240496e05bd9ad3cc2af3117e8aee742ef8a6ef82b80ba093233c82013344fc1

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:28 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cf872910f706545660debbc0d4dc93a.html
Size

3KB
MD5

0cf872910f706545660debbc0d4dc93a
SHA1

6e17e914b1025d9d3386197fb49d326f33c15c85
SHA256

240496e05bd9ad3cc2af3117e8aee742ef8a6ef82b80ba093233c82013344fc1
SHA512

69c351e7a6c70d39c46a0bafc9a9cbb44f0079771d453c8cce05528c654c692816142e21b1cf1049f68f4f288b75d75100355c18df13289a1c1a9b4512d3f73e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000030a9585943093467589dfcc909a02579b995405e61b13050331eac109a45be9d000000000e800000000200002000000055edc5c99384f2ee4d8d58353812ee67693b595665f90ac5a845aaec55c7117c9000000008ddb90a2111517665b06db3d38d28214de5009b0c09fe5b7eaf2925a667a2324cafe95b8ca8f9fac8e55549479946435a498df3746c10f433eb1e87a4bb10c85082a44cb30fb1dcfb568a083f9f0e316ea469ee25175cad67cd0e5eccd8bbc93ba66d43e5c3a990e96773b7ac4ffc2bd53d663bd4f8586071a34201c686b07d6ae1e62cb27bee4776973463ab76a4a940000000fb374120c4f24e9f601907a955ccf13eed57da2c39988235dfd3de131e6018e7bf92bf39311cb8c18cec0cff9eabff8e112f0e303a562d63f2029b3b9c817e51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23C55E71-A747-11EE-B187-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000008371cbb51a12e53813cc9cd45a9efc606be72d09b2ed877daabb3e9531ada0d1000000000e80000000020000200000000bbcb2f8c6fc1dd9ca638b09f8e7871cc024e5d2215f0c7c10663c778dc010762000000076edaa6976bcfa7e03eec52c0e8b8245c7dfe22e07e97928f733aa9ec20c304840000000d44febebad9eba077052fe6eb3396b784ea8216e8260cc9c189638c63edbe567b888b0b3f0bcf0ed3804550c4d38622857c9b2f69e18a79d3ac0130e17b5be64	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204c89f9533bda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410125348"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2776	2372	iexplore.exe	28
PID 2372 wrote to memory of 2776	2372	iexplore.exe	28
PID 2372 wrote to memory of 2776	2372	iexplore.exe	28
PID 2372 wrote to memory of 2776	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0cf872910f706545660debbc0d4dc93a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

No results found

204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

1.1kB
7.8kB
13
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

893 B
7.7kB
12
11
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

877 B
7.8kB
11
12

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36cd3a91af616eb6c044e0cecc03f8e0

SHA1
f6bcdbe83ebbd6608017eb09a25c63b989f0899d

SHA256
072b9d136a5a3d5cbd97ec70f05f5f5729d5b7250f60725272823bfcf87bbd3d

SHA512
050efe62ba059e3937b35350aeaec869460d1792300a0f0dc77ab016c2092befa6e609a229de724059415e421fdffca21abb89b2f336520ea8e22e5f7430c7d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a569c69d688936f71beb43c737e3ade0

SHA1
d8a77118d965f052326c5076b56536dfcd7ae10f

SHA256
3e240c5b8f889eada5fd85c73d8e579d63d24d6f9c5d076b97f3d8c70b5fd33b

SHA512
72713a8c6004d597530dbe2a960bf030529c8074271add1745a566e3d03857401a9746e3c17b3b3d0a57003f3cbfbdb7f1fb8885341cca0e447b196a0fdefc5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d19f9ff968ba8699c344892761393b

SHA1
16cf0cd85f461ec49b76b304cd602538ce8f1549

SHA256
890864068727832cd1cdf50bfc3966c00278a0cb1d5824a246a3e4891e8e32e3

SHA512
b8a385a4ad07f0b8c86da4d5d658031bf10bf80672e42f1ff6cade125f888122282e13f0159941ea38bc9f7fefda98a52f77ffb7e691900a3d0c1d1e80d12c98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b42eac66ae0539471171f4ba1a2627a

SHA1
34221054f6f22eaeaf3fb658dfd521aa864ff18b

SHA256
d8b337d3a18e3ca55efd8891339d8d4ce2cfd0ffccc60246792738d436d3c776

SHA512
a6740f05560698f6b78ec0e8a00747a0f9f44ff1a6be3b1bb15fb28f219cf68352b34d6af6faf8f459f79440b138eaf6629141318c31438f9fa5552871582a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc611003cd4c155c20111b27ee1be866

SHA1
72b67ecf8946f7db6cc3c5beac5c6a6fce3270cb

SHA256
c7bb0584e6a610e021adbaa9c48958ece67582a3e9980e9cd7a5649cb80e1971

SHA512
29fd431c54fd83c6ae736808abd4b91dd085d782caf357fb38bc1b4cfa6d106990b10ce04e33e64a98823984e2656f3220f5d08cdbc32dc8ba216df78c00606a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e74c7147c1ac2340669dce705b1060d

SHA1
00513dac325934ef4bcd01ed207e0f7f7e20985f

SHA256
b18b3fee3ee83f04fee1f4274d98582a4dfb7c1a82f3bcf5d7431ee2a6eda089

SHA512
02bb144804cd6662dede74fc6beb6fbcbbe2f626a440358a618cafc120dac815cd5e85f81aef8117bd11824e18ddc1fb6a069444915452140769a6bf5d204381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d1d979be9b1763227d3b33456c09255

SHA1
ab48727f5b1fd60b246dc27cb2f84b5e4e94081f

SHA256
81b466aae005a1511c2531ddb9bb42e25aaf9c7a2ec6b03d54b0f23b0d04eaa1

SHA512
475853f01efce63057a1460e6291dc2fb83077230c9dd39a9fc7df72183d01b37f59c8368395b300c2a2a53af7f774b5357b99b0a8fdb43f37f74f84479c08dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c64c76529080e6646af0b71245c65d4

SHA1
ca53665fa3666ac1f1db57769e686780499e2024

SHA256
aba677d2c675bfc88a148583ec452daed916b83e54b7f972dea4535c5cdebf56

SHA512
e0c173d956ec972f75381e4111132302f7904a96facc59dbff2241b3028c30ad0ebe64396fc06a045e611b8e2e6fcbf3ea208443c40d4455fa59294d389ae38d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c653fe650b2edfca44b3f3ff5768c05

SHA1
f1732ef313ce22e71f84e34f1cd47db1de1c48de

SHA256
138a5fbfcec417e46d142d199c56c0b5d82586364e19e5071b837be64ca6fd10

SHA512
1d1f4bdcd179a11400d22ff48cc4710a6d2a8addb04a39775afd32a46035658d991beaa386dabe5958145b011d01d191ef02e0cde005bbaeac7e9fc3a63adfdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af96c0da15258ed04793aa8a6b1ff5e4

SHA1
eba2b16b00d2953280438cfb4c71856d33e5c4c6

SHA256
0d5a1813bba8a2b717e3bf95be76251ccd0bd469c606889036cf01552ae6c9e0

SHA512
bc71c246079a68eb75b79f6f081d4eb8b281d56a78ecd693f143dfcf909b449081174f8c83276a57f9a780d26c1cf4d272368da693cb0a23f56db39272969824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3ff7a1c1e001936a67bd74be2a59723

SHA1
44b0545f0a027bf3730fdab8fa2737ef3f0f1edc

SHA256
e476a64f06b01177c03219aed23af965b038d938a111ce4dde1f27a9b4744b38

SHA512
74f53b75c88558723cc6d48a6b0577b765770fa5a5522552149923f82b64a61e4ed2c0b684e7588df925b270309e5723f29b0ab9e3f8de245317b4cd9d51d6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1eb49f5a4cc0787f0a286a04524f55

SHA1
59ab3a0bb270c82609e9bd52089f803aaee98922

SHA256
1452a71a35ff524d1c52583eca1a47a227f852d2a747da499289061ccfa34b6a

SHA512
9d5324aff432507e8833402c35d50f3529a72013bb0aafae6f09ba52b4b56d71856c5952a04f09f20cb611f86558823a06ed97deb52edef4e05bba5196742145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d0b9c7c731095d96fd827379a49eb5f

SHA1
45b647bc8a12e7e092c568f70badd3686f781346

SHA256
9380a7ad2804411b13078933f6162f1ee461e60518dd89cb4b1db0b3ce41f9e7

SHA512
adbb0ddee4b928286951b60ccb2c3d244d867c943e17211aeadb4a99e5c47f48fb044038dae839694442a676e3415a9fb64fa80afdc1c50cbafc916272e8035f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2e65e043fb28eea7bdbac7bf855262

SHA1
26669302daacc3a25cf29e6ec6fd43ef81cd4763

SHA256
72a98db7d4a10e5dcbb865bd679006b63044478db5e270f275501ecee5ded71d

SHA512
a302fb78c273d8d1757bd87a3e57b1699aecfbcd4ef540e201cc5681d8d68f9a66cf289405b38f093c94e3264a8e5bf6794a462a75dedfa079158707a9fdf616

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F22.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7F44.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit