78fc11beff0fd6ce44ad6c1d462a8031b6585860bee5a560382cbc2750284c53

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10955d8519ff2ae16453ca8560e15007.html
Size

3KB
MD5

10955d8519ff2ae16453ca8560e15007
SHA1

41cde241dcb66e76e3b40d646fc08deb20ba9e99
SHA256

78fc11beff0fd6ce44ad6c1d462a8031b6585860bee5a560382cbc2750284c53
SHA512

7d7cb357efa2030d213fcce625c8ee503de6fdc6eea890fbafd20096d9479a89a5881549dc1e15129a2e2d5563f99c01ff066826be8e51fb8316276b39f3f5e8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003f5c80a3e1587fa710150becf5f9d74fba6e67f948a3df46215ce666696dc7cf000000000e8000000002000020000000faaf3410cf3ecdb9e0ec553f67ab18a470d5b3aa3914bc804e275424dd0bf210900000004e9d653ac48d40e3bdf06182079239ae0cf278baa4dc42212209da10dcf15fa8536acfd4e8f4041e106d6ecdd0181f98866b8a9d9bfbb72fbeb94150c2c1875cda1d02b0e87adea4478777523297178af51a87fac91c950522fd5aebf50555b89e9322a1242c128b2a70ab95a2e634cb900f25f1bc686838c662d0c6cd7f1b67a946fa05ec3c5145a05e2fd5d8047c1640000000aefcffec679651ab17ed7157606954bea665336d47f04f2ac9c778568eb9222c523652cdd4b51c33707cab6e11e79a3039a80dc1de91a30e1eb60ec424c6a42c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410151739"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700b0d8d913bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A634CD41-A784-11EE-BA23-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005d9014adc3e5189bb2deeceb5cc6dcf663a6f2a931b4a8de2988d239df26f96a000000000e80000000020000200000007f5d4acbdb03f9eb4a5244f81c169a80f0f3b6995fcaa7b15ae7409ca7afac962000000095712cbae722deedd88f459b8acfae34bb730617d46d1f0af0a1ea7d268e02ea400000005754ab60818bedfe5e60c468697e93beb7c4c983cea4711b9aaad56fb9cd30056d3de97a1b865facb6873fbbbbb93a390c3d65cc09c533de93fad4556a5de389	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2904	2960	iexplore.exe	28
PID 2960 wrote to memory of 2904	2960	iexplore.exe	28
PID 2960 wrote to memory of 2904	2960	iexplore.exe	28
PID 2960 wrote to memory of 2904	2960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10955d8519ff2ae16453ca8560e15007.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5103daa8e4e7625944b13c0a0c0a0d2f

SHA1
8ddea8f0a363854b81fdf2a68270b255d9c36818

SHA256
e4a280aa1014d1f8e278d411f94d7bbf1028be5689e68bc1e024adcb823afbb0

SHA512
51527cf4fc319d0fa3fbc953e6c0811bf14c27719a1c16e52bc016beeecd51ec2e1f7441b06cdd8cec073eaab108eb991bb44674f37cb995f40b942ae330c67a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c76c08a3e09d933c7a5c154604191919

SHA1
be68a11f1e2c7a7949a6d2bc673442dade6fbdbe

SHA256
f8dd46a3162068ac4befeeef02d0a1b6c019ffa3ed80edd2e03d1e4a3eec5753

SHA512
6cf1a30a19f67ffe9db8a41edc05fdef800dcb8a0691760acb365c9d968864bc68376af1380f6c7749f74b4ff947de3ac956414baa6a4a3c1132dc2b0a577a1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3945b66d1590bd43a6021f6f188050e

SHA1
f68b3b877c3e7955ba264460dec69a625388bba2

SHA256
4febe4580120eb9ac640c00368ecba32ce42e20586c067c98cbf30e2a3f03e34

SHA512
d8d9cf3210189edb8caeabdb74e23ba1dcc76c60a380705a2f2764724de6ab93256082e01c09d81c930c142840ae6f780d93d9ab09e36307dbc0b72edf6710a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b2cc2cced04692d0b4f8bc5dbb76f5c

SHA1
b30dab1b1d7bbea61065db1e83f619ff00748df1

SHA256
338433c464dea535027653234d902bf611e2e5b7bbb84b26327b2335126a6963

SHA512
6688e869716359255c6a8408ef1a6b604b4d9b757e49922cf82cc34567e4324d1fed6cc86ef776cd9707a5711ef9be445f645d062d66a05c09ae82a828a3fb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d2b55f2e44b9f1975fc44cc6d1341da

SHA1
b042a1537ddf25612e19570437827b64e3e937bd

SHA256
fcfb1b170bb49a975109f72a05b4b736f1021c33ec9edeb84d86f37464608287

SHA512
2af59a9826b0dafca0dc3f597758bcc93892926b7adec050f1a7d6680b7788ebe7cfa8361001af9dfd4d7b8e463cf9c9faf9ae2f22216a74636a3651c9685fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9176dd411a3251810f2b5a8b6590aa98

SHA1
496db03349fbeab9cbd0795a3f5804bd42073599

SHA256
e9ad242a4c1717acf87aa0203258159eb262a0316f74a6c6a63347db457a64d5

SHA512
9ceb28b54a3c16f0b0862450096283c45de4f39da814996badcaa4a612a72b722083c7602b0262b85707d6715b28bae254cf25c6879e0582f7b28b62976b1fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6dadafda1ac794466688bad09788a88

SHA1
2be99d712d33ec0721fa3b2a0d97a6b15befbf91

SHA256
11623398ab08486d817044fc51e99e0fc3cf3dca7de88d19d48f1d834f71547a

SHA512
d4cb26d7628abf84f1a2ac57007cafaa30b04d3b6f9a9539bdb54e4a0c4b92fef9147987ab96bfded80f7170ccd44114de38999a462cc5aa0c81d14cd5de748a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25996c94faeb6f228ad6edc1f595b2b6

SHA1
975724fda6e0fd37292f7ca4a50d42a1165e605c

SHA256
aa0593903216413ec400e6a4758e1d7f796bd7c71eddb9961d1aa204a58b2975

SHA512
cfbb36be6f984efbbc73506ad4821236dee25842eb257f03772bfd3bd7462c487d4c423af391993c9b74fc411f2ca72c441cec989512cef6aea8d890a83106b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff99e2cae8f82b4e19c5c02d11898491

SHA1
238c8bcfa45f0006fa29510e20c084d89dea4bb5

SHA256
079974f688c13bdf338466de014b36eef49be9564583116676053973aac490c3

SHA512
9b09a7e90614cc647b5af96521dd188c39238a260f3996290f7f475ac6b03b85b039f173fad08f1d3e9495ede36ff86b5032ebeb6abd6b9fa5c4484ebd47f14c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
816962dd967fbabf4e8869590d097ea9

SHA1
bd42c390444e4d056180a68033d9e355037f6167

SHA256
232b420add0072b6426671c6ffc6b97490fcf75b298ab7e84bfeb14263d0c1c8

SHA512
1c2885c5c032b883d870496a8a42754d3969bdcf33968bba6046434538d8672b0fe0d9d0bcfd22c8933abef01e0db0c3c094065c411b4f1d4188c008df278139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09259253dbddde10e856796f2b5723dc

SHA1
2911b2002e7c5bb727496f493efc9f80201da579

SHA256
553d7e8d00e0400f22eb4d2de3af0fa0764297dcfe9efb43b711636546873df8

SHA512
592822fc1c5d88d94235ab450e10529262a946f828e777c5fe83a726ee322aee6ccccafc0052bfbf59671dfc9ae416578bacf70e2282f29d8d5089c818128e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17f76a402132af6c580620ae9ba1dd36

SHA1
32bb37773ef89b606792d8c079a464455c4e96f7

SHA256
09158ad83d5a7aac06f3bc84df5c6d21669648729b5939663a3f98cd741d89c8

SHA512
6807063ff5d86e41670ea66cd77b1fa817aadf9a04f7a4a5016a49b969ca2b2d8781a154fceecfa18f00a11a1131007a1c1b000e675a51be0a43d4e2031734e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a260fe5043a9aeb6a982458c6f97503

SHA1
e2187a3009b600c3b442df06f695d55c3c426d75

SHA256
e80966500facc23721e96ffb375cb997ba4b61fca801680240f1f0d77c8a82fb

SHA512
f62c293255fce870defba1d5ad0435a39e0b1795ccace1e40f03ffc8ad7a3893fc8523d726fd567533e2689bb33246a4b4ec756edf6eb5adb4c2b770b2779057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4438348c337f4d1b1ddda5f91b60449c

SHA1
2f42fb9a281f813f8402ad30c54206c56845fb4d

SHA256
73557356cba3600793fef50f8bb8e71132e7f064a757aab5cfaf175795a9f0c3

SHA512
45dbe8e34b563b0093cf060512d11c622a0e30abafd3b9e3a6a843e2b3c702a8717806d11a27300015e21914d6a1685739d49fa7a299f94c075327a2523596aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505d34072630437ef1e9001c2bd69f70

SHA1
0ae4a88b57e5d3b1fd7e0a75a306e84ec595c41c

SHA256
1d139cd3e1e686cd6a108116a2d0aeb8891550eb0e8c76d21bbdeab14a9710dd

SHA512
606d339a31504969809da750e2c0cafbe95a0976724841edac705ba332cd646061a548cf34514360c59b0e102068f5285c5d34bde093423ff538d38a7f0ff5e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d30dda9b8f915e35c570ececc0458d5f

SHA1
4d60fd1f5e36eff53ca91f81d9c448c1c31dca63

SHA256
462ddd8083a2ccc1ae70524b6b5aac5454e132545a451486cb800e0154e3e00c

SHA512
deaa0af51a0317aaa8391617e38683ad9175cf5c47143f0f9fc40114c5c11f447b4938d49bc3b5dd857521971ce5c876be11bf12598e3d576276c261b5359fde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
730b64a980490d3ce422d43110d4426c

SHA1
664aa23d6bc2f78414609e827ba9ac4e38c0ad4e

SHA256
10e55b21ba8b64aafad5b8ff544ce6e8777bc72cc51ef77fe1b1b27f9f6cabc4

SHA512
046c190b56bd8f7683a7083f063905a130e8086c1b1c7122a8533bca5f9810ec3192a0474d430558f97d614e01e3734a77d32572108e84fd3b224f8519613c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b90f9363d144f3335a75475a18953c67

SHA1
8a56a269409bba9968992be6eb276c4e7dc2ccf6

SHA256
718b0c90512a2cd06e32c7ab580158e251dc84633dae9c64b87a1e0f0c64dcf2

SHA512
af6daed377a4d3204bb55ef85d4e12f1bc72fc2989be04dbc692f44ec7d882302063a8208b7cb788b2aea2396eaede041a68d94c5f4fa8e441bd4af82ec812d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFDE1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE9F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit