96c1d7e12c793a9c8265ceb113813f4403408539ba38a88466b157ef71eedc2a

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

116560a2c754e4d2933e96729ec33614.html
Size

601B
MD5

116560a2c754e4d2933e96729ec33614
SHA1

da87b6d028a42dcc00cac72cb355860a63f5ea11
SHA256

96c1d7e12c793a9c8265ceb113813f4403408539ba38a88466b157ef71eedc2a
SHA512

50572edde32148ffe76fd71dc6072477a37dd646ede9d0374117ae9f1ebccad04117b214e0c3d9cf5d7f21a13d6aeb770094ae12547422269254a7bb37e7d25e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c6f6d0518bb665826466fa6dd2d1ed957112625a66e114ce92d98bef3c0077e7000000000e80000000020000200000007a6e4844f2ca42b6610cec4e345f34a87c5ae5896f374bd71fff3834cb56e833900000004d43a741f3ebf6b32d04ecf2819b97677e4aaf72ef6c21fc5bebfbd84fc9b016e1b8370ec209da3b0ceb2592b5cd9bee6dc432d9a353b3eb595e1839e75b535f2ec22ed06b32a6ce79a8992223450d5049ffc808ba0f167616c7cce654038fa0a839100751eae75f8d00ee804334f9d0de190484e331c027dfe01e23a1a20c8346152c042f87186d0402ebf04e85de1140000000d2d6cff657ba63d5459ed13f5be8158abf153937dbffbfb782132e23da44fc66e6254a957a21a5213cfff9b3cba73728e9bc1bfbbff446f9802795205368e39a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED33C531-A86E-11EE-BF28-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410252366"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f982b37b3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000db62b86a901a6067940e44540e5f4d99b00134cd0c5e6589d9089b40cb7163a0000000000e8000000002000020000000b36bd382b1a87e69c8baaa8b73f03d92a901412df48e26d003bb4644d66dbb602000000092e522c1f858d10422d4901dcd511e03c031bb86db37fe1415c55ff82987182e40000000bc79b7826a94687e16124c545114dffbeab57877c7af6146307048b41490e9cffe3103109b5408a9d522989debbd62020ab80159a338edf2da6b7645904cb6ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2080	2300	iexplore.exe	28
PID 2300 wrote to memory of 2080	2300	iexplore.exe	28
PID 2300 wrote to memory of 2080	2300	iexplore.exe	28
PID 2300 wrote to memory of 2080	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\116560a2c754e4d2933e96729ec33614.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e90a0dbdc4b30b3b91f614798d5ec071

SHA1
fd172a371ac36c2c2526d5423e845b6da9fd7557

SHA256
097352164044ac64ced94c51cd9049a95dc5180d04fb294d72a00982204e9094

SHA512
8cccfbb3164e8f1e3ecc113fae8df13443d9f2136fceb7a7fdb0fcdda9d4f26f6e33af4be8b975fc2e52d52accc5f2b80f1f36a1f822c1b0f32583aba13aacc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c846ff40d41dd0ce294f5f05a24e57d

SHA1
978fe91da48d721d382a1df6d2b8688d92427a3f

SHA256
8f6c317c5c8f286d81fb58290c63f81e66ca41035a7ebd6bb03f94d0dd9e5934

SHA512
80d5134508ea0b6b132930c56bdedd1b598581e6856648e91cff93114a3c862f41b46fbe02dabf209aee8d4e8e6e9bc7a35140e52a28fa3be8869f2ad907d7b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a450e9b2c664204a07a55d7776cc3bf

SHA1
c75b87e4fbf402e0a427c1906e5653d3e1547cea

SHA256
71f4f4939d3d3b33229a95f38ae8c2cb5d4c8d65c4fbaefb3cae286e536f30d7

SHA512
601ee6e5561620aed8deb8337955ff8eb33a27d15789a02651dd3ab4e77d14079597da0287c2c2940fbe6bf38100b9361815909fdfc94bf7a17ecb21e94695d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c488ff711a3dff13605ad63f26b07570

SHA1
aab8e39ae8f8c656336a9f5804ed15cb1c5382f0

SHA256
e7c1e4a93ef11883b430fc746594a4a591c3a61b69b21991a54e0db689a4d3b5

SHA512
cd7cd0d29ad96143a0d15933f35d6a8180e8e10fec2e99c329513902b020b0b65f82288b229a8b566fa2059e6ca138362948d4886748d2dd4b7afeb3b6bc6da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40fb459acbe063a21932f2df31718ddc

SHA1
d0ea47609fa7c76f82f8bf2cb57fd492cc246daa

SHA256
00d56c6fb8ebbe3925bbf0f983f9ce16668ef45e8970ae5aeb1d47b74005f0ec

SHA512
3d81282d05869944254d1a8de5c936f2c683d4e7dc78e548744233ec4c0ed9ee203bbbf790c995a8a27f9e0f4e9a6ca9224c57ea3612e224b152ca023daa0af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dfe130311f5fbac1431fd926c5f1324

SHA1
e64aa62830c71359751af1e47bcb375510dccb9b

SHA256
87175afa29068a96305b621fcd44a8a6beb8b3261f2546c1c2f212fc32cd2f0c

SHA512
841f7b8cf82326bd68b6be94618758aaeb540dc2c2eaac4765a3881a13ea6d63fee597eb3a5587be5bfcca33f98f58f350e8500536d266ee6e84194f63ff3997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8610f2e8e17c5f69d1dd546b283eb136

SHA1
16859276e3661ab62f7be5b8ef8863e228b09cdc

SHA256
54d0b9ab75b67d249c2a61113e7bcbcec3d4a0bd28ce4ef113009c5c91eb853c

SHA512
6a54a913c45c234f399ef10433249ca5adda1c15483d23097bf91fbeba3768d21580ca2e3b905101fbcdcc3d2ee56b242e376ccb72468b923a104d8ece7de531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba551a72dfe8633773e29967e4789848

SHA1
10dd45c03fbcbea48fa471113bd8bcfc09c3708b

SHA256
7165f719a8ef6ca21ae4f19cdb781e62742e7e2ce5e06bbd14546513f3801fee

SHA512
6dd696f59f49221d9377ef6dd246aaac73400b91a423684a10b3477a3d557a1265e188b685fed7f5b589d1814a377186d2a7252631d8e6a8d2760d342cc60326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecdf8b5bcf3fdecf68e7c35c59701e96

SHA1
38cae4631d7fbae5c6b91893fcc0f06f872d6b26

SHA256
6620280b08b5f870cb9713ec370cc4d2483864377c79c3e13e60389f92aece57

SHA512
f2508743163b9822fc11148e36c910827e5bccd82d1bad266477c89a80de84fcb27217ed7d0f8e5748a84a367649b88f9ac7470167a58715bd3c70cfa1eaf358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b81dad5062ae4164e5c6a5047c1ed9a

SHA1
b384e1403672a457f21e1e14d7b87a3e11545a88

SHA256
bcad186eccb1fc5523ef65567a719227fdb2a2ddb3a1fcfa165849bc5d534368

SHA512
ce677098d48443fc7133ae04601939a794559e9b5acd1e8e7be66686f20dcefda510ba1dcef5c3a90f20e391e09501a704c9733ff39a070902cddf701e2a1fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e5356e2677ce6eb2cb2b3c0be00956b

SHA1
baea17e51dcbdf361abe7fbd103f4c62ced0fd2b

SHA256
082666b151b48d6ecdd46627d64c33f8dbcba5b8a240f3323ed239b9e3b38d2f

SHA512
d4a4e305ac0563f30e501aef8e507fc5b758eb0e9285edaf417b3ec50d381768cfba8b38f95f50187edd076f0ee5306df59b23536ef168c68d74586a0e537602

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5939.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar597B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit