70c7739373840828319e344a53801c794a55b63b6b230556c32c1f04e3ff4474

Analysis

max time kernel
120s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15879340fcdee714ff197c4b6315d85e.html
Size

1KB
MD5

15879340fcdee714ff197c4b6315d85e
SHA1

2835ec66574788d68d2f869af06c6cf0765b1a82
SHA256

70c7739373840828319e344a53801c794a55b63b6b230556c32c1f04e3ff4474
SHA512

be2fdb5ad71074a035bac6087d46152abd5f7febba2e7190f977b4039e4422ed0cac2eae2c2e268cf0eb35b27c4d78175f501f0308c5fa6a01f2d4c685af4a40

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002317d47d72fcd531503f2ae5848bea0e5c8ad1db9492c4b599dbd745dc51359a000000000e800000000200002000000001193d28a93293b866f0d42987dc9770a98d29a39f29cc423f88159a4402e777200000004568d09e2e807b884b1d37547f9a7d53ea1303d34e309c39d5a30dfbe097e4f0400000004c2a4ee54a2a3b38b27b1b39795923174731b5231d88b39522b11fc2a04ea94608170033c735b0d6f2a12144d2b9e423a9868d418c638b105e8245428ea13bde	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fffe641d3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000a9f27b7ed7477973eec8a14e15b4f555df38d525204949792f2b93190f236acb000000000e8000000002000020000000889bd8bd6dc1e799be366e0ea5bfd42f1808d5100c6346dc74b548e2f626c853900000007226979d445fb8e15f21552a7fd020c0e82fd89d56f4efb9841df68b4d4a2cf80829fb394d3f820aac2f794dc03662b58c5f58c256d6a9dbe14a6cc7ecf6a1d9d2c01bfaa8975017dfaf6f3008ae67c6425303086f99c3723ab4b6006cced6691b1415d554c53b283bfd20ac7db9d8dd55b6f963322427ed5cbf74b8a8d85f99f5aa07eb677beaf438debd77cd6830834000000019dfa34b7e01bb7ea13831c325a9d569573793b60cb5a9568a8719bfb8a2ed4d0bcb4f78fba45a57e6931d582a0a65900aff4d69fb242befa36c54f80f677aa0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F415D41-A910-11EE-9B28-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410321807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3016	2008	iexplore.exe	19
PID 2008 wrote to memory of 3016	2008	iexplore.exe	19
PID 2008 wrote to memory of 3016	2008	iexplore.exe	19
PID 2008 wrote to memory of 3016	2008	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15879340fcdee714ff197c4b6315d85e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
995ba13fc2963a7c695e31819e05411b

SHA1
dad0813e3898063c96dac92c2ff511e1e947b50e

SHA256
ea786f7f8b80a131f921db8b98a2d274f4b05b03a8a9cffc1947b9254e874be4

SHA512
81b20c612d7b1bbc0f7d91947db3c3222c09ae1d78f323e6f4ebc3cd43da357f3fb35c4d661e0e40a505d23ebba7445e13e74f64fe82073bfafd1ebfc41e3cdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bbfecfd59dafa2eec7a26a944c3f2ec

SHA1
49f227c50ba3cd9c014b297178125d2d31a354d5

SHA256
b0d29484c71016f8994c64111a16e91cd38c8f4fe1298be51cdce139e32f0846

SHA512
f7566ba378594ed53ceb82f318a34462f8fa5e376ee19cc4b353f1d4ef588b16b55c1a7df655801feb6b0881b05ec0ce9ad40f55920fcd79ff7ff82bbff2def2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc26701d8b3abe1aba88eeff45d22b99

SHA1
18ad1716e538babdff175ce514d22f7458be4d66

SHA256
645ef4a61e163bc1bf590090d3166dc0a90a7cbedd07fd1b53bc0f85dcc34f8a

SHA512
5b635d83019c056f68c6e2b57322a63d7080065544d5f2c63191cb9e3b262cbdcbe5bda338403631136ab8dc3b8d4cca721070b420fd1184e0b4ec33167baef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde0a95f3a8559bd163b21eb4d7b110c

SHA1
c9d3234714bc2226d94e1c0cbc138a2f20ad501d

SHA256
4a712e668a9919219f2bf6ed6cf2c4d8b89879d7a865b5681f708edb816ad626

SHA512
542949e58dd140536a49d1ec20d8f005236c4723446e8bad9724ad18e7e93ddf33e3ecb6d71dc09ef7ca23333c1aa8a469a306e0db2891fb1a88577f02c2113b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f37bf4089ec417d42322760fe6e5e47

SHA1
585e20f52868f915e1d6b814ab3ff0219dea0758

SHA256
9af8fb069b9e001f7286089a085c9edc473f11f48ec2ccd4e8ef0c3dcd9c47b1

SHA512
e6494204d30bd0e34f50d60b466d7e57ed91fb816e323d999afdc241877edfc623fbf276cd6d66b4b9bc54dcde1b9dd174e6d9c16d6ad80885df70f42ccd2362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aaa03ce2509d0601a390a132470c6d1

SHA1
2297fa7c1545220207f234fa20ab2121e8b3b965

SHA256
caf95775adbe531272ad9819173f93de5f1e16880252713e78ccaadc96f07b82

SHA512
3827a5b37e2b5d8b66e4cdefedd0cfbea4a33f0a1cfc0432b01f5776438595d5dabcf035d339e9c327a02a4f5d2ec12d11b71e611f6a9f8cb547d20103420ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76565035681e3dd2b8503ec372cf62f0

SHA1
1b0fa8812490abc3abc5312a622e2d1b6bbf241f

SHA256
f4fe35dd3439eaf45762b147b7181425d39fe633a30d55e56bd6594f08e06c5a

SHA512
537deccee1d32c191f36f7e3729a82f3787e2b6fb50ed87a484833d188b6311381e73cdeb655c4c42593daa67b02de58d6af56f0b3ea50eb2423287c9630ff44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aa0cec0035b1504fde8efd451bb0c2a

SHA1
b0bba375d0e4f085043359d43e9758a5d285524d

SHA256
8b2ac2937e98f4dc569eb44b4d6a34876c203c97bef38d520bba2d9d2e7a1a70

SHA512
f70a71430324b91e8c770ded4a98eb47ae68336ef13845093c6d393db1ef4e0394ec04ad01b1615a53363eda0095668d3b1f89d2bea8538c6727f20ab47d397f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6147.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit