0a1ac32126e0d301f0b5eb5bb5c851db848a3349567bcbda27dc15fc68cbadf4

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12445575201c406fdcd2b6c59d7e417a.html
Size

1KB
MD5

12445575201c406fdcd2b6c59d7e417a
SHA1

1a42f06a6dcd22617f899e8eb0672d6dae02d59d
SHA256

0a1ac32126e0d301f0b5eb5bb5c851db848a3349567bcbda27dc15fc68cbadf4
SHA512

ed8d5d03c3e9b6ca0498e93d727a6c9d2894f00e704cd77dfda74ba727e01fcc78628d9e57f7437e5a61097e038aec59aa2c7445ec1c974ccb0293a3c3f5377b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410164390"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B86E571-A7A2-11EE-9021-5E4183A8FC47} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400dcce3ae3bda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000006db3bbdaead5f2a255eecf69f8af33996e3c42763fb20513b25d73c8f6a9cc8b000000000e8000000002000020000000d0a99ffcfd8483678583eb007c5f38457a205cb5ff81cb5bc5d1e039793a51bf20000000876d3e6c2b1d65a078ef1f39dee7c256f7d0555991fe5e0b750e0b039a48e96740000000ed6bd7c295019b358e09e55b4e4c4732542712872d5fd27f64c733789ba3f1b34bf6d7c5ac24de03cd72c40fc9f3a52c708d6a465421c8930d4f36930c7bddb0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000000d80a40f3069804d5cff5d5176dd5aedcacf2934fc779168e2276f69a086975c000000000e8000000002000020000000e9569c87059b9f3b3633761f76d39fbbbc2a39ff9c88d5e64ee45d512478003f90000000d1bed04f6d7fb2fa339f243a5b24c6ed2ee9959bbfd6a3e59a9db3e55316abcf36c91b7b7fa32948abb5bd6b8626a83b6c1a4b8d701db598d0a59fdfa38f528327913bc98c815e3b99de81763c9eae9acd80a46a21da99461acbd37a0f3173d4de21c923b9538fbdae41c48156a14a8d8241e4442f8493ca73f3324142518963d9bc3757bf1474e24779e26acfafa83a40000000404b36ee38373e70cb5aa83a73dc908508b4ece8fdb582a95275cb2a4116b3ca3ec9ca7172800fdf9c687cac57a4d6e0697a4ea1b4c4725410b04d9a4fdde7b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2184	2884	iexplore.exe	17
PID 2884 wrote to memory of 2184	2884	iexplore.exe	17
PID 2884 wrote to memory of 2184	2884	iexplore.exe	17
PID 2884 wrote to memory of 2184	2884	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12445575201c406fdcd2b6c59d7e417a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f3723c30edffbc6d10840ffadf5191

SHA1
bf5a47b115f69bd15de23e8bddcb770d2793a95d

SHA256
06197ff71233b99c4e8ec24a1be1a2d1b09aa2ab20f28b3de7ff745ca8651d62

SHA512
a0ceeb4d6ba6971c46450f6696bb6493de51a77078074052b98d19bdf6459fadf6d9b013b82626b50dd0d0228784ea1d9cbc93283e8df7a97e33741955436369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06dd53e24e8d84a3074c6db2ac62b922

SHA1
0aa915c528bac13b4361c9a64ed7a2cb5f4301c8

SHA256
6489be1bb7f803883a37947c2436faf735f6a06c0742da88e3291a370b553cd6

SHA512
b6ac983a1944c93267c83e7f156457751dcd22867f421217f7a715c86b62ac68f98bcb9a5205e8b51f6dec594db4eead1d7066932dac3f6794914656ad3247b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc86e803a798d69967a6a538bcdfe4a2

SHA1
c2c08e4b58bfe90821bc2f1e466aee3d7177348b

SHA256
527bf419052e268c419e96406d7f403d39c73b4bc4cd79c3987e5232f3e42804

SHA512
cafb74df6a139ab7925826efb1f367b62df850337f7c394e015b8e025fcd2db52ce9ebb4ea634fb83dd66b2010d2d11bb7cf1ef73e6b8304e7d1dceae8812ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06280e5983ab17dfc2bf19d6aa6ddb3c

SHA1
181f9195a5c9c7da752a595a0d616440f87d1915

SHA256
d542474f26e689835d1318cc8b6c4af582d33483edc447cc37bf060609b0c952

SHA512
de3452fe325a2b5b00bd8357e52f4b1ce6256337ae96c541fe93d95ec89d8e2fb93be0dab29c68fd9825c9869f9ec06c8fc5558b42720328471602046d1854ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2def3db015ea56eec4e54d94929a21c

SHA1
99c4cfdcecd6065f1784bbe7353fd9078d33b746

SHA256
f8107aa2c268fca84b0eab07daa597124bdcba82556bcbcfe0c9ef45b6d8939a

SHA512
9b4cb16f5af7e1c72c911fda4bbe18da25a84a6b291e2a4b934e373fd2fe4a1a140ca038e73a2764c03f431d635b46353b69da50d651ffd09dd205bedb52bdd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acaf94dd13c95cae505e4237a2fcff50

SHA1
475887193bc60b649f6fb4151eafee26cd4a7533

SHA256
b0b18afb7fc5b6c99e4cb8bf3405e94ab3e770053cda2ee5a164aa96e0a1e653

SHA512
620c401ccadafda260c6c510ede5c366a78086d2bbb0df3289642becb19ddff92a6312a387e2b4fbb9c46ed1fbf6eab34c18b68af3a9d4fb4d4e384de0b18789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdeb9aa2a3f0fa93c4c7369854628552

SHA1
2dcb291909af8894077dae677be061c84a38473e

SHA256
7cc7546f23ff6eb383fdcd91915641178dfd5045c4d6d4dafe6d85016ddee7f8

SHA512
b9a2d476a3aa4b4c32fbdd81f6b8a15aee325454e48619dcb34dc5e8ca81065b497481d1121f5b8a5629a6c773e82f866694b57b74f6a659934db7259a2a5dbc

Download Submit