56970b408e8c9899df9265288724c95baa49dbb8dcd6b3f5fb91cb8592d581d3

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20497143446ba0e3d3b1ab4f737cd8f6.html
Size

430B
MD5

20497143446ba0e3d3b1ab4f737cd8f6
SHA1

a75462b4b423f0c483786494487f86c03c11e40f
SHA256

56970b408e8c9899df9265288724c95baa49dbb8dcd6b3f5fb91cb8592d581d3
SHA512

343d3daf6fe856fe3af81866494360c63661b448d5fd8265ef30344ad312ba6988b29d72930f6adb5dff55e477d26c68f0a6e55d5e1b074e6509b702830d36ff

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410275183"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000032165894b87a9302ac001f847d6f096dcf608d70b2be7064947ed08367dcb27c000000000e80000000020000200000002121a7afdb3898e4841dd9186ec93293907438a25fc61f5fe29c047acb1204aa90000000611dd27b6f39bca7f445a6664ddd62208ece074ad6ed7d1681d1db3c2acd38c95393f1672dc59f72658020ace4d48edafc58353cec2c6335d3fd05b901fedb3182d5a88037fa0caae726ae64553d9c97b0c46238b6b7e7012455ec0061c21b8d22c999c64b554e073c5b3e98b9d701e6c63567d1b9b7cdc11e9c5ff653b37ebbf74cf32b0a4bfdc1e7197a72ebd0099c4000000055a267c78aec8a1941c81ac0f2fc2fc40fc73a45dc15bf0864071cb3990adf6792afa5692277b4b496193ae2860b1982e736fbed09c24958dda2b120e6141142	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10AE0901-A8A4-11EE-834F-6AA5205CD920} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000092efb062b5711a7bd4be860a8185e6bcbd0cfa04c22bb57b55a7d17e7f79e408000000000e80000000020000200000007b62755b4d2399f799014e1dd59b3e97e99077be18f6295ef775ac7408c6419920000000ab37750d108583effdd1ce947a73cd06c4c8e1802ad8ca381bc0cfe217f653514000000093fefad3cd92ccf28f23a35d0ff2457f7bbe2ba2859d3e2eda7b8314c22fcca4cc8636e73f91c9d79ac32fb552f938243e807d748c3a2012609acc4fe050c2cf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40466ae1b03cda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3008	2964	iexplore.exe	17
PID 2964 wrote to memory of 3008	2964	iexplore.exe	17
PID 2964 wrote to memory of 3008	2964	iexplore.exe	17
PID 2964 wrote to memory of 3008	2964	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20497143446ba0e3d3b1ab4f737cd8f6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7a33a6d3fd5e46976c5098f22ab117

SHA1
460825c9890fcb40c94ca2a0ba8a355d67ff8ed6

SHA256
fa19a4c253c77c9c6204bb81475cbd1c3e9088841431667531d9652d7743b983

SHA512
335652f25a5cd01148af8799fbca6789755cd557f59f7d13543400dc0e7c1f3a715ff12fcdd7f91d37a5e6545b9043c793d4272405deffa326762ed2f055bbe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d3d905362aae6af064ab85c597d05b2

SHA1
8a5df1e90f788dd681035018c77bd02253d59aa7

SHA256
ffc2ac0afe1e55dbc920f76c8ac5333041dee986799a52cec5ca79a5122fd8c4

SHA512
bc5fd8f1016840292ff7c2b0751b98cb0adbddc661f234c0ce1a1d0420b231854648267cebf585ce3c0702f8c042d84e1cddc51dcda970644c4f61eb9b97fc4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e9fe477cfbf54a9b2fb6ebb1a98afdd

SHA1
d3f32f758904838f9c60a1166ea4947c4d52e992

SHA256
6b6ddce2b0514b8a306abdafb28aeb79f524bb5adb601ea5b6592bc960acd06d

SHA512
f3fa01852f4ded621d257aaf98c645a1bde7d20d00884a339ae464d7e856794d04630d3c0c60ad96ce9f948f524be92fb1c5e0d77f17ffc4cb584d43e3ddac4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71e96517e9867e36b508cb09a5b538f0

SHA1
1140dd392687cb1d5599ebc32f7ee1addf46ccb3

SHA256
3f5e5aa06e2ee6cf1b579fe40b4f32087704230aa0124f67d3762fb25bd32ec3

SHA512
d209efc49734f155522af345c2dc756c0ec457e83fe13e99d65b86e49c552bf4f3b8e16774e7c7e5cba7aa5a445e02b1cf92f0927b76badf8a93bb7d53416227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbb44e9831c4e2827cb70d3c5eea7a53

SHA1
66305c6b3757462936fbf39a2c1016e575be1c22

SHA256
9fe068eeef21740c4732ade4b115f921a8d3e0b18a98021aa8667423dcea752c

SHA512
61fad7c90bfd31e62a3befa83f77577628ab3110315609e4d6f76d0a26a2f052efa37a75fcca1fd8093960f4a1f650f2e5685643a0a62a4956b8641e2a21a3b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b49b98115f4cc8349beed70d8fbff61

SHA1
1cebfcc7809a38282c909c68f563643ef38d3d3f

SHA256
235527b7b385d1d88462fbd980d59a01cd16fb90557a4249a1c27bdc4ab2c1d0

SHA512
ca77806511c4eefe8e0c8425e365c4f1ef47ad9c13ae3da480a732238808aa60261b52951ae053f3802a14922fa78f56540434beaa25c7cd596f8e4ea41499e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2246911832c34f83372cd297f071d5

SHA1
dafe4376ce5bd0990e6ebcfd6afcaa0f1113988f

SHA256
cb147d496620befeb9f9f35423b2a93a0e0c54dd82c99432517c64d6346cb40f

SHA512
bd1f58ea5b9aad0a01f4f839eba395a55a93ab16b59fd25723ecb082694292d3510045bbb95a12624236e211eda5a314ac2908d305ec91ef319e72d454b152f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a5f8884c9d991137b4e00a3ab75524d

SHA1
d8b82527f190a58e955c6e96aae8c14508ef62d3

SHA256
4d9df1afb7ecff4f736a8237031e02ce3840524941f40f190174b0824c18cf48

SHA512
e3c44d2b41e44dcd2faa1c3a697e850e9e63cf41233f2bc3ea9739f924f91f5ff87a7dac061613e64e6779f11d823662573f0b410adf45c1cc31f9e1c246fc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n7bgnbu\imagestore.dat

Filesize
1KB

MD5
0a0324216ae8dc1d6be9f9fa47f279db

SHA1
e7135839406a972be9e15e9b0532520cc3cb59d2

SHA256
6eac392b56f86101e456088faa0f415800e30db3e22f5ed67aa78a5184411a62

SHA512
bee6a22ac2b35a5e0a2bf683c3256f162c4f3cfed21fb349ff8f409cc7e87c0235767c2a81b69022319a894278e22655e22b3754fa537ab35a610842bc13ec00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I5X8VMX8\favicon[2].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit