04c6f10bf94ed3fce93c5fc42f5da9607f09706957bd6c048cc1093eddfc1ee6

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d55f0d7e4b9f1dec4a4d11eccfe2afb.html
Size

388B
MD5

0d55f0d7e4b9f1dec4a4d11eccfe2afb
SHA1

8555e88ce79d73e13d673b1bf1c9889a87c36f74
SHA256

04c6f10bf94ed3fce93c5fc42f5da9607f09706957bd6c048cc1093eddfc1ee6
SHA512

932acfc8a6e6f7682d6e419861b5318a6264078b78b2939b1200dc89cc8bbd8187a57a9d39021f1c9ae68cf1072a0dff2c2b31c2bc382b052effa9ca87fc5cc3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90180631-A74D-11EE-BCA6-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007653b23c40c1e52cbd9525b9a94360940c7b5c634dd2fdc9fadda98ec34db018000000000e800000000200002000000022cbef58f02c62561451af23d24f05c46a3f5cee77a2e1aae31254f7efd812122000000009408b351fc21b28340e651dcab29ac99f191987ce20c36f1624f400dfa8354b4000000014660f15d39bf617b6af5bde682b8ddb9e2a3126716b3cebf2ad73e43b6a5e49b560ad282629cfefadaafb51c2f18cc415a0729096885944c452e7349592af83	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905a40545a3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000055775c1e77e3dff90445a12da06a6c883faaf45a87f068691bf6fb13b0536097000000000e8000000002000020000000d5d914d153a8d1f10b2bc327af786d5e465d5b8135475def784159fb79d4470e900000005801e33cbf780e68cfdc5ace28f7d23c784fc3e49cac2e4ed429326cccb97a426d5adcf1d12f3fc4db92d8ab402ec40c7530620ab20b90d3ea293d564a9ef7e69e60e6d9ccee15708cba06bc1de3e8c41b2ff5b859d8460898699c83b48a5b4cb25bf0a76bdaf0d5f2ee21d20b9ede828d4d0d9048d74b0ff0ed844b79b5353a5287d324ebad4aaec7c232b5ca52af984000000076678e7d352fc9937c910fdb0decd8b42ee8a49183e871252ee4bc9582842c65ed8d3eb5bd8368bdf9a84a0856ab247099bd1ac5e96c9a7922c50e1ac4098263	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410128081"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2644	2056	iexplore.exe	28
PID 2056 wrote to memory of 2644	2056	iexplore.exe	28
PID 2056 wrote to memory of 2644	2056	iexplore.exe	28
PID 2056 wrote to memory of 2644	2056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d55f0d7e4b9f1dec4a4d11eccfe2afb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efb78a9e9f78c72e75a64e0c6e179192

SHA1
2da8533ab4f41c8d7d889bfd51544ba31a054d2b

SHA256
6a4e3b22741738cd1fc4111cc793ea910d2e9e169a3abd165f7a57eaec2185a4

SHA512
1ea8e93d7f208e3004c467cc0702a3b270d8e5a384b8ac9cb3b72741b0cc2b531fcbcf1e6235246c7ce207ba066f5376614b7995fc7cf1ea9960e7eb997b54d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
486ac8487f0ce3ee1c05cfbb0de78a70

SHA1
fbf553bcba328870c67d92d190cc36008dc1baaf

SHA256
cea578a33133a97c373bda8a24c6371118da869cf167d46bbe7819fa86906931

SHA512
117a6df40b663841486898914085a571a17c3a8c2c386d13387275bcff6be60db47d574dd815ade705190fda772d6c6dc12362faeb9fadb2fc5a01c86dfc747e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebcdb7b2ec474f557e9e50fd4e20a7cb

SHA1
422788023812f251a8944ec3fec094ea5a5f6c45

SHA256
1956130682861892642e0375c3c84c910526cc85f0e55d2a75877f063d51fe7a

SHA512
cee4657383dc07934b0f2d57aa465362160ad52a7538c9dbdd1af7f02c18959430295e336dd7333641965ad1ec34b4275aa6fe51b789c2fc41275c4118ab75b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcd56a3cc8320866f589b1094b042f1f

SHA1
0bd5580cab7edb09a8db170cc16abad424b6e30a

SHA256
5729e2446a910692b660cd3f65fbb94734d3b41c232aef60c1badf07a68b4fd0

SHA512
2f607eacd23a147554d3184c8cf50d3381cdf6bc725d44a9eafa973f4a52758eab664ee53ccde08c1a665b593ed4505634a39b73167744713049edf3b3efa063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42d58d23db271f397f91d64ad26a9e59

SHA1
b1a8b5a0499e61a909978ffa0e75ff35b3ab57f3

SHA256
827fd9e56dfaf6b9816e96a82759fde992dfbba76ebb7c25c7132f5fb119e84a

SHA512
039e23578c46e638dd4aa1c47a30b763d379a4c81c5e399a8c1b0549594090502e4049896945a57830f507646412156739c5d96a2606f57238434dc91b88a49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92c8a5ee82cbb4325d24a4b4b1365702

SHA1
30e08617353eeba577cfadcd39962534dad3cea7

SHA256
f16bc404f2aea283c089ede83d2ec1ad49276c3e47453e477126d2602e870a03

SHA512
78c234dfc0bffa448335979efacdea4272d35cd2fa6dba98fb9e5fac501f4cbdf1317f72f62dda3d9a8ffe3be7c969e7fe4e3bb6726b342af394064d58aa7801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42115a6bc145b8a596491e0df2844f33

SHA1
b3f395c0f108db151242a334213d565e8ae2892c

SHA256
db32a91d3dd725458e0624b12196a12e8acf17c7819ae5ca7348badc8fe986bc

SHA512
18b9f79e5a238038d8e591fc9f5d0fd5eb7365db14ab7fd1f2c7ad97403458aa787f5b8d3bbec3ab13865a7bbb0bc87ef9d3c9b5558ecbbdf4f4f2effd412190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
390a107238635d93d32210d863e5df49

SHA1
ce4a9c8154fe88d88b8be9433eec07fcaca7ff8d

SHA256
d708159be3b1c641b851377c7f667877e87beb19f9d05c28dd362d0a1a009fea

SHA512
66dcc7dae00ee617cc8b08166b10c845137441dc348342f5f9b5f0887e8b604b7cabfa62077ac17e8625d994dc065552f63c1b7900db02fd81d417b2d979f7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39a85c34041287f9184aa8611cfa8771

SHA1
75fcca865adb5cedb3acc4f609137212b1fdb34a

SHA256
0c08cd9404ae6ff7d21b30ea0150591e9c9bf11a80613f1025a774f2ff3807a4

SHA512
faad9bc6c6c631277f35a8f42a32762dc364ed4b84ee1083f11793f957141b344faa1a385f0af65215c5b8cd5b0e88b55c22d4eec0da6893f8ac543ad84239a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09b2ea7bdeb15609d0d963a4df5fa09a

SHA1
713e9f1964c54cded67aac898c74bc2dd30dc70a

SHA256
824e7eb61506a443154c37b644a5363569b967e328a3563dff6c6672586ecb39

SHA512
586c958ae17f01f5a288d40f7028ba1d9adfe6498cdebb196ab25fd7da01b2d9e2bac306d288e84c34b73cd395eb9c40a93d2031358792d55d94b7c6346f29e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12a8d90c52a2b812d29d62cea470e993

SHA1
ab6fc390a4a8613096233dd8e66eb753fe65495c

SHA256
1cec8c0a05f571e3873ab9b2587f1bd30b8cd1c400a8d67b8ec7789e804c7310

SHA512
1070f733a91a96e33dcf3ebbcf9472a38fcbaa68769e51f5523b855cc3d448afb40fca64271dda2217658371a9d23424c1b9f1a06a677742709fcafc4a9d2437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc7464ae0e10e983b708f4259a74d1db

SHA1
34491924e313bb990fc21585c7051752fa8207e3

SHA256
0503e3f353840d49f32d268284d1c3ec62b711029d36cec3d0d5e7fe13e4791d

SHA512
af5c19b7f91efdbb1b4f279e43d0568e960baabedfa69c2a61fb91c2fab97c618a9ca4ef9c4686e5c6918f81a3b768a3f69aba8e703605d0c52d821ce476d223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
610e938009b2d5e95597caac7c672119

SHA1
ae5b08d1ea9b60ade4bee902296073451cbeff47

SHA256
a78b52955a4592a7e3446b594ea91ccc2eca0d5f5bc042f7069d977720ccca82

SHA512
fee57719601774eae478e6dffb3fdcfe3ab44de7d26ef1cb117593223e4c640a9c0435437ef78186a32e4ba41703d39a52cbcbc8ab00e45d6b746b525cf9212c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar656D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit