e2fd519fbb1c33e5f34a5d24e85826a2f7c893531311598a17e21c7cb23da490

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fe31671c166774f913a6ada0651df06.html
Size

1KB
MD5

0fe31671c166774f913a6ada0651df06
SHA1

382cb694189f9bf35d9b5260371c4c3314ec4283
SHA256

e2fd519fbb1c33e5f34a5d24e85826a2f7c893531311598a17e21c7cb23da490
SHA512

f5ed03ecb2f3602efea50ca3491f007bbe0b4ddaf13b56acde2fd5016f02552dcdc63e5f1545e232eb4efa03cf3ab4d561efe57cda45596135a144473530834d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000082af37150b09f7d4e2926deafbb94f2d0642573bcd0d25085ceec391c6dd5da4000000000e8000000002000020000000c916f00e567de01457a2b6a3f53d11c74ae78556b9eb7789b74e4d45a769952b200000000cdaee206d8707d748f7c39b95970401b043da9fa53221529327ed6500c1faf5400000000f56f92264919ec3958aaee8cbd9f95b16b68675670ca027cc283b7e71a66772e2afc2764960a3e7571b00e0c6b7be6e949a326dd81e705b4ce0482548f2201b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307d6ff84f3cda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410233552"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007a3d5a8b18c98e22e566762499e0ed35b09467660d9091f04617da9a50863c04000000000e80000000020000200000002d50637484b8d285733b059b8a32dd29d09a42e1e114966dab55f660a8f764c3900000005da1522de5995439301e5bd0770a0876f64a1e12f5e2b775c37984564b4061daee5ac86e2f3777b5d4649537ad7de972880e5292d4145638e73e4e35fd8290738b1278442ec1c927c160444c28dabe1cdf756f286e4fcbc31fab548222087247bc101896bc87ba17bfebf832791da33e9d94585931af9e1a22f9bebce2f1d1d36b3c66b856d62c4cc299d7dccf888b5c40000000f840e3635c2c5b727cc958b101894a7a25c6b3d301012e26ca1bfb2933e7b3eeec06362266399ef3d636e362b3906708bb5e6d9cdcf019f8989e8db84a6b13ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F07C471-A843-11EE-8CB7-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1388	iexplore.exe
1388	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2416	1388	iexplore.exe	28
PID 1388 wrote to memory of 2416	1388	iexplore.exe	28
PID 1388 wrote to memory of 2416	1388	iexplore.exe	28
PID 1388 wrote to memory of 2416	1388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fe31671c166774f913a6ada0651df06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a66fd1daff3dd2cbd4bdf01cd2c5e2d6

SHA1
10f9c570550e5b7fa5e8c5a059eb332d95020bd9

SHA256
7bfc74ac6cb82f178d6fcc96c27671a1aa972866b49fe840d2e20a94f535967d

SHA512
0959215c2bc7f4b0c818b6a392bdca3ed662e1e8f1c70462bf18bb1a3658f3afea5308fa8982eea127da6397eee04ca7765743152ad5aa5acf86e39d94b88e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8181c00caeef97180f1f42f6fb1e319a

SHA1
19b069cbbd117db075cc4235fec7c2b40bebd678

SHA256
1afb9dbe02951cd5d84f708e8366280c406fee4e05bcf50e043d6f01423d86d3

SHA512
6e531274bc41effb21876db42917fc778cb7703a4ca1e4aa83a5a3d97f795681f5b45d4087892c249f12b9d13ff52630222ad70fed414315ca1e0ae8bb87980f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
054c16ea23e1ddccbd88e81f7553192b

SHA1
b4bf617938b113c13ef3d526144ac8c540962126

SHA256
5d9d098fc4fc4b8759f40b49ff42bdc1fff2650e907cf0aa591155d8e46a80d4

SHA512
e7e1b1fc4b3f3adbe65fc14b30ace315e96506b511d566ccc7685ff0ca2f226563eaa5a83c099d09c043393eabaff68b96e08196931932f3ab38c89d62c00da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecb9ba804347759a99a1ae05faf6d8bc

SHA1
57f05961a854aaa854e3f9f4a197c82f5fb6654a

SHA256
0129b2c9502f509877c58fa675ae5b1ba24ce8f800a079b16c3d6fea58057c41

SHA512
3842ee322e76ee7b6ec18b3b58db71152dbbd0d5ee990ff1ba9b2b360e633bea2f72deb5f5668f6520b5eba11ee51735c23027b89c90040a873236fa6fe61d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee26d16034831b412bd2a7b661fa4efc

SHA1
3eaf8d45ae27d8d123088e0f824fd299699a972a

SHA256
70e664d5351affac9948ae8d5e5e21c0e6c9db72d1e196044e74913ec952fd80

SHA512
41d9636a6c0df38a649ed3615c0733d3964f9c2635c9d32ae57582422ff47bb09b27ffd5bfb00990ffbbf229663ffb7c9063280f8deba09606a47ed0a746261b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c1ba3fd19e398cb831bb43a0e9130cd

SHA1
3f3d54ae5dce5d4ae56230a26a7bb5e42eca52b1

SHA256
11fee0ae49215533ebfcd83f16b8a6d3fc5934580901ecda6de9fca249e887b8

SHA512
5b315f5c6999d6768bd6bab16a35c2dc488ef11751fcce8201b3fb839dc208d89481d96cb36a3622cd4e77721a63921ee9b1967e84b7ca250133919fbe48139e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2810f828710ae8f81fa29f34f5cf9d60

SHA1
f97c5096d43990fff59c6ca1f9ba498c3afdf435

SHA256
7b42bc20f7427fb72ad2cf4c7cdbb1b9477f3a9184757fbce3999522042ad69f

SHA512
8a48f138e90e3cafe9fc9d0d26756443d66769f2232f7110916b65622f49a86f445d92f98d4186ba59614cce97fafb87d2f7efa944f25dc235fa48dad28a453c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c0b1dc809cdf03e38e3db09da4eca44

SHA1
52042273c0fb42de9aa07c0e327919ce9433a3a5

SHA256
f0386ded86d64035ec7bece1810e53c0d28493a7e3ae385ed38730c96b59f315

SHA512
fffb889f977f2b7d7e76e3465336ca394e8e647f6e73e7c20d31eee167cb474ecfcc4d10a5fb2969efe0f33db5de1f7bc76519506aca5fd29c43d35b76152952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
767dd8f3d0758d95a7ffff24d2b7be6d

SHA1
c7b2773128524692f2b774e9774956b75dd54e14

SHA256
655f34d484e18a0d48c1d002e6095299a212554cecb17097dd63635191a5dfe1

SHA512
8edabafed3c9353e2161eae6e4eafbf6ffdf2c6fe785e8a1e7a47790eadd09714aca80fbad617960b8ed7122bbba6feab5a8683dfc77d171b7c2386491d6e8a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c74cde891916d801c2aeb33d7f44b69

SHA1
67d8be10e08bd4b49be342b9f4b8354aad4949b3

SHA256
6d8a765863b6cc4af7ffd671aea974d76aeff1636947671da74f42e559f2e1ae

SHA512
59029ada4b8b3a11df5317bd4b1ebc0fc8ad692cc676252cdef25ec8744a02602e1eba773db1e7e6d9366d00e232a9c4dff34dff69005002dfe63d7d9df195ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ad0f23fcc5bee1c77eeed47547871a8

SHA1
ce2313368dcf240fa06502136ac3913dfd9c9768

SHA256
8a2dfe7b8d759f9599d86d9dca91004cedbf18cb8132e042f2dc3713efaee124

SHA512
399c362e0fa16106d828d526bf68f06c57df85cc82d16cfeadcffc9800d50a62adb314fdc1d091a8c55d544d758cdbb78c370e25dda9c286bbc130cd832811d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
169c4a70959d57ab130f1d8091770011

SHA1
539156187152efb675e5768881f46a7208bf5ca6

SHA256
ef512a9a11be9fdf8add379ed19c407c32e139454c29ab0242ce39b1c8f5dcd6

SHA512
7fed63f0d7822a4a5da140eb46bd480885e56d43d05d9a33667417b35fa36bb7fd8cd3ec3be91214284029d79396f098a38b078d5277787f573e5745e88ca759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e318d7ba59ffdb55b005c138eb4627a

SHA1
e92af51cbab237fec8fff1f713b969f13ede1ea2

SHA256
f7aedeb4c508670dbb762ce9d1f977a788cf363874fba05ea68e2e157d15babb

SHA512
d18ab5fde8b73481a4ded412d0599dc8cadf8a3cb308dbb49e60570a6ac064aa327e3d2cdca6df98b216d6987f2942a9e79928dfd0f73094d4adcf668922e8f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e7b75672556a0aba95211d6121c49ea

SHA1
f6436b21182e1a276bba795bbcce6934945d6f98

SHA256
5e3915ae0bb0fb9325d4a3b154d4d700b42f6a5891b4da25632a4bf45e73ccee

SHA512
e38b62d9053887fcfe291e0176eb9814995bc7df183d605dfe91a478be3e90612ece85b21e512a0aafcc4fc14a3803d74a50506033d0d25a2542191b84176902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ee1698d5b6df262e9e3dc8fcd2b8622

SHA1
f1efd78f5bdcb5ae0cd2f3566e0a17064b31e24b

SHA256
6d33061a6702d05008c39f6fc4eaf2fdd9922cc449b1811b901fcc1aa04e718d

SHA512
c82dc6b1a68ea4a2943edbdc8c0e2afd9ee457ad503986983daf0236e6f555c5110de7be01f64dd7ab10dbd8b64ee4d3a16ce79c8d64573c246e905880719d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9ef8e6d676dd5174dc45fc41e9991e9

SHA1
542bbbae239a10c2564b8724cf8aad00535a0aae

SHA256
ea5314684c69e62c0b579d822e12584fc53cae436b9865d6cf9fdf51be39cae2

SHA512
cb439c0935a3a87e8a03be290e1aa91c677cb18e93e4328047753641908e4c29e7ce48c0a301282093f07c3b2fe393a84ec4059b8122854f35ba0ac162cf5c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6EB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB783.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit