5ba9c69411bfb5b280502e1ea795307c09e2048a8436aa539057e2b0831e726c

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.htm
Size

1KB
MD5

48dd794c3e57b0d1c552d84744925d48
SHA1

a814a6ffd9d8e6f82e947f8d1bb0f8314c44cc56
SHA256

dce6180dd8fc245b0f053161f20f151baa931a822a26c08457a448d73188b7da
SHA512

ae53a5aa010e889c8fb82a77f9e839833b38dd3c017bf6dff7a754a726ad0185dea3cd1abea2c97e420520d46cb8ea6d6a734f7d3a007c7b3f8754bfacda4427

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000003da9c57dd7c01c660c044ebe06a8b1a2531bd5ee4cc9ab726a726acf58f8a18c000000000e8000000002000020000000d6f38073134561c12a6d3138786d72cf7ae68fc20f50ba2be17d033003c0d11b200000009b7e42fac9b0332838cf3ae9fa7c230ece69877cac28f0d796bec965c5b76cd240000000889fc6444fa7a405e004ed65f7eb48df9a3d3fbaeac6cc426931b672efdefbc414fa67f240169c0a7d0223573e49ade585b103e125825c6afcf178015d9ab126	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908b39257d3bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008dbd35628630f435eefc9827394968eaa87846a3b6628dbab31158917fc2df0b000000000e800000000200002000000038cfb41da905d1f887bc8cab743d007ff0a723746727b156fa67f00b0326fcb490000000540b51d15cf45d2f1b7e9fe6d8377e4839dda53d8b96e0dc8363598d5ac0de94396eae3ba54ba92fd3daa59693fb1865918765e5655392f53496c3a42f7a993d0c0ed3396657a5059a932f26fc361f92a3177930fee52257c14ad447eb16115fecd7aeb0bce19c0d9a570ae888acc6e4c1766e102d747b47465ace125e393bd8afe2a2d6c1851d60ac8ba6dc9851a2ef40000000892ff687047c386e1b7280c37ed95e6c5ea058f949786572499c1d4650f757c26684c46a2ce407e277e40e31ed65be4e1b250df009691a355858f8f278dc9cae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C68CD61-A770-11EE-87B1-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410143021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2140	2308	iexplore.exe	15
PID 2308 wrote to memory of 2140	2308	iexplore.exe	15
PID 2308 wrote to memory of 2140	2308	iexplore.exe	15
PID 2308 wrote to memory of 2140	2308	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
affc1e35a0e8c35f43d1e1b9a35e4038

SHA1
009af545b8d97db6add4627c3ba03a2b0bc1b230

SHA256
8784fb833e53fd4e90860699331e050a2b598655a71745cd99e0762ec99653af

SHA512
9f20e1075a7a62592afa25545fb2ce68d0b2b25d557c041540e091d9d7cd66d0481f5c05b8b8e1277c4b271eeeb33a41ef0f74aa4bf37f6e55dbebb0ddfdd1ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87611c9c83ab839c17c62bea58ef2394

SHA1
8f520c39c974c5e2a17adfd4f92419a7a5958fb2

SHA256
b56898c7509e8d02a49687344a6aa40944e8803aed5716e8352f25156a4faaa6

SHA512
595f16793ac035d4ef5ce86de4a1b5875dfd77f8b9b10250e17917f4e82cb970ac355f989859084da05228b9025b37a88bedea259041c61b5c814c8e65fba18b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56ab53f49fd3ff766dd56c571597ae5a

SHA1
d0993e03e3b12b1eb64e77be1a6c94bf84710741

SHA256
f718b1c9219beb6df2b230f4072795e76a4b4f2f111a5bedef6247e69860516f

SHA512
0580297b25278db8f12f11e436207ea125d7ca6867d62aaf4e93ecf9aab2fed1e8f9409bcc6b3bf85a267b097011ab6dc7c46e775126554260b31b14cf708344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f634fd275896cfa6a3d5cdd3c772689c

SHA1
5b489fefd1c9198dd00d5e04bccf6bfc2c231530

SHA256
774cbf5c65de0903a3598a5bb250feb38e9cdb344dc883027671a00d5f49764a

SHA512
3e78c33b33b224a45fd96c469f6e1076231426a64774b06bb47d375f895c373e43a423b173d8ee5795783d7d828cf9692fcdd5d7d7865d9996ef4cf692e63225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23903bbe6236bde0bb7810486b384c08

SHA1
8efd0987124616514c8457e53dff027e9003b81c

SHA256
49c6e1f38ddf72523bad179a55d7115a47428c99fe64ec7570e1eef63c8c23f7

SHA512
a16a6f5fcbdc73b4f09899104aadc59dc92811fb84302462aab40e61de9fafdea8ba2b741b8cc6ecfe25fd779df021a12e656bc10db6a2cc6fe4dbdc649e049c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9fe0d23d2099e69f3560e50d5cfb7ba

SHA1
e52ec0e3a1738ff6f2345d6e55dc356d585df4c5

SHA256
b97a6c2c3fb4d2c1938afbc8380a02f974a9041b6bba09b3f63664c18c5addea

SHA512
8c10238641cd42e53858222266a2aa98fc460c1acd32059985f0a7680ecf198479c8f61160d5fb1ab478081b0cc948ed8b9aef240fb105c1ceab4c9b05551544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93f7ac5e8faf7d5299671f4c95c594f6

SHA1
59d8593833b06a0f155687180b80fab9a7300181

SHA256
6614c3be6c4de4b12f592b71b6a9a423e302c27aff78e8847604b75c0b53ca7e

SHA512
75566e10e04ba4f54f94af520c19d3524aff3de1b39ad65f1aa90753850a0185bc54bb5bed5b8e971dff5fc4c8d5bdc0050a75e1aec055be3e54672b80aecfcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4a7d563dd43349d6f184affd9816f3c

SHA1
a6638aeb9e35eab69ce3d14b4ac23a96e4ebd42a

SHA256
bd84581c3005ffa69f474f997272e07566499a061250fb241a1088df4502e5db

SHA512
461bc944c9b6f71935f495940f7713c2a727b1d5e2dbb4b944d26db497b3ecaf97ee10741f783d7ad46192d51b0862eceb544dee4b87848d92c684479cf98c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ed82487fd0a9fac2f392acbcbcbb9fe

SHA1
846844cfc0e24ad77cc276ce154d8ad2c06d7ab0

SHA256
588a1d65095767558c927556d5a009b329dfdcaf5c5704e6fc1f257942bcd306

SHA512
f9bf85d0ca5808f3a92a7869ef2c013cbfc6d833a9df6f1b3aee8dd489b5ad1a336625d9b524f42f9c4bde28345d3e35f6a3d558ba559cf1d52ccf0ae98b657b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
366bb382894696c841bd59b1b326dbf3

SHA1
2da909d0d85cbbaf4aa42325acd3b9e2989e697f

SHA256
0c42a5e568315027f5388d159b1a5ec2371df8c5984baf16178bf286cf571c2f

SHA512
ff6b167adb06cad98568ad260272a403eb8578ad6633ca29ece5a1fcd05738f2138a9c7100bb953f3b390630613a037d5fb324bf5b93142b11e5a2fdb5e7cfca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ead03edb6f5e48e6c90a0a090659b4f

SHA1
599a6938a12d6bc067b8123641111c05804d5d6a

SHA256
4a94c4197abe387c16d34126524171e0703f1048ad7fbfdeb8a90ff9cc083188

SHA512
b6f16765eebfae902ff8ebcd45af05a0f2b0ad653ded80082ff108d6f9c0bb156e590786ed21dcd1468cdeccd538dc1faa259789bc210ddbff4fce6453fa915c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ed82959ac74280d0bec2611615305d

SHA1
558c49cbdf313ad4ac2b39a8d2700585d687de6c

SHA256
3b617c8b594d688f1853034b9ed5aa0c5be994690ca783275b5e08cb4241a450

SHA512
52f88e6dd4c2288b819ba9e0bb56120ca62759382a7ae1b2b4cd3ab8e21e4bda67afc9d30802bbd76e26b4aa1231856aac4af9805eab7ecdf5d17e1d74c83da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AC9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B5A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit