528c883db8f578b181e3590e671dc2adf1f18f8a773b55799032bf3e86845b97

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12500aa8adc67634c025b47b091456ae.html
Size

2KB
MD5

12500aa8adc67634c025b47b091456ae
SHA1

cc444fb6f4b2b00a5a481ddea8dc0552fee6d5e6
SHA256

528c883db8f578b181e3590e671dc2adf1f18f8a773b55799032bf3e86845b97
SHA512

54c68bbc8ab65919f53d47c21af0685184a1a5708936b1feaa909a24212b844f017ec2a83f8049fc24bec71dfeb0c7ed95e4bb2c01bc6ef334e6735afb4617e2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69165FE1-A889-11EE-B1D6-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410263738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07eea3d963cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000015c7b523badc8634b265212a2e9dce5b2c406ca5473382007239bbd77a059532000000000e8000000002000020000000d00792d836958de6a7022a23e6017fc9abbd0a21e5eea14e00aba18141f7b86b2000000075947c63693122dd4f1727309cdc6779e8cca27e85a42dcde6f90b12da8623ba4000000079c66b5734ef48d5305341684e0a00a4b7a68930e885a9f5b237948484d8a2e0dd3ddd9a7698db7f17d17312d0165563eccadd4c322595a9872ee4b6380979bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007fa100bdaf938c6493cd96c40bfb3581e09df94cba1ee8c839d47ede49ce34ee000000000e8000000002000020000000edb3a34d4806262fbd8cc0af606c975556f2fbf59bda157da6eccae7a7a4f07990000000c588ee582cd9b4ce6aa452b4646669dcfcd2acfcb658e5866eef95a69396b6ebca85c304e5b9eaf61b2efb271205965062e1fbba4920be90b7afa76db749f77441930682251bfa68460f8307e13437523ec7d7b7039cd8444269c67c883c62a6dff4e721d512c2f268b0680bbbfce4e79d901a6f6eaddb454b3eb054aab4fe47c3e61d9cd466e5f074ad6f821ef6eff9400000009bc6db1ef99ecee1bf32e5be2eb1826639fdb5641842f9aa06695c62fabd027473907436af21f896f0d7e5bdbbe81573f5ec6de358f695e89b9a925f2551424e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2360	1724	iexplore.exe	28
PID 1724 wrote to memory of 2360	1724	iexplore.exe	28
PID 1724 wrote to memory of 2360	1724	iexplore.exe	28
PID 1724 wrote to memory of 2360	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12500aa8adc67634c025b47b091456ae.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70c406148576958b448aceef6c22645b

SHA1
4d315b48035c888f5c2ce7ce83cd9ab704e2e2df

SHA256
10406ed38124880d285b6b51f36158d0c193baa997c3184eeaeb579f1b16d211

SHA512
f81dd126b7deb833d8a6bc9bee55a9a7105e0b8aef6e22081bb7c442c9b711a8bb8335944fb677598576b40262bb7bc25af10300fa12eac15df68c8a19c3702f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8efaff54770d2a0919895255bee56e11

SHA1
e6181b049991b20372245fb71e18a5977e508792

SHA256
24d3de0a9008771d1dd2fa0dda67d2e1531d7f9355afd9224d3be5b487d8c1fd

SHA512
e39991a5fd9a2b007af71defeda4eff4c31a277c4134102952407bede554f9f880bcadfd24a9de37c0091a88faf536838db35757f58622c345ccc23a8b60a5c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05046d239c510ade89ffb2299ef18382

SHA1
2c9c45432e363aaa744893495cfdc327bf2fd1eb

SHA256
b0e9660adc034fb9df5472f380e5abc5465f0e7a7293d832a6ec51ab0ee94f62

SHA512
8a38ef237e81a5c055fc2ff869dbdd56c1e5de21f82d6c363796709ae79d7dbde8569ac2cb36d88980e58dc6da9c0ee1c1bb921b88f14bf67861df0584570cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eb5bc7ad30734ad99a3d14ee96ffbdf

SHA1
f3128ef41ba027b49856ff9bfaf0be11a8464d33

SHA256
a26ec72984b2d4fb16a8647b77e221a1089e4019e114c8bf3a4890862eb2090d

SHA512
02f541f679a3752a0462e45783aa7132a4f393e548fcec945199c52f9aa46d0cd811892a37faf1e338b2775b36f8bfdc72dbcb98513d59e761df65487ffa4688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
563b0c1973a2fe99806a1d0b4ee2a519

SHA1
2b9f95d3a3157843ee856df983efead668d21390

SHA256
c4cf8d67a11f7f6ee6d82b0e1566eb7cd69215fbe93552e2196758b7452603ef

SHA512
136255a4f7d06acb3ea43e8e5e4b094f270b6656e495c39ef4d7c32d260a9d5c73255f8224a1099adb749d354eddc49768d5591cb71ded27ffff0ba060d6b97e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f845dcab78ef24c03db5e8fa0c6468fd

SHA1
07bc95bbc1c339f66a8fb8ff96a036b7650bea1d

SHA256
c4a9e6116144085a0b7cb00b077419734aa770a4e1db2d9d71c5c846ee8d7dda

SHA512
a0347ed5a9d76cbde25ca2604410605f79df367f33fe3b825ba35e27baad960f8e58b326121bd5265c7c02a85f46d88d99804c9a104f16b0e92dd037073f3690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4120f97e9b5295c3521f7865e1b24848

SHA1
f509fdcbbe00d119310b708c0073d129f576bb51

SHA256
53f28d4fe611d76c99e56ddadce6fc836df7b35f3cbfff83b854976a41502adc

SHA512
20c7dea6838b190c0c62d972f71f72ab29a51b27164c048baa3ee7e1cd3e34769838df10ee47669a1d96dddba8f43051fd6df0b2f785a59e723b36ec69b09a00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2f76ee4013d02eb3067ac2a488669fc

SHA1
fb0e4d27e63e36c8ee16cf0eb2cd039249797e47

SHA256
b56b1fd26f2f4464fbd4c365ac53702b293f4928a7b964cd18679d862160699a

SHA512
1293e987ff003e6e2d4d9acb8d1314618579e37c195269cdfff5a03d2bdec6dd1798fb7e90462224af571b93f57a835f96fcddc6bcc86f3fe8cd49474b8aa14b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4185d49a387bfd80e7f8df2f9eb6ec8

SHA1
42bb0fbcd386abc6237f4817b3199653f60288cc

SHA256
0fa05c7b6cf42e202b057ab49812d0a36f2f916266967d923b5a655a5541115d

SHA512
2a07f6d130a1102816bcdefa57b1468ab6ad26f61e3bccd0fed5c69eccca364320ad61c77902a2a95a56bfd2cdfb9b61c7efd2db5baf802de860a5967180a43a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d81c300b0c6917fd5bad58144a0267fc

SHA1
0ee9e1a04d70c9681a8b4dd166d35a5d2bf16df6

SHA256
22813453d801d57d2d4c2192ecb93001d73b77ab49b2605537255d7534c12980

SHA512
6f4e729046554cd222cd1ff5cd83476473c854e2ae467a7f1eb0f601b3e57911a90d0fe78e207791070dc3092ba27ef91eeb6b9aabd1fdd55d9902ed19700c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a45e7177ab5d0a3d48965eb81b087f85

SHA1
eea7fb941320e441be6472539047e19fc9ffedac

SHA256
9948043d2d16a52c9053603d532b8f4f023aae783008a4db60a9bf5e1cc76787

SHA512
f7726e8e43b324604068fb92bc14d10a7ea0aadb85dd66ceef170adcce64816c6e77c14292bacabb44b687220ae4d09427a06af3662cd994d3b3645934f6ebf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38201c26c938237e024783478f295dc9

SHA1
08102fc50d2363680765d4afaf700d65ab7f3f3e

SHA256
3d499ea7f3353c4153116f7236f84734d0092b8202ea8d4a29705c78304a70c0

SHA512
f7c3dacbdab7f9cf2be4595ede9c2067d26293235d0dc0c009594588489132f85366918028045df3817c518498e46d43c4f44923ddbdb97269f21f2de3f5793a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49702cc716c2d4abf8fe0e9c326204c3

SHA1
68afeb8ce3d819c81e789e1370d743adc47adc00

SHA256
0d782b6e442b4270b0291291e9061c2620e06c5fe95b40a766de9acd12fc56d8

SHA512
0980a4f89e0b1ed93cc4105b901edd5c1bf6b902b8d777768f821e817562e14bd87f856da4e0d23b40ed7c63e9b4b7ae51bb36983f86079938348d645ed0bf33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A05.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AF2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit