783198ae01dea9fe889181480b18a54b27d7d4f7cd9e5dd6d092059466c7e440

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13fb06bbe2171e26c6fbcff13ca67af8.html
Size

2KB
MD5

13fb06bbe2171e26c6fbcff13ca67af8
SHA1

126b6b3b7dbf857f0b5f87760748e8c344f15eca
SHA256

783198ae01dea9fe889181480b18a54b27d7d4f7cd9e5dd6d092059466c7e440
SHA512

954c95c7b23874366167a852d870073955c8b82dd855d1488dd2ccb66494c452d362ab5aa18df6ef4d36eadce20f3be5ca895fab39cc49c94e022da1a621e2e6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000da67a73be22b73378a9974404a57e0d52dff019681ebe8a0a2068bdbfa199a03000000000e8000000002000020000000d0a7134032981a987540129cb46c6da4d38c1dc2f3963313110a5d9a132f77bc900000005977b1eb72a8fa91b6484d2940a3cf14d7272c405185aee4af29bce1ab7d8c07ab94d89a64699f9c3a0e6aaec5085f34b345d7cba55b6e0f921fd9edce82172197360b94a063de39dc32e051c938a205521e8115abf4c9d5fb0975f51bcf84ab8f0201044a586c1ce6a1a71b9f81ea1abbdf19b5a894b9d59395d4a8cabfc5385cbe1fce0a86e65c8bcdf9f253adc0de400000009f4049a077de30c7f72d9aa35c6871ab84863bfe0bdcc7968f80717a71ba9bc1f8a506cf107f5795aeb2967be3c91a40a6581fb6ee5e2867e9f113ba4cce6d25	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42A8F8F1-A8BF-11EE-A675-6E556AB52A45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410286876"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01d1e19cc3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000064e75ea7cd449aae20a7454337ab65a81c388a1106ab734440097d56d6a5180a000000000e8000000002000020000000faec16b7948d0b4112745a8677753f963cd9c9cd7b5e0de3ccacfa055cdeeee8200000004f616931a352c4674ec91100ab58491e70bc9d65acc482905b14388986d9b1c8400000009cb1029cc5010298f2a88db1de7a079981cdf83c9ef1de53aa3185468f5b354ce3eeb4f86700a1a1120e4ef60c5e3b85e68507ec71097ef1719003351fe4b4c1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3048	2220	iexplore.exe	28
PID 2220 wrote to memory of 3048	2220	iexplore.exe	28
PID 2220 wrote to memory of 3048	2220	iexplore.exe	28
PID 2220 wrote to memory of 3048	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13fb06bbe2171e26c6fbcff13ca67af8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b461b9d919036f9184a68180a7dd6a06

SHA1
af7d86352a1826e0aa9097f476457e87a372520c

SHA256
545582f76bb54c3c6ff8689d9c737866c4286bea90c9ab1a5259ec7cea70bd2f

SHA512
b0303b2d4e9d7ba2a8eada89ea33a53ce812e85a4141105610358f50ae4ea3738781c7daa67a10d92e4c2cf8824dfb50afe85f1012841455791d3c5f64d89558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
231e87638c686e1f0e872a6f7c571eb0

SHA1
2fc0355ff114cce85c29ea1b9e0d22cb133f2700

SHA256
878ff93faab63033db8c823165db41c087a329e99abd816d2f8d2dc0c42638c9

SHA512
7aedb162c7538de43eac241b36aa3a92cdce3e774826b9fae815309c97bb1cfb99f55c2acdab147c79badf28b5557119d61e29aab94662db066517049ab77eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef8b196a1aa93b51d3447467c726d1be

SHA1
78a5e94491e52430361f32e433b1b0d162289312

SHA256
b70768521c034e7f75432e63eb0f764206f13132a302b34cfdf6338f08fa82aa

SHA512
08b2483b37ed4289b8889287a68cbbf61900ea5c21eb065ee21bb0fe35b1ecf4d8b89fbdb4e8bdb625b35f0f9b93a9192f2b831d0b36271ac869182b5b3b6cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fc962499fe7d48bb72ab4ac3f34e63e

SHA1
3b0baa7192fc70a56bea2b56d068b0c545e17ba0

SHA256
9fb064dd8d7013eb720d4bff20fdc85b0b48da14519df0ffb93eb0af26938535

SHA512
bf40312d1ec42a4a1e5ca62321ec5ed6f0057e7e4d3002c80cdabd05768d3d09a453f07d10637b323028010005680d1d5c97dd2c39b74b4863644eabad75a7df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
018e1989dddcaa49cf1d6c809ca60418

SHA1
da4af2e6a8a9950d50ca10668fcd318247c27f2e

SHA256
e8b9931ae9cad954025f7195505b0b69ae98001076ce351fecfc238fe1b7b8a7

SHA512
1a8ec05d0891ea9228fec2dc2c8b623974166840b0cef6a77cd6a4a50bc9d05976e84784e5a607b4ee94f631df5dfe37b895047c93a44ebe7af53c31a4273fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc88e40530f2010a561a25c877ce5f8c

SHA1
be7463da35c6ed2cf0cf436bdcc3d6ec8580b8e7

SHA256
49b78549f07d460b17a535cdd3641a34931d954a9f10ae2c52c176ae900950f3

SHA512
46d8a82e3c1b8da5e3c574ad83e8ed41eca890599e1e6198043aa4508429c6d20a6bdbea55b9cb9b5383234de0fc02799e63830452add73f47014bf440abd56f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f558922eae78b240a1df0b257b8de20c

SHA1
4eb5977035208bbc8eedd693acee8a570e687a1d

SHA256
54446e68e467282d6bcc096101433303c5077405e1659d7759c01c1ad8fa0055

SHA512
856aea5ee99ba430df331d58be2492d35e1a375f1cb33ea596ab88fe2dcd6d3379e556563712c73d57a56d721a3150dfef49bf2213b84d70f66473a02b168f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08cd331845fd49470a972e471133a977

SHA1
dca72cc97b11c41dc8d4790e3d4e4166ea8e3a31

SHA256
ea7d9d1d2327c562ae04b716d9048341e2e261f97becfa2c0364c992e2b55801

SHA512
c2e0cbdf7e2df6ed620588ccc8643fb835726b0e0834766943be2c445ab86df1aea1cd30c71893083803297ea352d9aa2bd69c8e17face1788837bc99166de48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f02744e27d29ea17f37148644a9ee94

SHA1
06283cbcc69b804d1efb2ef214a43a6d02737952

SHA256
3302b91bd52b39eb01b01327ee8fb4cbde0a629ab757e4d870e24cbd1b2ce372

SHA512
8407e3b9c742614bc29abefd517f1e5c2f2de5f12d2cdc45bf9cdd6a25739dc3abc623d4468cfbac7012ae798836ea6cc011c8c60b99ec2fda805b952c0b17bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaaae60673f0ac4286c18a89e4c8e98e

SHA1
7a8f75a61cb871e633c92cd4fa131c84477b0aa9

SHA256
7e44c75cd12a9158b7714fac3c6d499d2b8f273db7723245fdda570aa0203ad7

SHA512
fa21fd93a3e6b72a079c519936f4aac9073b91c49140541324a43b2373bac58dd62b5e29c20daf10793ffadae09ba372300429ee483dcd03f49b62ec593db1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
472aade6c1c62ac7a9cee4632f51d7ec

SHA1
99c169de440b9ff3bae119728caae3b6f9fc91c3

SHA256
bea23edcfa772fb5d12c9eb82d4528d6984d7524ac7ff4d3a3093a08e51dd46e

SHA512
29a4952a869642c2895c748c6df0fb5761f395f5541c4ab5b3fcb7d29e8800032b3830f43874c54d32c9873404776cedc668d6ae3b096638df89971bf901b08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b599ac1429c7b017d9de57979ba092f

SHA1
2d76024f839898dd9feb0ebc87a5b2d1dbb9133f

SHA256
985bd6c0346d99193f2595ccf0e32522ed125e7544c556841d5a1e22d9131dee

SHA512
60c4ca5e615e2b5bb5223cfd6d698c25652ef745e76ea6843effef6efe23fa5f73951ecf8fbc35d0c45b061b615a944a1ec143e4d28fcc659daeb65cca41b77f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95EA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB82E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit