05baad1408e5258f8a8da23490850b29df679c286890d4a7c7ca9bbeda5ba280

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1657ee54540e4c9bc45c9ae6f74a1e51.html
Size

1KB
MD5

1657ee54540e4c9bc45c9ae6f74a1e51
SHA1

bc4fa46fe8c92548827c711c836cbbdc624c4f7c
SHA256

05baad1408e5258f8a8da23490850b29df679c286890d4a7c7ca9bbeda5ba280
SHA512

f78319b6fbe66045c99a929cf95b8f86a45948ea7047104f61f239cd74a85fb17105293fdb341a2d2532ec3b393e8418f16abcc80f7a4c932415820757528d65

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02e2069093cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000bd94bec88abff4c6e57be00825e3dccf42cf1e576cd5d25d22e15657b28ed566000000000e8000000002000020000000ca4138b6c03e12317f248089b379dcc1895ff1040e68db6481bbea0550dd61fe200000000625c8b9ccdf7ffaac897f9f49db1adc88febdce577b47c8efe6c12cadfdb799400000004a3f68649a1ca4d74bc7b32f84fef7c2b6490baf694960285f06ddfb6d37e3ac3bea65ae7ccddddcd397f248f34fd06173ace98a153abb54990be665e81452c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410203248"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90830981-A7FC-11EE-A4F4-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ce3ba6f3d38845345c81b7c51ec2786663ce72dbfba852b342d7f0724adcfaf1000000000e8000000002000020000000244df3a12b352abaa27e48a9ccebfaf55da5899196b00c7cbfb966b9b226cc5090000000afaf7f40fd4ce933b1a3f5af3a3f9b269ced646dd089b145ba93b07ace3edc3e655d1d135612e6be4e06deaa99fa880bd7d20ec627491e6ee37b6ee1bb241fef7327a628148304a081f5b75ffdd3a4d74a13ae3ccadfcf53d817219b2229eee68f2deceee1f99302483e0bb59de3e0b905ca5b529edd0a2eaf4973089c68d82a2f3e3446465de37cae0b5d7d08cfe47e4000000091822d9073a6ee1df95f94b94630a0a6bc45191590bf82cfe834717726a6f20f4744a0e7833646b4f8713a328650fb93d306efd237b4e45d89cf8b636fa6be7d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2124	1760	iexplore.exe	28
PID 1760 wrote to memory of 2124	1760	iexplore.exe	28
PID 1760 wrote to memory of 2124	1760	iexplore.exe	28
PID 1760 wrote to memory of 2124	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1657ee54540e4c9bc45c9ae6f74a1e51.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3057ba4391f920be444f9324d220961c

SHA1
f506de9870875f3e5af8396dd5c6c59cfa224a31

SHA256
579507c945ada51c6e8169b17d4d80e1271080e1432af5cdbe84ec7255e2ff56

SHA512
27d3b579960306b74613a3e9357f899aeac3f08ad2205d7857c7ef1c7b9ed802f212df0cfe461672c043bcbdfb56d280109886e3fe6519368ba6f7d6360f0ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7ad875a3fb5ed91cd6f611ad8dee9ca

SHA1
8ace3a9e2f49f8210be967f7e2effb9aa6686abe

SHA256
1e4db13879a36d58850efea6dda927ca3aa7c41bbb9bab2b2d46e538bd23a3ae

SHA512
158d9d16c38193946f1082c8cdf8d93f772f20124d402fa17b9a3e0da469dcc8ca64b987626f6244e0f6460b6637ad84bd28a55ed87b76b0a8976408f4de7666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17c549c604f9b187c06b77ee93df893c

SHA1
b13cee0dc19c585b8fd139ccca66ce318c9f3e05

SHA256
4189f9361717c9cd08cf9b800d36669c439de2eba17644c8cd4aefb60502f2fa

SHA512
0954913653417ba02ad1b9ee99b8004d550f68959b8c60688d8866ff130de90da4a7d31713d950b7f6a2d066675b65d1837712ba8656b0159a97293f80f12db8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4755bb922d3f5efa15a1a94518343390

SHA1
cec58f1495e0c96328d0a13f0e849b0f62bfdad9

SHA256
7aebc0e90cdb88d165e834a8c63917ce747a7f94c354375969de1aa0adae3fa0

SHA512
246078e4d3062b99e632719cda8aea8f07014add49d3b45807d79bf2fc38c994e936d20aabd2610c3e9188e9cc50f46382b146f5e156b3f8f77ddada96879915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a3233cb2adc613c2a2c4979c92e8205

SHA1
dd80f0e2ef44f4fec78e773d105fcb3e447bbc32

SHA256
1223b491a36d99269c145690f762dfd326da7e065584055b7fb314fbde320091

SHA512
3e248c419d3f1d499c8bb9fe625d2b58ee8b66e33803adecf069f233af71716cd36c238a3a3681c947c64118ce3f988cb780d96062e6c14a0c6d18cdc604ae68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cca6d5555c903c4bd5fb9118b170968

SHA1
8d97a294dd029095694ae0a23dda225fc910a10e

SHA256
967980e20ac720422550c8aeb7958170f55de33454717df964fec54a5261df11

SHA512
5d2bbe9523e82c8a0a3b8337ec7b580bdf2d6981061bcc01c3c819d57b023e681a554e61b2788580f5c0f1436bb23da8c86477ea58eae335b0a9d4afb7b875ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
095b350e2851f04503f47c91cdf72f34

SHA1
52dba1042be095213a39c96df47ecbb5fc75a09f

SHA256
76f65a2aa924d749165bc6e40ac7e3c167882f709774e7fc31fdb69bdfd3ab98

SHA512
0ad93a74f2b8ed7245b30d871f69ae1bbf7b1bdfa55c34419f4fe6b3e1aa4958cd3739d4c51301ce66f08b8b7336765a63d5c49a9329f3d8fc8b0267273f5e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51a31018377fd1796f038a72b6655419

SHA1
d98130e6230a92b08380279950ba6e48717ec729

SHA256
78ee58b2356e0842b1c0f0e74064b36c739e96d508ea4fb60eb5d84008c5fef2

SHA512
92ef057ce6ce4f7f3dfc26fb70901dd1a989bfac3f92756adbe7531ba049f659d1193c03143da0c5bf0197085c69e9f0edaf286fbf38ea96a3cffb24333fb66a

Download Submit