13cade40aee0566a2a4fb728d7db7bed9d9605d1c9c82ce7743179a0b3d9422a

Analysis

max time kernel
71s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1586feb9a4d4617693ae78c192ff496e.html
Size

895B
MD5

1586feb9a4d4617693ae78c192ff496e
SHA1

1f6795b1934e907d69c43cda816be53908746359
SHA256

13cade40aee0566a2a4fb728d7db7bed9d9605d1c9c82ce7743179a0b3d9422a
SHA512

86b90e5383a7fb26cf49fcacb1a5937b85aae8e59187b00c68fb39765a37061cf5011efc3d0426f316b3059c8bd91071090f43380a46330bb7a6e4eefa4260e3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000072f6e1e21581e46ca69573c593c05c4529cfdb804215803e544955bcd5724b04000000000e800000000200002000000064731a0fe0a973201db65071b8f5b963451dc4a817f52c92aa6862b30c4a459520000000644f70364609b6483b8c901962b391e9cf510d5293b46e9c00c6d14a854b0643400000005a385705aab6cb9bdc0be43d2cffe33617a6211642b0f8443c289feba7562183c719b89d87c24e26e309005a3da932d2e48e19c5a64e708cfd608a1a5e69a801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000004c382010d3a80ebe5fdab67cb459ee29f1d8c8729450f84e64e7510715c3e716000000000e800000000200002000000052ffcaaf773925fe90eb49ab1ee4e2ef3856fba244c2b82750d41d49433e954990000000588c3e8bebc18bebaed725e52383f3357a4bf7cfc07a2804b26187f145b4545af1dcb815c917738846f9fb36ff4c54af5d7b0fc48fdfbfad4df499bbfcde10e5c7f1953f35510cb32fe9e6234c84b7cd888fde362246df85a4f971c789d43fd7ee9d5d6301a5e88075190564deec1e012c055edea2b491423af13a9431af027df126587f47f179e76e8c70ca6095933b400000008a309b3ebf63f271308f0e685c431450bec82349dd96dfa5add7c22beec65235b869f44b2651313fd954474cfdd2cebcebe8fdf97cc5f26cb358eb0c68370763	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B03C6C1-A910-11EE-A68A-46FC6C3D459E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008930471d3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3048	2372	iexplore.exe	17
PID 2372 wrote to memory of 3048	2372	iexplore.exe	17
PID 2372 wrote to memory of 3048	2372	iexplore.exe	17
PID 2372 wrote to memory of 3048	2372	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1586feb9a4d4617693ae78c192ff496e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bc357f80166b0f8565c75eb0f4768d87

SHA1
b234a66b2778f873eeffe9ee53696a6d8d88f198

SHA256
dd5c9102b24129a24e475a1fcce4f88c648f4cada6cf73b4c32dce22f3a58f8f

SHA512
8d3e159d9a37fd6696d90f713352aea95738cb59bb66d7b42eae2f52f82118da097e706e60e3fc294fe43cb21a244b70bdd0cf1727efa7592a760d85bf9dee80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae2f094676c7fb4db450df0f6b076709

SHA1
01bc37a638505f9e1b5727d1bf45afc4effab506

SHA256
d9de1f0b4ea935db0c5ce6dab45dc0c0950f36ddc69b8ff892d10f10f846dac9

SHA512
4b688b7de1d2f8ae81bd58edd989561e0ad3983684c1ca1cf6fd33d2009270ea9720337f17ae181755a583e24ca58d9aa06306be1609e415d526dbb93a65dcee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21e2e9ccd247d6efba7f6e7d656e32ee

SHA1
c434e6f159a638c99f560f6b1fe6d6bea5bb642f

SHA256
0b668b49951537d56f9c2f065f4e6e55373027ba2554317cd2af7a7f6c770260

SHA512
0b2f46c272b1e6a705ce6a6cdfbba3c7c1bf21c6e57b308acd54bad34a0a599448cac1a60384bec64559998955749c06234eed45f0c0d33ead45de9178eeb13f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ba854849cef1f174a34ca52a82cd2fa

SHA1
e7f0650d808ed7d71f0ee50fd946e6936143bc10

SHA256
be50c0c810067c2b1c28ca35643c9b830d51b479a082232943c561811538c13b

SHA512
c1d03a2ac03cbe0b03bdd01a182a91f5efa55b6714e3e7882f3d6bfbde558c9b4582c7d0457735ebb708c66edcf14c8ac64750fe5c1f6ca58990681a1e82b652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aecc60e41c5d08babe806400760557d

SHA1
4e0f6298af2de3814ffa8e470e3df6d1fb898782

SHA256
ca6737faa4b4f29e18a03760786ee9de220b97e0717f7e35b3bea969322ee6e1

SHA512
cc73793f63321c6fd98a442c935364787e0db22b60a20591406678dd230f63dd5a218f63afc0e02c3c20e4b2244bd94b4a4ff66df72c893e382b508a0e58e8a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae170ed95b7941f375c9499ac430282

SHA1
3d8ec946b2ea980cb2d4d495f1885afbe6e33c95

SHA256
b7950e7627a1a6c35675d9b1a3b71ccc16c858ab0773828b55114bd4afb412c1

SHA512
35bd744922682023872a54fd7b84bb82504c20022aceda5628469d6e2d3dde477561e347cfe53388d5fe0027649d519652e754248b54fd3ff8bc48961541f6fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
053dffeae3f87196c6388b62b2606d69

SHA1
c6b07157469e370d8e79911060969937a199bed5

SHA256
e43aaa903b41b0f32f4ba40736e6b71d7fadf2ca21271c49ac362319f6282776

SHA512
f464b89f9459fbad3cd7a2a46e2a9673454132837d36c5dcc7768c6e282bb7d496f671c907cf41219a6f572e8c298e9ff51b0f6a0d7907585b4733f3ca314f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9075639dd83702e147bb34b0d2e66461

SHA1
b61919d3b17a9777b3d84cebbda21e53ce7c7c78

SHA256
dcf49e8fbc3308944533a49d4fcda732d8cc5aaa2e11712fb8574391940178df

SHA512
6a6f84fd1667d95129c9bdb42dd6776dc90b916eafbb885ce7c9a2dd2d24195e87d7765a7b71ce09acbfaf931b458dadc2f4bde3703d3d963fca5e5b13dbeef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c224e33e840426f4af3f28966b790343

SHA1
41ef96b482fd9b8975c4abca8e2be0d1eaae5855

SHA256
81ac84695e603a02c2bd35b602ef03f5f689c654e2c914b4fdc41cddc8c2a971

SHA512
e1e29677b7c43e6689bf0c94e6d27ea5904718f89c78f887b49c6e2b1ed53be19b32c1395f0ecea332b9a5e89b3a2eff689987a83a20f53c24e89d310d7ec7c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
882cdad94f56b85d9e9ab2eef7852409

SHA1
a387e7fd886201ce83f599d6c6e094a8bd5a99c4

SHA256
247c412ef23834e21b5a2db305ddcd70b2fae42b4d9fbf6c1b6ed395401ab321

SHA512
2cae5565c87f895a75407e519dd31217eb841b6d8fd7a1f7ba335779e0cfc7bee55ae685d5d7d88f7773f2fd520445f64cfe7450070f61dfc746faa822810aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecd391086dbb7c4e50838c17d1da57fb

SHA1
1e166cafb72ceb9fda0a9cbc49f7f7b1593bc7f1

SHA256
8f27a23d684f183b7841a33a047bb155381c348aff79c2d8e299538aed10f618

SHA512
1378716e33a331e7d1239bede8f850bebd35353c51c33174eaa97640bac1ef33096c3aca05161f460df6dca2b4b43dc8d6cdb16e4d2149a3bb0d394846e42e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18a544a37fa6a38765a582a6421dbc0

SHA1
d44839d75064d91fe8d5fc47ff9a9344661f6e8d

SHA256
4bac71c491347e5b8035e2dbf28754069c678dd8044d7c91c52de55cb7409e0e

SHA512
eccc307b5bd83312a00b15e367761b330617257aca521e67372d58c45a89150327387c5a809dff906e36afff80c38572b1e1561fbd0b57286f0752a176e3deae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1dd0d0e28b87bf0f0c147df12ac04b4

SHA1
e958655b31e5e08e453df9d2e4f62645cbb5531d

SHA256
fb030aa0ca50e47945ffdc10677b02226c9535987b5ec3d7e33ca2a0afc262c6

SHA512
582afdbb2f400cb58f6c01ab6b48e4ede117ea7b8109cce9e6731a0a650553fa8296bbcaaf40f5aaca35bc6e08657297b1934d3d7d70b6515c9a2ea2747f6698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
724cca368f263287d15e96e2250901b7

SHA1
91a8d383afe09132c9f24833c57df3bc9f385786

SHA256
3e1b876362c9c32550cc8cba33eb5b43edaf25abf0f9abc0e6e63389cf469da9

SHA512
c83a908469c619161326c27b4a1fa0a5c388aa67678335d8095d0e2b67ce30bbd82d4fe314cb1691c5a23737a51f16abf2a43311b8c0d3cfa4fcdfbc06cea44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
515a2117107cecb3f70a9e61eed903dc

SHA1
6c8337e29db1d26d0f3ec14e15f27b4bbe5ea516

SHA256
4d0f34433cfd6e0d5511e6dc039d7b15311a20ce8003c1b187fc48fafc19f7e6

SHA512
497273ff1e4152919dab599d2069cd64ff7bad5e9905f6c206620c70efd52ea35614df8072cb645e12227ef4478253a9b0455d55af198bec834d9757318c9ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CF8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit