47e7a40100604736c4def576c245eab3aef23505688deff485512de0956b2266

Analysis

max time kernel
122s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ea59c9dc3131534576febd775d597bc.html
Size

3KB
MD5

1ea59c9dc3131534576febd775d597bc
SHA1

a2d3c59e58207a380a54caba492f2b4ba2e6f9fe
SHA256

47e7a40100604736c4def576c245eab3aef23505688deff485512de0956b2266
SHA512

4f898e37be5d84f83f80a51458fc02ace7e3ac13bebb7f3311753a498af6ecc685b120e14822399d23795e208a3b3629524f8f59978ce47bdc6766d25c18d441

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000db4c5566e0d32258f26b77b524205b620b7cd9e8638f4a5c80c39a86c97c2ab6000000000e8000000002000020000000743f7098720831fbdf370eb9f1e386fbbb743b3086da5579ca54952fd3d210b090000000851cbdc00cc134cacdd0cecf01a12eeef99804b92537d472213951ecd37369af17ec193ba945d71ac7e9bd695a465094450880358a2c090ac58b6f1814790221c858f4b1b6dd671ff55ab5e1d3c37f8bce5b3f48fde77af908b3987cfa4f836312de8073cf99a212db5c2613b77bdd071e459239a78e42de92a9ae08d0f24a05d56928730a4567e476a90aa2402b237b40000000167c20c4c8e12c43c80120d6db06bab505da3100a045ea2b65d7d19d19a39f614d26e7dc2cbf209826f7a68f4a9f42b94f77afe0153d28d8bb70b98614575625	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7F95301-AB27-11EE-B6E5-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410551659"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000cc97c5ff72667e64a0f3a4604440a197355bba2af6437301520697f5f81f6564000000000e8000000002000020000000f1211004b399a149e8407c274baf38ad4de4452889804d18d9e48b0915b5486520000000bead87ebf92e1176ccbd3f75119d3f18c1bbad70d5ad274d6c54da55e991583f40000000bf33ea1fdc5672fdac1838be59f50b37a9f1ab7de3d84af01c5e1d1420a71292842c165a160041cf464371fb534b8b9f8e5f05243ff1adc623140493b71c8c98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501bb19d343fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2124	2184	iexplore.exe	28
PID 2184 wrote to memory of 2124	2184	iexplore.exe	28
PID 2184 wrote to memory of 2124	2184	iexplore.exe	28
PID 2184 wrote to memory of 2124	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ea59c9dc3131534576febd775d597bc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69defec03a9affbd7d3a19680d669a84

SHA1
dd3a935a77895f3ab4fe06f9b13b652e15253df7

SHA256
3a49dc07b90e683797a46b0ad7d6589c70a549360fd9944a847f1e26ab88299c

SHA512
d7cdfca0f5294794f5842e331245a3ef712e43b2c300e7361c2fb71437a44f7b424d809146afa193a1075956f4211884f58045b05b03c860a548402ec6b031ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
601b4201ef5bece542c943ced282ea82

SHA1
06320f31b168ad9d8ddfa856f97a2b00baceae8e

SHA256
59110edd7e8ab3ce32abf8fac17622d4fe892d49f2c27caa4671967f0f2ebe13

SHA512
2350d1bfa63a5e52c2a1e6a40e3da9519a41f771191b08bc4496e5ee779d28f89e9bac63a6e5b62dedd4398d04ed974669d6e1201b4db6de514f290056dc767d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3759f30296d135b5b926f0ecbde61ea8

SHA1
d66770427ca44f54472110016cd87e0901250657

SHA256
647545b2b72e10bbedd2220032a973fb92dde5a3a52d4982fee38b6a33fc1e71

SHA512
7135c7dc65c71e92ade6aa54832da9d12edeefb0f5513724db25879f5539e6fe80375ce2053627222753856934cb2d244c797762126253649b82231bbeee0238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e60bcc7562a243a6f782344dbc13b5ff

SHA1
58d81ed14549bff1de4a1de558db242eeff80c5d

SHA256
32876a770a5181dfd475bd9a9382b56325d7c6d7555d73686ac0490f554ac735

SHA512
ea5362e0056d423e4e4d7f86ddb5440b5691cd6aea84cf88a57cb97c00ebe80062ec1446ea54e53677f13fff98a74ae1ed417ffca45653706ae1df7e90b53ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe75b7f6b372f6f788733906ff8e286

SHA1
65d60b2270bc119cfaee2f6b5bd350df06a2e3b4

SHA256
72ad11d63cf361715a18c02d7fdec7bf4541050a804308d74fbd0fee9c3ea0c8

SHA512
1ae6393c8c19643b91a6692055d348185e88cfff6ffb72a09c303a9e31444d1da3027eef335e7bb637ad77609696255f83c80b3f5d3f0494e425e3094de7e57b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dae30fe94e8831ab82e6ca345147739

SHA1
e5fd5c4364e5e6946e971873bdb42398c18c6a64

SHA256
e8c3daf58df655ca3e838229ddc5d65e3bb09450283997c333e258207e3aa031

SHA512
66b9344581e30f24cc27b1f57d9fdb3f39ba31ef27f141c0b4c64da33f2ae5594901529b5c9482fc9c8816221d41d2220c034871de78305ff16cbef3bb59df3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc3abd484017a689e793404d8ace7683

SHA1
3f9dfa934c52b3b91c30801526c00570ba5e603d

SHA256
dd17de1ec1024905864f60df096fa66b66d5360ce1f3ed1a28e569ffedec5fdc

SHA512
99a7082163a633568aaa16d8ff6f06363f0ec43b7af477844f4cff9648746743d18395b962a8bc1ab784f5e025ef949794c91548c9bfbf68de29788cc0d9ee67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3cde5a96465068054cb36f4e2379599

SHA1
9e53bf94a00d0313c47730424d9103e5f31a10a5

SHA256
daee41af2d34cb7ee2ccb652061b8ae9d124038e7873c7045cabdfadf16f8539

SHA512
098f9e6b3f1fea4f6cb84a0af2d3f457f2966b307f53f2e01eca952a5f8336f3ffe3affcc468e9aa8590ccda385400932271c6001dca21c178d1eadb6312d4a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91b2afd7aba338d50e891a890da21f5f

SHA1
5ac64a4fc366eee84773e2a979a6e77707ea827c

SHA256
c996a1505da961ea3157b42254604a5f31718eb325c189451a72852207174411

SHA512
e498818216ee0f37be6651640d50b928809ad5e34c36af3ebca4d2c0ccbd61b498fee1c92c839ae6488d7ef4df531781e73798030f54799771bfa4ba48cfa629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24b779decb3fb44ebff159d3db1fc6c5

SHA1
15cdf057236728a86ae40366170d9c3fc7fe2308

SHA256
ab0b5a0b54b969910e6d4f5bcc5d5ca73c147dabea5dbc3de3c6225f7b9e1657

SHA512
78abc8ef305ffa991e3a8df134c0bff958d06821a0d51d07a9011b1bebe93f1b7749cadfcec09d93b62e2dd49211a66f29a27dfd0fc11e4ff8118330cc69a240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307a3f8ed4b3ed8fe278bfc66087152b

SHA1
f7beeb9d68011de1070b7e122601fa62ea6feecd

SHA256
ac1bf64778cef5f893a3d40921d817e46880d3ec0fba37366bbb9143b64f3aae

SHA512
1d5302c5b50492b06b27becb100da3de6a782d649af381406a083010cf577675c4de7c3eccfde27b8a342b33a71b7495ec96df8fe9ec61be0486d2777dc157dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9188.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar963D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit