58e547e4188c62fe221e70721787f76fe4e3e79778f7cd34c6f7162a62cbddf1

Analysis

max time kernel
122s
max time network
172s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12f0c1f5d9de90c0e712c29758c29ac9.html
Size

1KB
MD5

12f0c1f5d9de90c0e712c29758c29ac9
SHA1

e938c60615c30c750fbcd17a70b56facda5925c2
SHA256

58e547e4188c62fe221e70721787f76fe4e3e79778f7cd34c6f7162a62cbddf1
SHA512

c597f11442dd57963e05b242f5f4be674faf0689e1fdb983526c87d33067f7b235cbfd8e951a0bb018049b9de2096651f141341815e39c993093be201f1014ef

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D1CCDC0-A7AD-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410169308"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000507b849959d3af3e147d841a110941aec4ab348f54ae431dc9bbad8188600288000000000e80000000020000200000009a8103a4901b0266a88ab84e2a45385dd7587a069ce3688b31b6711d570cdb2b200000004e3b1fa97c28496088cecd2659547bbcc085e807e8cfcc4c8e4c2e06cb77e3de40000000e4b7b01a6c18d12f295c373a13c86d98f3449dad1c0c091ae430d51bd2901e84cb979c8dc1394020a7336df515cc08bbd22dc181683391aed7215db712b01952	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000009651a3d35ff79cd5b15db9a0c05f5643f51183d123bd2dc7a3c0c40e60892e64000000000e8000000002000020000000c5ae3e7d6eb9b1ae94ddcf46ca162a0c1f9ea7821b0b0b9a06fcba83124ae4a290000000943f196b10f959ec7e7a43baa68ab1a36a20e5c6122885613f8792df69ab7ef8264352b1c69acf6547617216cd5f9886d2014b9dc64ccd434a656f5890bb7d06b106a08fb5ccbb26a229e9e644c9a48a924e334dc95f6cf3b8b1dfd129f344c7e4a123b73ed06d6f11f6f596c759b1a2df2401e8f40350a3100600a8d59f676db26a4fa5f8eef85e9681cc2676544af640000000d5b13631c1763548462e40e2a4e93f199fbf976b4d2f35b331582a820284bf5947912efe9aa90fb68926e98b11511ef852c7c48e256d0e32e97d57ebef039aa4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04d8e62ba3bda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2812	2104	iexplore.exe	28
PID 2104 wrote to memory of 2812	2104	iexplore.exe	28
PID 2104 wrote to memory of 2812	2104	iexplore.exe	28
PID 2104 wrote to memory of 2812	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12f0c1f5d9de90c0e712c29758c29ac9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a68a197782cf356c0ace847ea3ca3ba

SHA1
14a6ade2926804b910ffa69a453992c1f53fb0cf

SHA256
3884165e72b848b9e506b373b92b45d4260d5d798f908cb0e9f7094dbfc956d4

SHA512
16c32fb3353a327d81aaafe9640e6827f7709a259d9d7a4accd777dd9554b4aa42ff00449776e9e2e21fe05525cd6e93c5a09abf9d7065e914ccaa0e329a7009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44dcfbd251a8972bf088e3660499e29b

SHA1
1f3b5d7a45554216a5bf4b660717186a3b21d2e0

SHA256
e17aee29e9d0455050af3f14a0e69485b4767db41864fc466e259a52c66c94ef

SHA512
46aaac09f4cb32433fd0f759bae1aee7cb035bd7abe7f82a1d39ce25bb0b560e1c6d9e6f0a060e22847271f29bffa6cd7fcb4810261bd4c0532a9c7447e89921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e06367bde02a0fd3ddac91f60c5e48

SHA1
c2f7789bfcc865ed4b370de09ef6350180d2c5dc

SHA256
fbfcafe36ab5511ddb3870028b3022cfd51575cfe3fe947ea5cfdedad01bf0a4

SHA512
1aecbde459c476cd8e9cc5497f2bd0cddc5cb5ebd999585548d346f98512b2d94847e0f337876be56788a8c55e9053f789dd3696e0a867af94695f1f1e6cefc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
763932fb128cd19a1bac080d2181533c

SHA1
da4993ec6646e488cdb97968830da422c38cf381

SHA256
cbe265c7cbac70d5183bf1d6fb00d6107252b86211ba2442dfada636ff8c0176

SHA512
3f5de0c2542e4fafa061c44da2e9394daa1345742cc0c28f18cf41fbbf4031498687c67b06e716761f71ce1d764974d0135a3242e8e1ace8b16ebfdc1c64f49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e854e680f09eefc1cbc28c39d8f9f67e

SHA1
00d34b70208e623bd1c9ac3023e40fae3bcdfa7a

SHA256
8151cb91f7f83cb29e38167dcef5283a3116fe7f12513b369dbf946dfa5f970d

SHA512
572c49a977e839deef27ad3468e901c3ef04cdc1becde5712113dbe57413061113880304bf8c40440a00d8a4b63252d50942270c87897f922d65d71e9e170025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69ba8762788dbf1341eee4b42c7cd427

SHA1
3db5a07413f32b954a33cbc20c3e692424d581d6

SHA256
1f25c8b8d87594cf46002d9062f027296edb4c936a2554ea24205df781513cdc

SHA512
e2ca9c04d720b2215184127cdf0d06aae1a1aee578ba5e9f5009a5c8bc81b88f863d75cef7598999b8335a150cfc910c0888aff177b0cc94b43ced2d4bd870b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e38dc1310b7e24f0597bf04b5d04c68

SHA1
d293adfd35d514efef285ed06ac5b9872eebcaec

SHA256
99b3068cdc062e608d5296388c58df04590bfc3504831f14855a97a1358c4749

SHA512
71792916bb35ec91bdfee80d5299a5d8c73658c078b60a82a696506dfef91b8d7e3f746038f2d8e4c90de33bb187374d6c9c7bca01a53f76b362207ff216b650

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE3CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE43D.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit