91925ee1889515af2c6c28e0fbcef385d2c0c7b87571eb442155cef3e2474e84

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ed555fc857e3722ac2b1569be4308f.html
Size

432B
MD5

13ed555fc857e3722ac2b1569be4308f
SHA1

66aa2e1ebc0a6e3faac3df974b7f60d18aa78f9d
SHA256

91925ee1889515af2c6c28e0fbcef385d2c0c7b87571eb442155cef3e2474e84
SHA512

d2046269cbd54d16efd363939f41e53ab0bcecd65c6f8af1f256738f9dfc08e88d1af3426995fbf2e82d01f9ed8ae3077dce4e5a2ec098c1ed3df7b5257b9602

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410176407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000004796b232f820a406b3f7b4092a5a0fe549e77bbf1c8d28019bb335e739b01d49000000000e8000000002000020000000c079ad03a7ed795e610b50fc063a9d452c0ea76d5524a7c6fc71460af9036eaf2000000062e76201ee1e223c454433b1933b51d38efab410b1da7b90277a03d3e841481c400000003d4e0e4f9d6816df662ade5cf06e7e9c541b36b66d7fe4dca4d39296b8447f3fdefa5dc0bd44ae78ff0e3e2154660302175b7f29b1b1d4d77c145ec881224886	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000033c778a0711b4fc40ee9c92d4d2b28fa5687decb8971d40d35351cd2339cd6df000000000e8000000002000020000000da19c4e789571a1d0c020cd3775fe6d55e2554415fe73d94ac7aa2e386ce427b9000000046772c0d1f9e1de7b4c9b628037ad85007821d55151723764e99347937c37741446e70a89b58de36b493373b144b41affee3b1d5bed60d28b10079be4138dd16e86261ddf9da3d5aa35f678c71092a0542f5062fb6b0e68ad97cc424b52a586927586a3aaaf1ac064193cb459b4dd4beebfbcea3578125b12a013342b73a9ff670ced70f792acff1e5708264308c8c0f4000000062dd245dd8a0d920da30b63d6f67478cae905548617ebc86337b95fd296456dc2e6d9d26eccadb4e79b71984c2a79e9b0c2ce65e6df6fda21f1a2cad8078988f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f822ddca3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16354A01-A7BE-11EE-9610-464D43A133DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2744	2468	iexplore.exe	18
PID 2468 wrote to memory of 2744	2468	iexplore.exe	18
PID 2468 wrote to memory of 2744	2468	iexplore.exe	18
PID 2468 wrote to memory of 2744	2468	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13ed555fc857e3722ac2b1569be4308f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae2db1f767e57508c0d3128c9cd0e3bf

SHA1
6ff0ce59af26bb33f7de67efc063c00ffd1ed83e

SHA256
9de6bc2c84c6444f4a47f74e37d2443d93048e01473de4e12c3b6190de100cd7

SHA512
9a270e439ad19ba39aba4afbc2acf8178bd576bae84b3e5dbd8c47535f98b914d2af3aff36d8fd790991e27c5edd3ab5e8b9c33b45db3e721b2dc2a163fa2f17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7922a5fc89453393693f986f03f91052

SHA1
b631ad3149f3ec5d41072f209f9d6ea4ff8e8b8e

SHA256
d873d93b200a16639a8caa633d7f7ed8aae489d4548719eccf074188f206c421

SHA512
9291bf21ebed64e2d47cba116c48125b0bd0bae681032c1fa3a7f06acf91807ce77af850af19ae43b7bab748ace7d9e69a7e81b8d6acf5636175ee1b63906a34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc3bf1cd162d98a34f9867f718575940

SHA1
a08f5693b4902a4d67e4263f997594dc978e1eb7

SHA256
bbdb8318a996378ea245d2f565aa4c6db47a8f47e1571fffa66be51f0db52c77

SHA512
95c8a412e006e85a5a56132ca07c111f48cfa34a23b3c95ec31d2b6ee5b36986d80812a8eccd65ca02725335a923cda0381fadf5d9ccdea99fb2cd953b228fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9396c5691405d795274b3e2fc7a5abe7

SHA1
b98fc2474432c7424d8a9475800e7e080d1c7c9e

SHA256
a2eb857dd5b5a80bf0307740ca90a99a00f49962eaedf014cd0e8964efb50a00

SHA512
1bb538beaa2a3dfedc5476d5103809875777a9703b8584eb918b82525582f30698d08d518c4c4dbe2642209a3d74f60bf7142942e1b5518a59a467d23d0b6c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eb0cb786d6e99ad7b4ad5df4c092265

SHA1
f86907d4d508bb49a2995626ce6f6629e06f797a

SHA256
9b4853bb11c79989c456170f1877a453d07b7621d45c036844e01fd2aea75d63

SHA512
a337aec4eb2368306ca6ec063078d850b35d13a8d250ea6d85e52a097d44682ff52608787860357fc5e4941878cd1319072128c2a739d3637e270adfaaef999d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c65db9c9cd6d0c581941742998e73a1

SHA1
8f58c81ade3c8663b091bf659f233941f480a541

SHA256
2f2849d7c6baf71734f64a75269b201a09cda2f8280ba4119393b6816b0feb8e

SHA512
4a8350743d20ded0fc67ca31e43c9e420c5f43917a7b0315d61e0b29ca315445436a44ee7354aa8c9594dc92b1a94492fe66bcb39e06768873bb34b4cd8552e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e04d9082960807149727152896c19e2

SHA1
866895d8788cbe6dc67f3c9831e9425d746181c9

SHA256
94e3c9f74ab43ca2ffbd3b71502946f91f2cac297a007b86a1d4c55310b0713f

SHA512
efc0f66b675b96d5e212765095281d79c50b505faaa6e4e82493caf40169ceca812cc9029c2c78ca25ba549ad036111c13b33a76e6a0d157d420d03729605ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1da3cacea799e6628b5ee24367205976

SHA1
c75c3492cb2daecd89d955395ea6a2c41be59d65

SHA256
1820983589d01a1bcef1b5335e56e0b517bb7b9a55b7248907cb308efc653204

SHA512
b75ef5eaed912c74da1af8dd6d4ccf1001069b04efde25801f50f02c6e6caa4aaf282150cf47eec9b5b89b3a83c138b015f8e709e585f1bedd59c6688932810b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b035794431173bc06452e6916cb9be3c

SHA1
61133f38f4fa3e5d7184871eb01ae4bfe406b711

SHA256
1dedb6c8cae561d1827fcb7bf9509f1b9857b3227f285ccc5534426774ffec59

SHA512
adf62f1bc3d07700c2ed9e99ebef1e239e4e7322b231683934a7c8eb622435414f31cde81bef7c5d26b26243679dcddd881b2350e4baa9e4a110b0122286b476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
533255561b7d527cb862ff2832a6c5b0

SHA1
abec88ca0ac349b502aa3ef874bcb605f2edab82

SHA256
498188627b42d29ce6bb99147022adce23e73b18e4b013594b26ad7120cd82ad

SHA512
d287e906af3a5fb2a62c1a3159f30cd2600f471c52b5a6426db1a855497a324ca4d489adc0687874fed127e0f3ac21e53e522ada8bbc349edbc513bb745c5a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d513a916f9722096cd927cbe2f79108

SHA1
a02ac4d5df67dde82a640ef7fa77f10129bcc7e7

SHA256
ce18d6af8bdb21da033ec5b65509f5df947a273ed57f2d0c4a915cd251bf797a

SHA512
3dbda0aefafea8abb5b92aa343fc1644cd081dc4fff09b3d8cccc204895be8f5c9b3d810e7f22bc7e512ac01e412e4e98b2e873ba4c1aca6ae40cf473e5be937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883d301ca00df4e39bd3baadc275c036

SHA1
5fa4d7f75f4a0b07cd5798e4ab0ed7df0bda425c

SHA256
16f90f4530d206243b86929c26c39ab8a3b287ef1c50ec368cabef81a2c13789

SHA512
ba80d334d6de7912965a4f8edc5262c04c2ca10a5f4cc2962b3b6f4fc8236ba85d9546ae720e5475c0be12acae3dfba8aad7864cddae911f01ba42faee9e5159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\02cy2i9\imagestore.dat

Filesize
1KB

MD5
e6378d7cb2bd9137b2ba99569c3333ad

SHA1
f8735d8cd1096e6430c44834f399daa2df01b01f

SHA256
62fbd92f73a6a3e8a1feda02f7a44297ac1cf47261df64759dc9f3da32173e23

SHA512
ece8a23c072630776bd8f7d0a8e9f28e731245d4e063e93cf6a9133f0e62c3787e0dd62d4d128edeb6ff8a9ffe904ebb63fbdc03b5c45777cb6e87a7157d5e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4205.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit