186ca3a9eb9e400e1700baf48bc008c4644138771d666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2753730332d6711d989a05fbd048a57

SHA1
0cd5e8adc64b145f52c51c14340c54e91cf55a7c

SHA256
97583504665341175c795cd81839343345807f8b92c5057e7219d5d046d775bc

SHA512
5dfb59ef62d5568982fb93c9b3fff90db679141c69f6021e9adf23276a47f28100e6b9ee49028a73e57e7f3ae337724e91a9a45ad59c9c83196372b4059d584c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc96a5d7f8891ba2350f58759204799d

SHA1
85c5cfe53ab0a4058c82c0864db3a0b2f024c163

SHA256
21311b21d82c9d47a347b5cf9444d07fd5fdfa92f42a4039218b2ac9119bf3b1

SHA512
3d82e5d296f040722e51f25d0cb3cf2d7db5534e4d7ce826139b793e0652fa313ef720516088d6e4caf0fd0fb231bf890ef3e79eafc995098661843049064614

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba7c8bb3eb5c90ce41d9efd5f47dfd5c

SHA1
58be2c550f4d37346ab220fd8b449a9a176daf1f

SHA256
fbfb07537074b26a61bd2224a19c18072ed3fc4b426be2fc72290c5bbe9e7943

SHA512
ed2ad0d7505c8d67f4ab4aa529974eeba3a9ede5875e47bcc6692697d3dbc643394564954f97d2389376039d4471ed838f5006b9ffdea48dd2962606cc43422c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccf6b26562868ada6c1db08ff3c20b59

SHA1
f6f4e222faa83b2eae378dfa77db8210f6222c6b

SHA256
f5235bfa4b88a978a2f7a15a160c25a20ea5e4f0a5ec84f0a751d945dea05dd2

SHA512
2fd008928c8fb02ad992fb5ef3d9b125b161f8d62934a01a809f76ac9018b3b4aac7294ead92f4b9cc9dc28c0f12b90e97f53a5d0a4d422a4081814256ed3cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f81ec9bad1b66c27ed8e221e2896f33

SHA1
ee7e9a7aaa89778d63eb291e943cfecc4be58abe

SHA256
c83a63f595353003393a02626df48eb201e8b2b0ca6dfa1edb48b233a2661865

SHA512
b94b97daf010936c93b5f80e7a620d7ad6c11c938be698ab998dd80d057f3169d9a86a6fcf27d50a16ffe9ca5748c17a53a18d0826d5e009705301e6dd361a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19498e9dec65da0782532b88ae69cb61

SHA1
0947356eb2ab7488b80448e3efd07163b0efda73

SHA256
dc81084c26fe804b7df278ef2fc196b730460cad292d89e6614a1809f50bad57

SHA512
588f1cb30eb8d1854c1248a762dc94c77eb83c36752ebc32d3559b5cf716089743458c437bddf9189793a6a9ac1db54193c6fb7e0f723a0ab952665848c1184c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d890186f2f3281a72d14d3ef52ced3a6

SHA1
9902394fcbfac5f44a4d5b1e954d04e4bcef8428

SHA256
37758f574cb597b2d35ebf24634fa4dbd0392c992a2b6aa6fd4dd15df4f749fa

SHA512
77766dfb5fc4d57b9bc9e70c54d81afd1be165bf89e5ade8523c441edcec9e4e191f7ff029ce4d951af48cd31d7cd38a3364014cde7e187955c0410b505cff37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a22bed8b5728a6a817c2966acd67ff5

SHA1
7aea752aa0d4eb23abfde4b965b2db4cd7543acb

SHA256
01d523084af52e9aca00339f3be9f164d73312aea758687bf663abd65e211d3b

SHA512
630e22cb50632a392bd07fc4eb07fb0aabc7f3ba2d875d62615d96d8cdbf08bc9bde11310ced23a69112c22e6a2750fc7e973d07bc03d3f7bbbe4f34e6265815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f11ce974e255ec2870162c51728637

SHA1
3e10bac1dcd92ca79ed452617738cecf84761bed

SHA256
33bf3fc5c047b8f25b09117bfb16beef0232360995b560835002998d7195a59d

SHA512
77a7dd8dd6a789235a23eaefe5836fd9c1e71276f50d6616d0c17d3328894f8c4aa16cfddf8d7adf9eb0a928e73c02d3d2a196dd15f736cd1dabc54d871b538e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ea3d499bc2c2a2ae0357ea5efc697a2

SHA1
adc2a9a0a3df241e32abfde8f378255a8ac34f1c

SHA256
c896fc478b12233943cbffdbd6721c7bf20092208999abce5c9168e2db29c075

SHA512
57c3cdc7920b947f48d5dfc172949cbbec3eb1cd53e6066ddc823cf7749b9d0d3f1efe7456f9c33cc7dc2d46e1655d915bf588b5aab99323cfa2c86c66a0be01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3361.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3421.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit