a848cac19ca6255fcbc49f19a3596bacad7c0d197b75eff7690b75707cb01fe8

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14d107645aff4836f661cf9766ca1063.html
Size

561B
MD5

14d107645aff4836f661cf9766ca1063
SHA1

d7e8c79f8fe75c7e5c6829708c74e7599efcf529
SHA256

a848cac19ca6255fcbc49f19a3596bacad7c0d197b75eff7690b75707cb01fe8
SHA512

1cf861330ad96789768e692d6fd5b4da9933604f395af8b1c1779ff567f8df5d95a86d950fe50a0cf45575d424d60058426e1b6272e882460886878525da7b43

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ede63011047b88217e5b71771a7d9315b2260b3588d048fd04398f9c1b4be4c0000000000e8000000002000020000000ed30eca39255b7dd87f8829c2351a4a6e0bd4fe255cbfc3a164689d74dbfea6f9000000017c9d8951c6c11a43ad19221c3b8c2d86c0bb0889187a0f691e8f646fd11642b1547bc5bc3c94e3263e9ddb3c3ccaca82bf72361c426ee969285c88e752d5ee113f819b2e34bb2897c1cc93d119ffef32b2cee0fcff89ee188c83fda727db5057e1ae9f49b83232390e07af8d8254a22905f71345f79db585a899f30ead4421853ff6754d81dff1b48f0e428112cdae840000000ffa7860e31465efc5dbf5f23e08ba08105588e980eaa7665db0b1699f58ec72dd0c0d367d058e1368d241f09d65850a4fb97c3a6537d92038b72a0debce97bc1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410309602"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35D94C81-A8F4-11EE-AE8B-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000000d2ce6d6abb70aa1955bdbcadedf3889bf2c7427f37959c13247f55c8ecb8fd2000000000e8000000002000020000000ff7ade365fdf7cab2f51affd3f42f3431e74bbd93db33f4cd88e857de4bc65d22000000013db6a7f6d53ee78067e984da565b98e8a163f9be4fa0c30150afb2da608a9ea4000000056a6e5324a92f29fbb4efaf02f461d8957cf5fc3a34d057385f3525b71855fd86d3e80ab925595f00c43acc1675dc7badeb4e9ab3290837976463595d2dfc450	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0268004013dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2704	2228	iexplore.exe	28
PID 2228 wrote to memory of 2704	2228	iexplore.exe	28
PID 2228 wrote to memory of 2704	2228	iexplore.exe	28
PID 2228 wrote to memory of 2704	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14d107645aff4836f661cf9766ca1063.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72f96504fa2c9b0449483931b96037fc

SHA1
71ccfe30b3fb6a31d535e87cff7695604eedcd7a

SHA256
be6915c96aadf5f063086de077edf86376192f818c1f601cd59852178fa127a3

SHA512
dab440e55e3abdc8afabe4a05fceb5798847bd2e2c21e2b0d839851232f032ddff5e48d54f78fc2193a4d3e3ac3c9b5bed86ddf01279b09af53e754c912ce7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74bfed1ac4a3c757dadb489cef508782

SHA1
7ddd3b3c0e30324cd436257aad308b246cbf2373

SHA256
74187f7c948d166f8a09170ada68059e16cf1cc6a40cd550e98ef11d842bf29f

SHA512
378d549056b048b17637695d5d6c3eaa7789c97f49469b62981c5eab5d958a16637873699cf812bd897de4228bb4c9545620e38ba97be3683d2fc94f2051af14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b0ba06ae75d9d462b232db9babdf70a

SHA1
e6414a86cad4c7dc8561ca66e9b1e2ea4f48f2a5

SHA256
a60658f56aa390692e4982f469e96a92464de8b3e15eede09265fac4cd74883d

SHA512
6977abda4cf432107682135db631a59162f064aa510d7d4cf8541aba413244eadac126700f3cabdb01faaad5a3e8ce4b7b33ebb4db7e400f0ad5bbc98bfb6be0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8074f74d37860ac05a4fb983e6ab2026

SHA1
4d1dc95dc082722349f82ae7619f905fd6a26ea3

SHA256
a5f9b00a043b75dd057cd40472c5696a2e4818c8c403c00c3004b1be0bb954e8

SHA512
774934f61384b27277348ecbe225e4b7f22e8cdb03d672c3bd6a52ad72eb2828cef162b129770921019cfe6220e32683ea68abde0e91a4d2ec3671ac35c75a23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f07a5f429651f2b2ed21e58f2c280cda

SHA1
c0a5052c2ae7437658382b05dc927abaa5c96eae

SHA256
7ce28e24eac129203844ff1093f5d89fead7eafdc54c2710ebad2d2163a38951

SHA512
7563945b0ebacb308b13a621470fb6feb999e8b93cf3383a1c8f322833f6e99c208fd13bdb545afc494f9a904a629040b74614bcea09529bc5f4483f31d46865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7df369800d23fa22543ce234e208de52

SHA1
d173a880722c2d3afb4bcb8c76d538d770825804

SHA256
bfad4318881d9c09b1057f97008e712109919b5dc6c4e27c97d21a78511f1239

SHA512
2247e78675bdf99a190f80dbfb010ad834cce33cb2387ebdf91207f6da29a1605c7f78ffec4bf8ece1b4d284796b2eb3ded92ae9ba5afcb59dacf0324d98dac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
194aed675be8508e995a8c931a944034

SHA1
e530882169920ef8e4781a4eed2a8c8ffff7b41c

SHA256
a26fdb5fa02e0a40374d0b033a77c97dc6730539598e636dcc6cec652a8139d3

SHA512
4fbc9e8c77396ddcc1a299944d652880098b80eb8d4800036ad4c7f0836e237ca95c38a0a5ddf6275c5dc528d947d29b86c738800f1f0e8e9e13474b60d6d8f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69443383d27477c124683a75056f4c55

SHA1
f4e2a14cf0690aeca6062cc4e4411ec89ca79316

SHA256
3a6a33dbea952cabf8ffd1d685f0f1c147f755b4d2cf38b6e2c431db319e0766

SHA512
f5ecec95a70df3322258b1c1fee049a783d7a23f619c0b17d3b2f4cd281ad8e7e900fae5c259a82b7aa0b0b08e5224c604fde6b89e26d2a725208c0e07f1c1c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eaea764ee3c25ec329b0765dbc3c5ef

SHA1
4a16c076ad2412e82751e97be49ff4f4ed575848

SHA256
9424f8cd44b19fa4bf5d2e87b59d546822009912bc38647bed9ceb0f2ac1ee1f

SHA512
061462a90dade787e6dd1ac8ef029bc840f1185c51246c9ff2b503047631caea2c2ac07112c0e3738bfc4c7c8e7467b7c5b6b42c5f777fd1089ba33c68af2a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EC6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar609D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit