42c4a7031daef86c555d454edd0106a148c7aad5c6d6a8d85dcfa2ebf0184a07

Analysis

max time kernel
119s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ee4b4cbfdb7626424889ad5764401c2.html
Size

3KB
MD5

1ee4b4cbfdb7626424889ad5764401c2
SHA1

8daa9ec86a4a0da498fc6155a6b250be28ff628e
SHA256

42c4a7031daef86c555d454edd0106a148c7aad5c6d6a8d85dcfa2ebf0184a07
SHA512

42745f39e94fe9813b94f5fe6913ff8d243906b41b085e36d21edc91c4479de5806247ef8b4c56a73e461095abc02c608380d673ea0bd138ddb98c581bb0a8d7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600e2264983cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000ba61d059b6dadec6a350bc96043402fdc6734de50b9c08444171e15c64bd24d0000000000e800000000200002000000057e7de70ee0f0261ebea45b8239c959b1a4b8d8f8f33d889faf841023c93e92920000000bc1d915898ba5e8a8b50f3961bf4491a1c7a09cc30e96b7908e52e9bc56082d9400000006674a882c2039d7e315e47d80ce3ba7e415913af29e8bb1439fdd7766fa40f7282fba06599cce66ef0f07d2e2536e6f0ab5a79484b9e80180259021a1491f78b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F23E1B1-A88B-11EE-9324-DED0D00124D2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000787e7120602b18cd266ec074d812f88b4189134c883e640a0d562738f494d13c000000000e800000000200002000000092b0ea1cf3db5dd5d9ed19d87d118f369114ad6fe7e9776ac22a32eba4893b6790000000d68337b5dcbe234cea9705ece4df23b58ee59f279edb7f9e16d47e29b021dccdd078dd015e9133cd392ef807dff63fc68898d1cb5e6bb5eb8114c3f355d6769b0fd09b0e4371c913e0c11d08bb24b832396cd681e4096c31d3b7e932411465df34965dda364cad78c6ece440080dd020ac3d9cf925f1b4d3a475a598c6c7292f5549a57689bbec5d1507c8bb4490e7784000000044444eb3b58e2f6a5fc44cd501349e45d8170e213b06d8afbc243dbc207f3a6cf0b85c12a5ed8b6bd76e170400ef11e35cb7042bcefbf7013fbe26666f472745	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410264671"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1204	iexplore.exe
1204	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2376	1204	iexplore.exe	28
PID 1204 wrote to memory of 2376	1204	iexplore.exe	28
PID 1204 wrote to memory of 2376	1204	iexplore.exe	28
PID 1204 wrote to memory of 2376	1204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ee4b4cbfdb7626424889ad5764401c2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdd219345031e999e6b3acaed066569a

SHA1
410232847758f5c0213d2842d849a607a810a464

SHA256
7666c8f9f7a3a9dae13a7bedf38e1a51e01afadbafb3423c24c3a2e84ff6ac3a

SHA512
df85e20fdea56268ffd2d19b1d7a5b1950637f5b070beb4fcd2260f1578b9513697b9f9262f8da4dbe1cc8195e42961788f152796babdc6ab9e51f602da4ee3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fef07b56b38e72eb90b8b4149f48789

SHA1
e3647241cba795cb7f44e0b2477a0342d9bffbf4

SHA256
a7dfc6ae8aa4fa5c3b178aa03b084896ea49decb1a6f4ad6ae6696014ce14f4a

SHA512
ebc82baef1f7a282e372c9d5dd92dcb94b9dce8f455bc60dc538140693be10ea6e0703c6f62e155c2c2a70dbbd861e5a48dd1a1c202ba5e05243f99ce91c3f12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3de19b2e2b927d5ac1789b9f7544220e

SHA1
9b1b56ae7d07e2b78ffd2884617c066a63a1005b

SHA256
6b294bd989f5af363238370e52bf377c657cf16ffda82435a5a8461f07cbee8e

SHA512
2d0f8a927fcc81765abf137159a0c8d74feab5a0fac3221a2ff9ada5a06ad6462e31ad50c8c6263c71fef7b4359621e9d08f48051772439195047d9828c08594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca03a75a06a5e2725ffefab377837e16

SHA1
0a0ea45c83c44833abd6302f362fcde9beb74127

SHA256
da15b735bd98d5d9a7c734d47e68da9e565a87c5f6d8181be3d1b453e3080a7b

SHA512
9ef44ea34aded02ea1a795cf549786298fa3396909188e7325a804910d6da4811178a5c796848674ff01c5a22b10f277f1794ccf7223fe938af33e9338abba3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ffaa03173223bbbd7c5d2109a6d933c

SHA1
6b7dfff83f319fab296787296268715e01fdf07e

SHA256
a33b02e4a4921a96ec7aa6bae404af1e117aa4f5cc70e478a04f1b40eadb19f7

SHA512
1fe7276d6f6b27e95f4390351fad0ed44221b531efe1176d40cc74fd0e7d5553079af43e9a0f84f97fbe124655031c2222599b8f110f3f9cf5e6ca6274c0b81d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7d661cbf04bb4667949ac3ee1de7dd9

SHA1
8dd8915cf496117f457d62ec898a3b77363028c8

SHA256
b56f649a54da19f35f1c97cd846321de22cbad45981d681c5057020dd601f8cc

SHA512
de403aa6013b11891004937de8f4d6409ab3bb3123f13c9367687b206cecccc04439263d78f3f819d4459647f67c877d00cbf7c5b35422df017a626fe9b9a081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faa4d2159b98ec932f72982667dc2ea2

SHA1
eacd9e14a6ce22b2aea68334506e94af5dfb7a48

SHA256
b3c2da3dc932fd233a95e19f1f3e898f299e753a1e2b7bd0a844c4680aff5d48

SHA512
38b397c27f85208202f76f4c68953f1ab9089c92c0bf9512202f466179671ef61de16fcacc38250d0d0c90cdd3cb1eb38c508619938d955f1b4fad040c734b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10e28b444346ccbf174a032884f197dc

SHA1
161308ee14b2319fa9b6e0df6d4e7810ac9fe55c

SHA256
6324de44e99f4949103b967f5625da86c73b0ca14e4bf6eb675d0e91a1f1e04b

SHA512
a3941319bcbda5595d99cf4965b34ab33964623bfebaf8dc0fe779f742c3d01e506fbcd3b486d14a7c20496462ee96e9e667f3b40e2a3f4d1b1cc2c9bc5ea056

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab650B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6ED0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit