3a40f0dd8821dfbccb35bec3dd1b7f6c20245ac6dc7ab126bbd38623aff2bd90

Analysis

max time kernel
158s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15575dec222e94b7e2990bab9d0d67d9.html
Size

2KB
MD5

15575dec222e94b7e2990bab9d0d67d9
SHA1

b1db81aada9f9a481899a37b91b1fe175ec34bf2
SHA256

3a40f0dd8821dfbccb35bec3dd1b7f6c20245ac6dc7ab126bbd38623aff2bd90
SHA512

0b3e4cc6ae59986b898b7ba4ec2d42862812b82c115c853b797eed2fdbb28675180e56cb5446cbc0ef78ead7ced1f34c48c9084760fc5dc5fcca0dc1e4af8566

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ee6458183dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410319613"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002564515a569723d1544be11442466782f4df81d4015ac390e36ceb9078b2d1b4000000000e80000000020000200000001a3d0aba0d1d058eacbb731cedf108e2f86b55bdf8509c7caf389f6367db28ae90000000138ba2ab3e5079e8ca82dcddaa36f822b52aa8b0c8dc0923c6de27d6f2abed0beeaad09e9fb12ab555b47c5df30f541a668d97917899ce1b0a1e7550a02530f12324ad46d88e5506eecfef2bfe9902236e0c578d4f7227305f1fdb7dbd60d52f53794f32c8d030ad4892d8fee6d0c9a66acdf48115c26c86688f3aa319404b4becd71ed871c5800a66b91eea3f93269840000000b1926280531eecaec15ab00d0177fcc34bc88bc4f75b9e46b3d94f8b545d3a2dd80e78e562699b521716407eadc556bec4eebeb6b5a395f4a8665af9b20b323c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{833A98F1-A90B-11EE-92F6-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000000b1086190c8f639f4108e2452101988bd0649f5c5031276b64c802b95d80e57f000000000e80000000020000200000003c4b7602ffe906190f1deb3b34c303037f85695d076d188ca1d89acd271b50af20000000587932230fecaf3fcd685c8285bbbd6ca1460bee2451aa1340163abd992b74fe400000009d05f4fe714dd4bfcd7564079c34ca9e73dab34b8cc02b26aad2e9b7f7a9c57278c34cc77f285e31eccfe4bbbb1ca0a0cb25f0f86825662d7f2b9d787e8a9dd0	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2620	2724	iexplore.exe	30
PID 2724 wrote to memory of 2620	2724	iexplore.exe	30
PID 2724 wrote to memory of 2620	2724	iexplore.exe	30
PID 2724 wrote to memory of 2620	2724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15575dec222e94b7e2990bab9d0d67d9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23290a0d3417eac3d6278f1c9362f388

SHA1
cdf6b6fb9c29126e346b4ccd13c8a8d6a032dbc0

SHA256
814f5272c491cab3ef1e92cf18122474c779806f84ed0713b77e89ef740a6559

SHA512
cbb5732a539149a308921b3edff9c74164a6c99b792106ef690286db599312c7573cf521bc895481143dbb32445c5e0568413f1af6953f366d042f0dd454ac16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff679d0d3f3be5c23fa91421dff7feb8

SHA1
f3f36eafb2ceadad4b377825c9b3fe99f3a67072

SHA256
562aa56a7949035da61a7ae5cec6a5d9e01f4f7b2236f0b1005f39b18b966177

SHA512
c60563649d84dd0a44004d155205e7116f6d0888648b20d5b4a9920ea99a5ae451f820f35d1a27a1cf70410574353173e108e0722ddae16e46a6256082b69cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
001abd33a383c2bc589786b85db90372

SHA1
30bcfb02f2729bd5a0538dbf5f31275e5a4403ed

SHA256
36d32dd5cc816b5b6cab1f25cedf0dbf0de9f0513d911a2702ff320ca8236d3f

SHA512
b98e4268ef24ce70b139fa8e8d21197c74b2a4998ea036fd8c37a3649581c2a855e6b13a0f6fe6ce72248bd464ab97f105af4dadae06cfeb06f3f75eb8b966a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49ce715985a051ba5665794a84bc0f08

SHA1
b4ce976a6d230ac8b064db7253c287dcb5cb258d

SHA256
047755b5145472758c70a010be6e1ef848d41653ff15ef95f0eb9d33f8601a5f

SHA512
8988b7d16e874e623edcd481d731c9cb45bfbb038b460b058d16230b7e6b7657403c278a3069ca2b6e40bd1426dbb93243b75e9b27a8238917c44171e5a57106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d14fca89bb715f2372060c12eeb042db

SHA1
3afdbe0f42b92e7b75fd5009595526472d15019d

SHA256
62fc0379d3a18d3c8fc70bc6f8b6dde0261a612150fdf81c016767338734bbe0

SHA512
8edb750900040947678f56e1c66fa9884b4115b4403ffa6f511e7822e2f93848401fb8a432080d95a1ad9d5b5aad4f7f41cbace723d384d30b11e20ee7641c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3013c8ce03194bc8dc1c9c719acdd38e

SHA1
cc752444c6e5e8b84afbd1995464bbb64080044f

SHA256
228a7b2ced5292672d2aeee2800e3dd6b836d9942cc11e4c714557562d752c8e

SHA512
96bc179643726a4609db2cdb81c62773b44680b921bdd560a287d08ee81e86ace984ab74a679f5e9fe3e95261cb167e15c0b6b8db0f93b56c10c802d6646e5d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db1f51978dffb636e2e4d25dd67a121a

SHA1
41090c211954977f7c2a2ab8604c649869fd38a8

SHA256
9ebdd56c450d11a10b318814fe6a6e95f6f5205fe2cf0a5a35f098d8b1cfac4d

SHA512
cc64e318522cbdf8b0374ba1823afd86155217c0e714a1af5a8fd2bf8a693a7c4b3aa1b40d28ce678e3c342abc55d07262c38cf86a44cafe4225e4e8f41bdc66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18aaee0931e9e5d180ea8a1869e9f258

SHA1
f786e66e83dead1db53b4b0477170aa54120978b

SHA256
e1425eb07d8fa4d541c77fdf5514e40cfc9beb22f5afa93af98f9619ff2a4040

SHA512
47a343c02e2f8c3cf555633890c1c10891663105f9f243faadb7c313c6462180c90fc5c2925f2288993c840918a2e89e6388d4c1cb906218d601e5aa2a06567a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebf6edac01e17216600f69d1a962e94b

SHA1
c78b618905cc7ae57f968ba2703164cdb085d4bc

SHA256
9f04811ff836b3e824d1196639b75db7f76345484d20e744eb7b8a548cfc4fbd

SHA512
da0b43b1e02b432e916a5758916949e8dc987df7e74ba74a47d95c67cbc5ac05e21950ab4d2f4b706e2356a3e66f8ab9740dcc03b1694a72f9318e2547a1bbee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF26C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF31C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit