1ceee325b5188ef2b200f12a8f06427ceee5b29948310767e8af8ff252ed9bc8

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0865ef0282b955d9c6b0a266f25654d1.html
Size

1KB
MD5

0865ef0282b955d9c6b0a266f25654d1
SHA1

63ca74407ed670a4f28de7d874bb11188af4eb14
SHA256

1ceee325b5188ef2b200f12a8f06427ceee5b29948310767e8af8ff252ed9bc8
SHA512

07dd995f2b47d3ae80d06742e3e34f939177c614d4a1b8fbf313dbd780c8333763f0b66bb874493232475a47f93b18aeaf40d36c8ab7cce6b0c5c30ba66bebb3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c4d587d4ec8ea909a412d296d29592959895d0be05fe330d12062bf069ce36c0000000000e80000000020000200000001836e677fafeabecc2a7c17f8ecb93813b22c668da490211294217e2b5a524c6900000001f96bae2bede384241606d4a37d357293c08f7f44d17f43f3b1e55a3b84e4b5e1a0d1d5a3c9334eacb3b6c039e262a300eb2af7e0aca593c234128b7dfc05b199fa1b2f6455c7c23166ba6ada3229f56dd8b8df38b3bc284453f70208cf3014d8de506d0bf16e9c8ecc699097d38ce4bdaec4509b50381ebe6b5434d05752d58751374e8d02764f6b8097a514ad2286940000000f9c3484262f0594b999adcc46e118f24a5a0dabe3e2e731c7a4930be4133273c10fd2aa52e00a64a518793513f9e862ec0e1c36ac189bffafea21897c0577a85	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410093202"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000807cffca28bea046cf7af4148b9a7d543af48f4e780387ecc56049bc8a62437e000000000e8000000002000020000000d29732ea45a3fedbce4037f8de0ab736a2f993c034ef3eb329194c9ca99c6a4a2000000076883c4f86dc52b766a0f418e13bcbd336d01b08e14628c2d689d0937d343aef40000000f54812442734fb1adbb3b00471305381b477b3ae6d9ec1becb41a766efe2a23955dcda59dd2076c943eee2884ff1a28520f85348592cc247171be0ba88dbcefe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d5f531093bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CE10BF1-A6FC-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2700	2336	iexplore.exe	28
PID 2336 wrote to memory of 2700	2336	iexplore.exe	28
PID 2336 wrote to memory of 2700	2336	iexplore.exe	28
PID 2336 wrote to memory of 2700	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0865ef0282b955d9c6b0a266f25654d1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1f61e758473f39d60669a477e2c06cc

SHA1
c3c01d1383338ea839311f0b898841402501feb8

SHA256
33a92044b01232f0c2d50abeb64fe638706a73b45cca91ada6de5e05a4cc8b50

SHA512
0f2ee98c3a59800b46a17f687f5258cb729c1b20a3af916fd5a41902b916f1339a7ba99ae8faca2d79cb04269564afa5d874160f53eb2b444cf0414782d95d77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bd10903c469565ea80ae28daa4a410d

SHA1
c8803e603805f983e604b25212af17394a20a6aa

SHA256
6c6b801b5e571356ef0725186ff6da07723363c0a878c20ce18b83598770cc76

SHA512
cff1cd48e8c910d70a1de5396c5eadc73f1d250ea2ea0a33a76f078951c85e40d3b5bead5d29b8c38532f195b004a49c3e96debe8f85be8c29dd797df636c466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
085b6e63c83c55cff53771c9ec832454

SHA1
adfa4afbf35c7d40579d03b708673289590765d8

SHA256
2e038eb1e07803dc5477d7d81dde3bfa713cd773aaaf2eaa6b8c548d43f32f40

SHA512
a47016cc332f7da4027fc7a05c51dea9d556942f271bb8c09c570c3fe4c54bcb65d67492b1faa79f9d79eff7e952eb7a84f11bfa7773e1d7913f62c52bfe9d7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
352444efca9a4692c0946f0acd83d161

SHA1
7d0c171206a69aadafc745c8963de90ccae49fc8

SHA256
1f3c5c38826bd27573f1d2b7d4d476accbf44a563226f379eae8e49b93c3b6c3

SHA512
f4020e24a6529f4edea2a664f3469615093f8a66d454d8dd3342734d1b2456404280e1062b6851f2b8f380cfe48bb01fe974389f9ac44d31a832e0a4958f3b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce2ffd9fdb9053f5aa72545fc48c1092

SHA1
64ba01b467181d0fe80684f4100ea2394f554305

SHA256
844a8aeaf9e5474de19c57890b9a9d29ca8ca1230f7469de387330318564579f

SHA512
dc7a59029c0e6540fc1f19e7848614c0d571ad1641dc61dc0edb934ac9400327f814a9d773ee13ff6d19292cd746731350ed43f4defbbcc7061fce78fb1d21f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
675c07df94d803e9c4a97bd99e31427e

SHA1
786fce57016c4a9684d46156f274af424feecb5d

SHA256
c72d89977381c8680b5ab8309b2dd2f5dc5ad35f13fc9b1960e193c1accc82c9

SHA512
95b404e718c46d5a6409819b9166349f9805a006eb2ac37665a0e42fc4c4488e5e169034ca52599160c7fbc73ce6ee755fe046ab8325edfb2bc871967f61dfd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc0fc9903d60d2844ed25e1aed9d9812

SHA1
5d4cdfda0a92ca2e1d48a3eefbd6137bd21e4516

SHA256
68c2938ad5a45bd6e670eb02520f8d4dc9dfc41174f84a0849483b9fb6dd1676

SHA512
25701e96b5f5e4731f84a701618489e268691d57c3049dc2b39781cbdad8d3a15ddd6e0ca3be5c98028767f87ab50cb131199e0a15a451b99935193540773d01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e936ec12631f327ed0570aefe4cefe5

SHA1
da7eb7e2ba173909926ea1eea8c86953a812b6c5

SHA256
abe07ae5f90ef07275b70c96dc869b216b3d3c6d5332f2b6ac3f59ee7b6402da

SHA512
b0ad52190df5a53fb0ce44dd57044a8d2e36a95ebdd13240769c03c5b2ed02b873270c4c07c8a46029d531fd2bc169ac9d1887850b0562fde3fe5d7438f17146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
351d0b41cd0733557e99e780de691f56

SHA1
19bae801302f968cbd423e02244f13f52b858e66

SHA256
914b6111ca3140c4be5c3076925526fb1ecaf0f99035447f4c1e80ea630c34aa

SHA512
eaa2f8d21ede71af14fabf273ae4ba26710c9967deb6b9e844f4f638cbdec09ea94d66ba0584401428f3c5fe70490b1ea3df9cef29f4e4aa21aba71e2f55c2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8f82484ef51ea74174e71ab1d6e960c

SHA1
e81c4a2cc78b62edd37bd253e08ff173fa4ba4f0

SHA256
dcea50404666a3039be16b589cfe7250fdc948e11c51ea69f5782f36136988df

SHA512
d75d9faa7c210e149975a27c77efeb11a06b410cedd342a3f80d0e5ddc5b0e5e3ca2e0283ffd2ef2762359534d27135e65f9be83c677cf4d3ed270f9f333d6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
471426805acd4a4250448a228341713b

SHA1
82006df888d24dd32af1366dbf07928d6f5da4eb

SHA256
a21e01a93868ede8319b5a43489a65ef47b9eb8af74109c4c14e89ef6a2e79a8

SHA512
474d69b00c5b3749a6462e2e1d2531a0c884e2133b67f17d280476674438b27f6406d4d65be41849df09a2d68304cb471823219f27dc6e693ead848faa615664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d75c25a7c195b23b9afc2366cd69afb

SHA1
7c6e79f5e0d08370c3526c0fe37ed35a6b0d3ab1

SHA256
e4c74f192303d65f961dec84a4354dbc9177bc4ea103e6e5d6a7125673425fb7

SHA512
6fc2c2a4fbdef9caa8c0d56752926f859e68d299b062061a703d42fb324d89cc79aecd1fa5a81fd0d3480e7b4bd2892d81de8b53eccae36fdd2b17d38ac2998b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80e1fdfb30fff8d22a531ab25eb3fa87

SHA1
d88356c8d3012fd98fc41e5a79501394ab84e6e7

SHA256
9bb22a448b4524d3f4698020fd8c0bac387bf1730d111a49a233c60b0dbc5f21

SHA512
54e3c9853912366e1bf140f4d27ac8864d4c3b0777d3321b7056220205ccb60c2a3b85e085b543106d7cc59764680cc75a1c3fd7769645e9409e35c777574830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86857d890ba7507f26303f17b30a759b

SHA1
81d4444e55cae134daec4234479d0ebd386b4e69

SHA256
2f4841d8624d06866ba4d5d9381a41ed0d688ba1c1dfc3578587e34893d68c37

SHA512
90bbc086fc75d9d22aab3c201e7257d4be367e6910af969db16f91bfa0004a652e0ea04027ad25e9661edd6401fc3b17507f674a6608a6b329342735fdbb43ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab825B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8359.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit