b17e39351a409988a1297dc09972b06404f53ad2d9696f117a5b2fdf64cf6af9

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

190f5e384195b36352deae9fa05f373e.html
Size

1KB
MD5

190f5e384195b36352deae9fa05f373e
SHA1

783ded2c8bde74fc15b01b14afc305c463c3f4af
SHA256

b17e39351a409988a1297dc09972b06404f53ad2d9696f117a5b2fdf64cf6af9
SHA512

9cc1dd33ae8be23d7bf82957dba6df58b5321b7ab830fa7d7b8a12fc04c1a9024b2718b99c157414c154f78a347bf3e6203e718ef5a5ee87296133d2d001dc9e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e504f51cfb514293121cb61ecb39164f37c3edbca075cdfd69ed23565fdb0b0b000000000e80000000020000200000001b9aa982619e0cb63870917f95e0177f8bc6cb24c4c328405b0083bd136d809690000000166490eaffce442ce89d1bf0c0a20994eff9960b9e21091b0e7189c43308345cb0f07e93b675a0f2b83384a6f2d20718b3fd37ce93479310dd5be1cb51d20ba297f34908f6249248c5e7c65532a7bd2e8106d1bfbdcc11ed28bb422e46f3d2ce32dfdee7ee5e7d6d7097d74b871f0ce479ecb95b2da0cfd71574bf84ebeedcc450bfd95243880f95a69ca722fb39f3fd400000008203c3e374d45bd4b052a28e82008bf4858f43380bca52f9de46f1bbbdde3fe585aab34fc9dc2f3ccc910dc948f2dbd296f8333d06b3c9315d5b853fc9ce1473	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410450395"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ff9ed7483eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000034a115dc1bf2d28c9357c803fca1f4480def45dc54875c66839d8a39c87e3824000000000e8000000002000020000000c542ae48d5111920b512f8d9fd7a202658443f39737d2ba02f3cf4a3c1d3019720000000c219bfaadaf777539d8dd0b4ec98ab852e567ffecca22b936d063a96742886ab4000000047e14075434ce3f03dce2c164ffb9fd5bc220da91f1d1aa25255fbbc9097b90c7ae19967a5ff2474235ca5170cf239e9a4aae06091847ec347516766ab4da3a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0329D181-AA3C-11EE-B432-EEC5CD00071E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2708	2508	iexplore.exe	28
PID 2508 wrote to memory of 2708	2508	iexplore.exe	28
PID 2508 wrote to memory of 2708	2508	iexplore.exe	28
PID 2508 wrote to memory of 2708	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\190f5e384195b36352deae9fa05f373e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30bcda7b7381601a4c32214deb77b81b

SHA1
32952375f35be34aaf7a166c7118a7b1c94a2e38

SHA256
4a2baa8758830bb3d7ef9affc929eaebf377e2dc1eabb0e393137ebf5926bd11

SHA512
e09d2866f795298106599920892e4f53f8e7ed071432fb273b0c13e2f8d13775aff9d85f08999eba44342842362ec0b552d226b622fb8e49a4e232676b31bc1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50c8d66a7da8ba3e0870778fb632cd4a

SHA1
ab3ec0685b1f9533d2d6353c49340112c09c85f8

SHA256
30a95e5fd1619c1b7673257c4d1dae6a4133cfb71dac9554ec02cdb5577a81e4

SHA512
7d2aa760878d77b4364e77c6ff42178f103c40743ff2816903336a2d4c6de4002e64dabb056b2d95d89478af862c5dfadf8c20a4f3b1e0eb05e64da9a225eb34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4114e3b81d7b6abfa08a22e705edea9b

SHA1
fbd31e696816b88fd0aec07564de30314431b7ea

SHA256
dd124eedecc5001880488b4460a519a28d8a15221c94f55fbc6543461c0952b1

SHA512
7cbea7a153e8ec270999edde184fcd424a2712fe191670580765ce0a3aa078c21e1e2b2a2ac082d70d8dbe77cf46657cc04d938b4a445c1a42684fae99300f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db55e275b17061307127f608c40e0f2d

SHA1
c05ea8d3aacfd955f49609dd96f65f8b06dfeaac

SHA256
8eafaabe1eb389124d09d6827e8d1af26ea3e6f57dd53f231f011fbe95c09b31

SHA512
18775273f701e51cd94bb5b91c6a285c1e64ea46e06cacdad02579f366f1f1efa4df566d824d0fc1e6b416468ebe8021a0e4b6b60ba2375224170d79be82fc57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e45565402964ea13b3aed03662b68cb

SHA1
dcd21dc927b57962bed4f3e45a07c5117c549bba

SHA256
cdc1b6652f26a66a5b924d5d28365d47521be2749483d74461d6797ad85e66a9

SHA512
96937107cc9ed1f82c087af46213ae6f5b4de34c6bce5eaa4d04fe1cc5197e5a424fc73fe89eaa007d7c8fa45e3a338bce328704ff80eeb2736d31002c931e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be17e5571d45f25df732570b19ce276c

SHA1
80d94305df3460702c2047dcc91a025e8c29fbe6

SHA256
60cf2d034053694e6d4863914a4f23cdc55293f1ed95e2f409dda3c77c1f9d84

SHA512
0421086b0b812c4ba15671d8cbb55dd5fb0ad027952e9d47ddc353afe9f5678e0078d634b3ad1a1364bf95f915d88eb5871a59910ba9d9263a62b154338aff96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b76dd210112549a0ea03f610c9ab9061

SHA1
024e8080b73b4e7ad4043c4a6af3ab94df3196be

SHA256
6e7e7639b4eda8d2d71d97ba505bb4f7abad3012f88dc8f4443f00f0e09fd715

SHA512
03ecf95b17b969df7a7fc6982b464a627c5df4c3b6ecf35fa550d153b320ccdb33c45a2df542dff371affd2b860669e1eafd31a408f4f54f5cdff98d8e1d549e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00ab0a3400d06c84459934f24fb84a25

SHA1
ecab95540f13a81bc4de458cfff575504ce99bac

SHA256
d95dfd63a509a3e0833eab2a20db062bda14f25c83b851de5c8e1e42555ed703

SHA512
0a65d5779cf051c80d227e8294b25dcad6a7c7c276e371dd12f118f71f2488e4932f0b6096e34db81ba4940d4a63381e64759858d31d2b08b31142c745f72937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f9dbcc92c0d8350cbcb8cf1c22f77eb

SHA1
a5132768332e11343c553dfa72bc6d3ad1e2835d

SHA256
9f35893bdbd79007dfceb073b17eeffe1b94294530f61542a5f04221d21a9e3c

SHA512
e5c126b7d657f4df97dc7d3488fe06c29a81eb8f29d1d74745b91d7862e87d80fb71573f03372ebf9cfcd5f9ba52f8a54c6903c894e668cdceeda0163da01199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
842257cb4e6e076d33ded891360191df

SHA1
e3c5ca51c2dab7f654a42a93f4d0fc43474885d0

SHA256
2feb7cd1c7bf293a4a96bef91f47ef8ecd886193b4eb1d4e9b562545c15e214c

SHA512
070c5d3142ebdaefaa91879f1ecb37df25311c91dc0684ae89f49502ba171b3c76055d4d017940cb4b137d921a76d91ce4233f03b27821df0b9983fcc105013a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d06012f294c4460fb0070d0c33c2e356

SHA1
5922bfd627ea192153f6291a730a795e12d8011e

SHA256
f100937d41b5b688c2cc67177047bbad7b704f07c6c73632419145b9af56554f

SHA512
aecc0b13d03df458f18e10a838306be7292d4401115242e96d8d8a539120196d10eb5fee40185c06b2df075ceafd5f87f8befbdd77be00a9898bc401af15eafe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2ce32f55cf49cadc79221513ce8cb36

SHA1
48d830216ec8586fa63f4962c0d68ddf405f855d

SHA256
a266f71862f296bbef7e78dfafeaa3eb427dd641cc6e11c472916a13252a0242

SHA512
7ca3db1e54a26c8c997ecc6753055cd7d62cbfca7742f0e1e91f68dec0733f457351b5d2373b9b3c01c6225f849dbfe18c2e6bdcfb8890fa78473f786fba2a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1845.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1932.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit