30494f823e4082330a83f4f825bd1b44449aebafa817b5a21b739f4509dbc8b5

Analysis

max time kernel
119s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

201472d655a8cf10effb4c4b6bfe1454.html
Size

3KB
MD5

201472d655a8cf10effb4c4b6bfe1454
SHA1

f7868f0acf8dbb3c87f83c317badc7654188a000
SHA256

30494f823e4082330a83f4f825bd1b44449aebafa817b5a21b739f4509dbc8b5
SHA512

37fe17b3a054c536cf5aafc1594f5381e0542f6a8423414354348e101ac04ec4132939732b2cdd137961113b7cccc82b698fcfd3d34be5d3c872a995030d4efa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c8d5e681c5a4e7fcaee86bf8146dcc6fa56e108aba79f545a20edbe6ed97a4bf000000000e8000000002000020000000596f6d60a37551275e3772904ba1c25143b069eca8eaa8a8588fe89b81d564bd9000000014273eb3bc31896f9f482689019fa90c2058df264b386987af441ddd194635cf6f1ecfa85d50f6fe1a08f41566f047d6c67ed53cbcfd383444e263115817036b5f06c68c1f705ee0e26d0f20a00db911e374a982e9d5301d62c77133a780ea6d3fca3c56bd9cb941fd6878f5bc2b2013ec7f969bbe3f78a878cc7d20abb9b5153552e0850382d44e244b030e98a17adb40000000ffbab42a67cd7305910bcc191cdd9292e52815c62d727da792d0c3f411f1df4f6052c34de46ca5bf81f1f860aef6db60972870e60a823ec2758eeb2859ccff52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AACCE11-A8A0-11EE-AB4A-D6882E0F4692} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c334de82da4ecdf74720dec17e2e6668a38e17137d9fc56d7bc0abc3a0e66f75000000000e8000000002000020000000b874ce3e5e76c70b712ce37dae3f537f2286faba51bc09d82c28a9914947c462200000002b3f019572aaa6320a766b06c299edee3612f23f7c3fdf27d3874de2d2207c2e400000000ed6f493d655d9aa394608fc0d3232360dfaf8d49e362a1cbc988298fd941127449502e5f7f8f23d51f07e8518cfcd08a5d0d36187a60f3f08f3a50007ca866c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a058e17dad3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410273694"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1732	2088	iexplore.exe	16
PID 2088 wrote to memory of 1732	2088	iexplore.exe	16
PID 2088 wrote to memory of 1732	2088	iexplore.exe	16
PID 2088 wrote to memory of 1732	2088	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\201472d655a8cf10effb4c4b6bfe1454.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a092691fc59f4f74f9c5544f954d3e66

SHA1
21ca90a1cb9a1d2e15788454c5e2e20b642957b4

SHA256
868e221462687a720342f9ce24c40be3a283db674aae371bf6fd87feaf007b28

SHA512
2453fbaef3c053c74f5cc357dd1a21bae8a6960c3096d7ebf75c174b0c03f9927a5290a6c1d93ed5c3a991b8d59e2536888858c1e85d2ddde48edef6963acacf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aefab16f47610692e153a852791a17d

SHA1
ce5c49747a8178ff85f198989c507f9c4ff08f12

SHA256
be17695939b8c6e672084612c7620f2d240b7ddec661c79fdf8d95ea0cbedea5

SHA512
29e58a60c7a7e644445c1a77bb9164f1599f6a5b0ab8166883ec331c2512e3e27d84c7c0d63cce84191c123acc0c0fd8474bbf22ac38336f1efc8b819bd49c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbde37849cb771c689fbe79e87f57f0c

SHA1
8bb57e18bfcab17a5699602991d997709b5d2aa4

SHA256
946b3c7b496a7df6aa585da6a08aec828b98aa77ebfe4f41b56dd2c87e296511

SHA512
c6c7d0e128f7fb4b43701570ed3fd5eb13e6e5f113984e8e72b96d7629a489669c20331ce5b7163cba9213ffa08fef14d98fb9fda393ef1e19e73abda743c440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd3fdc8d9cc4463e2d8842088f14d416

SHA1
c72ab4d85e52cc1b38ec48af0c5603161a2e15e9

SHA256
fac7c54e58b38fea01e23100d39f9637f93e96b915df4473f17fd94be219bed7

SHA512
b440d0677e52e9988b39b4533247e278c38bb9fffa7342ef31f7afd3625742657a72725ff104b9035b8d18fd5a9fa4fbf1301460743f4a24bb58ad3a08b0fb88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6518f3682ec425a93215647f7aa48b15

SHA1
33cb5c25995a1d58f60ab03304940bcedf3ec74c

SHA256
d110e6d001ae35045b20e4005c800e06748cd1559057e2e8d344f6ea718f85e0

SHA512
facb822d14604bc332b8bb752103d96878376011e7dc40390a416260007fcd299b22033a4c37ade1a8feb958a3e29376b7241b4aabdaed9a6e1e75dbee44238b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7c44e71b4fbe82033c33d001aef0785

SHA1
d9e37082174a81645369e6ae25d356bb084c0af2

SHA256
a4431e553415f9730fa2ea135b32aba9d8879074a1aef9859a1053ce427c77bd

SHA512
3d069abd73583fb78c9f70a66859f2ca7828d6de666c5624e5afd279313372e036c16de10e08b5b080c8e2a3e1ef074b45bfc10f82e37d2a487a53cd244de7e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2894da9882e4f58dba68c452da28d33

SHA1
102ab7db93b0ddda8c9c970f941b10b6845704ac

SHA256
c0fdbbcf3fec4a2728f2b7d16bbc764be7bb01b5621aee2fcf1184ba2bb5ead9

SHA512
e05508c059036239649b8cd381b616c1f878cbc72e1c0bbb9ca748fbe9afb73df91f9894db4a15621459a1337b7841ade5ae1b3273b32b49f5cc0f2c4dfc27ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c011105777368675ad18a274520de3e

SHA1
8fa9060bb75bcf7b093db48ee19c2f584b41e02c

SHA256
9c31cc7c7f32227c0d3e528c32e14f03b2fca6ed2329bd23951ae48e64a905a8

SHA512
4d95fedde016c8cafe96803f721f541723dbb3de551dece84dd6aca8a061443c19fe2414a6fcb5c73353f3bb28410a0cf42c602ad89adccf90d596a081709a8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
965c87e16ad83217995917b97b685a29

SHA1
f264c583528fc2e0ff9e607fa80f53d3c84d10e2

SHA256
042596dd67e906c8a73292ee609e232450911a4f20f4763e90d8dec2c7aedd58

SHA512
48d63c2fc5071bc1dbd22de729e842421d30f83c6d7a9f09674ea2aecb7b55ef0c7c083b141835317718df958d1b566d7f34225d0d2088accd338b4454ff62f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF51A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1922.tmp

Filesize
115KB

MD5
26e1af71823e1da037166903e1b7837d

SHA1
6166909f4ea333483be6ddf72f051759e6352aef

SHA256
2693b3a30d1e8dda07fa1199b90dde7577323dd0f3a4d69cd62492cec5d150da

SHA512
7574b66f7c485ad44ea9c4da532f68da380fd69d12d21ee210b07334276dc322af206939f46837fad28f78494b6f0e325644cfded65b924f82f9af43f7b34db1

Download Submit