c6d4bdb4e65a93e4223ef7a150be835bec84dd1032519d2720eefc588e0a8cc6

Analysis

max time kernel
120s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fa1fc7ce391c6859b316c4813c58854.html
Size

2KB
MD5

0fa1fc7ce391c6859b316c4813c58854
SHA1

dff8ab1c0196d563ba72711b4c74d1ea688fc54e
SHA256

c6d4bdb4e65a93e4223ef7a150be835bec84dd1032519d2720eefc588e0a8cc6
SHA512

2970850ec3047dadcca3941a8437ceb5245745cfc210ce27ff68186d5d3cf08409c177bc2b72ceb8bb707c7feb0ec6634774ed0d5d355ee19c5a51f562e8fe76

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000870f0f9564d07ee5de7602731854bed676d9509aaec4ee1335367a33520b65ee000000000e8000000002000020000000161e379fc27990ffd27a676f0b52a9f31bd496777ff50189c97209fb1112085b20000000f2d19d7969e3f739e0de5b690f8d1c3ff91abed3855e2a15f76772d51edd4d6840000000ec28295be59365bb893d87998dc3a778fec5989389f61110df82d3365b6f4af613c021466f8041b07597f4a0ebdde010c383f9fbc6a9a86cf35d9f5e6bee3d3d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410230777"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e1bbc483569be3b74170b13d61432f0078a463bb281491010f60b2df3f8e1c64000000000e8000000002000020000000d85c5050438849f09367fa6218fac7c015d63533e34ef903e3c79c200d9aee8590000000fe8632616227bbec1ceea4ce627e3b76ca381d65e7fd5e2b0d490123fab59cc1834d1b7ede647cd5633dc0688a1995cdc86b2284ecfbaba93f4de600f318ad60e3e0bd4999be289d98aa43a7f72f2e93951e84205f3461c7dabecc6efba4eb7ffc380cc7556a08557ea1676aca871c0ca65cc543d71e75a37efd9e48714f39dfe4b67ca2d2b08d8942709f9d0fd3590540000000aa2f660c7e90655b44d0730f947868d607dacf715f8ea930b45d45affc71de1c9eb49a81ce76e57e7395cab78b28935c1aa9f9d83197bf9a9ec4f81ad50e42e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A94D0FC1-A83C-11EE-B517-EED0D7A1BF98} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a3ab88493cda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2708	2124	iexplore.exe	28
PID 2124 wrote to memory of 2708	2124	iexplore.exe	28
PID 2124 wrote to memory of 2708	2124	iexplore.exe	28
PID 2124 wrote to memory of 2708	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fa1fc7ce391c6859b316c4813c58854.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84bc4b91b43979b963e4ed466167d10c

SHA1
eacbf7bd35d69e172216ad5d20d99fb1d1c073a3

SHA256
8aa9ec7170bda066df53cd306865bac60545c8851d415a67e2f0b8697902875d

SHA512
6bd7274538008bf3bd23a7d6b376672691cfb60eb8976fc6e74ae2f67c96d23d8700011e07a66f8c6bd7bbac604e15c0b3b944b1005ddcee8ea331541a52fd06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe9ca4430e9bfe3037326140c0449cea

SHA1
9a0895e386b40a1658637ad5f50100b39f71a4c0

SHA256
98edb9f86487b4bf344e60db03a6013078c0654397ed4d47a740e6f7723c45c7

SHA512
2adcdcafcd827856717f609051ae68bd81b3201360caf384236fab73969c5cfb3c35913882bd5b8aa958c82c57836b19cdb0304f1cff9561320816e91473b792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eabd160c06b6867f84c47f7944cd82c4

SHA1
51614979ca819148e4ee283ad40128fa283546d6

SHA256
bd264d1c95b230ad43b483c6abc9ed8591f41e12245fce6ccf9fc5e406bbf499

SHA512
4d27005bf543613548dd52010f7d8c3c0b8cb8bf9027ea4ad6c1a848ddca5d7b985a998404810afa00a75efce4f4571ba7d424ae95f9138e28074d901784cb45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c41e3f6cdd4d113532bab3d2e8027cee

SHA1
8b12dbc8e9ca823c4184a8d6e56a8f7a3ec999c3

SHA256
2506bbb02a92a5e8918f891887fed63c0645041e7b6915d17ae5b5fc66cf41dc

SHA512
8767940b847573e8884f2c51a7af88fff7a0a24f43e64483d957393c77413b3f792985c96a1c74a40fd0794cd0503b0645d625f76ff3abe27731889e3b4b5744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57a140d7867860f26f0c7e09c631b1af

SHA1
328c9a24675e3c08167e2f6921167b7c82bfbdb3

SHA256
1b50cfba1c9c4e6240c14e6037e9b72b15241aa685ee6535e9067ebc12d99f65

SHA512
578bfbc515f34248ed6042b69838bcbc4f695518220eca5ee9ae05b310e7ea5ca2426ee7e79a038d78b6963fe2584d47a67046c273b5373f385ae6c0b7578169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca751e8a82f7a2d3ec57e9ac4c6613a1

SHA1
f327b5da5c3f62c255aef1286e03f4f54c3f0c73

SHA256
53e015fdb3cc26d5749144350900f6733df8e8057d2112cdd6ef6b9fd4246653

SHA512
f1f593c942c787fd4a73d9c04dc0433b12e2f7b93efa5d51e88023ed0d001d9f19a139b97b24c50db8bbdb86bd5fd9c0f02addff84ffe4a0cc2bd9c49596e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE801.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF482.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit