54176e1a94394d55e745471f5150a5eed2bcb638ed4860bb16249d0e9e8c7db1

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d900dc26c439c0bbf36bb5bfdf57cc9.html
Size

893B
MD5

0d900dc26c439c0bbf36bb5bfdf57cc9
SHA1

f0106d2a97ad8c5a7a10e36e7ee41988c38b775e
SHA256

54176e1a94394d55e745471f5150a5eed2bcb638ed4860bb16249d0e9e8c7db1
SHA512

fcb1ec1fed098f52380b5802bd84608ae935f40a9b99a81ffca67efe256497d487c9975a96ec86e98e60085387ed992531457e8b22f7a6173d1339cd8f8b66c2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004fb134ba1a3a62b0dd0e5e999fa11334a8e4a915aa21c75b71c09734b0f49157000000000e8000000002000020000000323840558d0c8075ff72be2d6ba4ce07171bf065e4ff1e3b58c001bb0f8fbacd20000000b056703a7b50c6884ef25166f58b687e7d6d7cf91bca496917408b534397b6f040000000c78b57342b62f77468df03afc646a91f99a214f754775ec28198dc13c59ee0bbeed952e17b06517766933b589bd9ff16294c3f1e76835080aa160341f2b23308	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001d05ed44d63e9a4180d1d195d6a039d895d42ed053b5dca3e67e5416408af54c000000000e800000000200002000000079eeee2d81581ba2f9f8cf854b5b8bc12a16f5f0a8abfc98fd3f6d6f7998a79d900000007582d7cec40a63e70fbce16b88b9a6a97620e347b22f34e59ff97c2bea7d777eb3dd383cb48ff5324eabf437eabef2f82f15c5a17e63d4ca7a5d5d0595aa08a603369b93e2cd003b44fb839c84a0d0b05507f6091c918b39872905e0b8ccb59f0d5d8a5ba322de52f71c527589689dafba4a91670d3525a21d64520330857ee51af6c8c33561ac5ffd68a188c256221f4000000072e308667dd52e5b1f7c6091ac063bd7909afdbf0dfc5780231033f6126bde98b328cf0175e045523dd8322e38d45d4b158cea45a1fb288e28e4e6e277f7d08b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0048f7c0d3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410205017"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4B0BCE1-A800-11EE-994C-464D43A133DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2688	2528	iexplore.exe	28
PID 2528 wrote to memory of 2688	2528	iexplore.exe	28
PID 2528 wrote to memory of 2688	2528	iexplore.exe	28
PID 2528 wrote to memory of 2688	2528	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d900dc26c439c0bbf36bb5bfdf57cc9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8944bc3e329c0172009e498329511a9

SHA1
280d0aadb1c501b2a7348d2df3286934de055b08

SHA256
2e3e4c926dc85ad486ebd275fd04ec3db0e38011d247a2925d9d47df3e4270a4

SHA512
bd6b6b9722ec9b0c5c71d686b7720e5b04f29d9d4140529c597c47eb913d3b686ec2bc4738acb50df30ad5f1e9e9862ad47eb4e38a0b6f039b47e060d9a025b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dcfb9363ca5f62db8b35877f825c84f

SHA1
298488d93a4b1f70871d785302fc5a04e4899a67

SHA256
7483b96d4fec3a789b5f1acf2da9a50761725cf06e5c2d88300da394a5db8750

SHA512
9b86288d0dbc95563c94795b19906fd009ad096a4888844ffbe4039774c5c2030a5ea2be6cfaf6f00b4a80a43473ffe211af65ed47da4f816fa33b7bab4c3fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
affe41a8e4198ffcb7c26edb63d72adb

SHA1
c87f497e5ac2327a2772afd2867d18c973207550

SHA256
39578d9d68ffcc39f0b71444a8a6ca3e9f9c6f09260d0a6598ea2a41d9cf825b

SHA512
915491babe7275dd6882f5ad81cc2858780d4ed9b9a5da50445e9770ed1db86b31e23fc9042b96cfd499ccd68703e686e444df125290a03b24b98adaab2b7391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b94af26c43d5ba9d666e68aef33a07b

SHA1
6175243385b4bd24c45f5e5ef33dfdcd5d75207c

SHA256
ade8e00df400607abae8bb0da84660d9d21802e4ee6412ab5c592bbccbfd7c0c

SHA512
a01765cdd3a6430f4e90e7957d5fd06db1df1762d2e31c07e4dba3450429e002ca46b8142c494fc39e9eb418d363e68c87127938488f76cb02003ed0eceed0f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dd3a75971df0e8c408e8f46e9d5d8c5

SHA1
57357110c39b45950afa1df47a389a60fa048192

SHA256
c9a85c8cd2e1b9d336974f87615fce14c6f08e52ac733a8731fc0824ab8275f8

SHA512
6710145141ab0e7f92b54bda913974d261b191f2ee6d743edfcaf5977affd11d57aaef5d0d2c2342fa2b7f87a03ee0d40a9b2554a2cb506fb8c660c2895fb773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
181cadd0b7818292e26661eddd2a9428

SHA1
4c10f45a85f51f0450788d57d4f3600af6ca66f3

SHA256
c0f6e5962026cb85fd8ca59d726faad8fb1173377287735087693a22130fbae1

SHA512
b4f79b8347cff72d77506f8997353c8e2ffd79b38bdc87483fcea183fef59eaf438095abfe70589164ab4995440ebc0e4e200710906dcc3672efccfa8ee0472a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47cb7e4dc907e739eeed2c3c96118a14

SHA1
b4a344c2241632616b1bdf7d5de49e37a24e385a

SHA256
93a51c9358ef054a6608d49e6b441b1f1847c416f19f3ad6e914d1cae46708f4

SHA512
908e7a6d53eef440a5c1284a7c335d526cb95f0930c4eef2afdc95b26e2fc0f6d248be05624c4a613390b426392908f46b7a6be414316b9edd4454b067eaa0ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e28ff760362230e725a4b1fb08125209

SHA1
5891b904d34fbe771f41ec5d2e525d3b6c3d202f

SHA256
770613dd5bbe9261b1b60c1f0167a7eb2944a9621f6d92470fed78cbb4861b93

SHA512
4fc414d7070ee227fdf1a3431e2c4fc995bde7e5dccd170a5d2953f4f4d91a0e5b98179d694a189eba6c533e0c86e73e32b2b5b437ed2cf788cdb02c9519b52e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d43c509c8c2834160461676150cfe988

SHA1
932553f35373653f0f1d99bd2525cb97b62a3964

SHA256
a67f998075d775999d7c08aaf9eeaa00481b2568809cc15e48c332b862114017

SHA512
b5d3ce934c4d0ef763ddf98e7c7e6067594d72d7c21bc14d93bcf603e8ff5e709e37cb50cef38296d83afcd7c66fdbc6d2de562dcd6d772b557961839d75f31e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cbbe7b6f7a2824c1714aa1b24703385

SHA1
4acbbe6f799834fed59d6f24177718e4d2e00627

SHA256
a820b076d2ef3253a0644e306bc66e5159845d3dc3efca46b7d7e69049008a2c

SHA512
fd851a25f20b7155937eb83987137f55380064b9961c1da5a2e6afef1c55540d06249df20d6ba06884478c2ee6179e567108b3e72060afef38b40daef0d67af6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5f81a855347e601aca7c35780d5d31a

SHA1
fbe07ec1bd538b2839a1120ffc9439eac2c26c67

SHA256
e8f372bbde279a8dcd7ed65d2b28b33220af98e49ad47c4441c8fb4bdf3ee1a1

SHA512
410cd77c56efbfbeef7134070d9e34a384fb1ea74ef7cb4d6782c869cc2d63876c91ea7e0d651dae9387b759fca934a16c2467d5390a37a84fd26bb6dcc5bdc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fcde6cd5bc8169ac6f0317026ef1aa0

SHA1
25615a98ef9427d7b4a54625bda2ed7e7af7a04e

SHA256
687af7b5ed09bd18acecfb69a95cf76beff8f0dee3c556e58e778ee3ee6b68d3

SHA512
c2379e60cc010af000af7ed398092024b8f46b950bc429c7aafc3314f9c8c718ad1fdb929702ea51e03b78a0ce08196622158347ac3a086202bc2ed724f70d9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b07f47d2606446012ebbfe75567f1b31

SHA1
2c04b5433ab4caf00a269d39d2e391c77494c04b

SHA256
fa98d6e650d77d1d2dfe6449c9373a28efaae7dbdb9f027649d40b595b3f5b77

SHA512
779bc44935adbf6abdba1fd82990ca164278047e9a7c720e879163d69f593ab6f0ce44889c36572b647fdc4bd526669b64c5daa0611105e386c0f98821ea616c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\wz5r4lq\imagestore.dat

Filesize
1KB

MD5
d92f92d3492602417ee259ebf44fb744

SHA1
1410fb1650cef5928439e156baa2a0f100ac5258

SHA256
589fd5ba0e3f5b2cc909db9a9692676ccde570894a1fe886b4bc8c0d2f6b6487

SHA512
869faf8ce5980499e8faedee5891aa1f39a7c034f87522f3fc022acccc6ece40edc8c11fc9ebeb2f4f3e17b15d634c6b93b12f078f78adbd75e7a4e3a6b44f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C26.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D23.tmp

Filesize
54KB

MD5
b70d6de0c4454e4d1177ea28c386ecf0

SHA1
dc88af52d5829a11d819ffa3e4647980bec63411

SHA256
f323b6fd9ed8acdd12c95fa08b20b342656650e5c365589b39f24d6179adbc98

SHA512
333da7c0a96e55b1ca7f87bcf19a35916668b5616151f8efd0de7368e3508a8ad93f7eb9bcfd24ddc3470dfb95cf5a16fce8ee17b52f9e6665399e5b1be50a0f

Download Submit