ab96da4439d05ca62acd9a3e9d7da0a34958879bfc8579afe9e27d15356b25c2

Analysis

max time kernel
182s
max time network
268s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1813a7451fc8a9fddfbca7359c04b84c.html
Size

758B
MD5

1813a7451fc8a9fddfbca7359c04b84c
SHA1

20767d367cdb2ba1929d94f10e689f547c3a2ecc
SHA256

ab96da4439d05ca62acd9a3e9d7da0a34958879bfc8579afe9e27d15356b25c2
SHA512

6b737d3902163eeb4eb1680dc6fd32ca301c88a8f32f2dedd0ea401d8e31c7061e990d930c4f388105b187e5e6325429983e6372d9f68e1c4feea8b0b040303e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6034820f2e3eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000007229b58cc72f2b8eef4faef5a7c734fdaa07ff878f1e7673c2936b78779fd848000000000e8000000002000020000000656aaf3a37f04f5bbf750331dd415dd49c14a630e2b5d462b8b5e91a0df6cdfd90000000fb0fe03e29023124c35187288019064cb2f1cfcf2ff8f4f17f41cce7bbcdedd9614d0839f211832cd46406b094a3b241b1140816c8acffeb291e15f2dda5fd51a169cdef20cea8377ecf52edaa536ed430bb3e11a6dd16bfc5f549528cbcbce47a2d08cc4408e5a0a5045427539164841da657dacd34e85cded01e726791656122b94e678ae627ce4925a614950a15294000000061a225a88da36299484c25c510e4e0439aaac00246207edd3df38504230a7d3d36b617a805aa69f692020554b2eb388384cd51308d4c70a724fd67f09fdcca7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410438888"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000ac84c32c727193335adde3e9e4c003f3632204e05b9550cf1c97390662891020000000000e8000000002000020000000d8b2d4fe9f98b013bf62a218b681b9dac85d6644521ee0bd03dea7a924852c842000000040615babcd2a9226e04b470903ee1321ffc7c42183867d3d8c7d92aae9cdec31400000005c407fec2955cc78a9dc1be4fcb9ac0461badf4795945e57509c2762b7401c3e08263713e933fb20f7fc8e9d89d14abdb842ae74a757da88cd175a9ce97595ff	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3986B420-AA21-11EE-B989-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
108	iexplore.exe
108	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2540	108	iexplore.exe	29
PID 108 wrote to memory of 2540	108	iexplore.exe	29
PID 108 wrote to memory of 2540	108	iexplore.exe	29
PID 108 wrote to memory of 2540	108	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1813a7451fc8a9fddfbca7359c04b84c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20048dafe8f036f82b3fdb94b29604bd

SHA1
bb1888c69c8988d9ab9a0df471c44688d244b04d

SHA256
ce667a4c3546c526dacb19110829d9dbaf3723b943d7a79487ad02fe18f00635

SHA512
78f168b67baa4c16eebfc43b7938f06ce4d6fa465849ae2e38b571c6520165ba7131f79e27d7f7a432890b0f8610d09d15fb07c6ee1b75b353679106a88715ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6710f13a6878ce9734d40959a2ee9866

SHA1
99647573bc7c942097caff40f1739fd087612402

SHA256
eae5515d9b31b8373b986aa1d897dc3c55c159a2baedccc8f0967260431814c1

SHA512
48c29ca0386abeb7171add32a5bc8886424e51d023b3f085f19eb70c0fc2e60dd863d810989b5a3df972fb464e87d3cf20c5dab1bbd1a572b1a56812aa6cb03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a6583ac5faaf94dac7365aca467bb0

SHA1
f9e1be10bc7003337c4b78d82d57e091f2f03f53

SHA256
392eea06d3c73a4399a0809f6630ed6af21b5b49ddf305d726affeb6fc940ef1

SHA512
584283e5ddde656e8e7109f76f6b4e1b3bbe649ffe486ee0417dc9de09233c9ca2121996c7ef88c1578a124f2144c8b40f3d8d4f38d7bbc95ab1226c2452e621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e59bfe5e2d7f8749c385bbc56583391

SHA1
6b50ebd6274269b170eafec19c7f6d7880a07641

SHA256
1481e542da5beaadd65b13ab307c1120a078452328a66f8b0812568ed47cc5a3

SHA512
78883c3ddf0178c754f6f867dff18df2ca8e60c7d3ebe69d8635f08f6addff2b11b90f423108e94cea3e9e6366b69a0c3b73383b1c53c77cf34a0b6a66879a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b213dd6a15c3ebd382d30a8ab84ee4

SHA1
b7c2e1b88dc5b2cf9e7bf8472581b565c0614a55

SHA256
e645982092d862d13c35aaf5ce4ad1608efe24b0159fe7f073c2501669f182e9

SHA512
cb7faeb027c0bb0b108666b8fcff763ece251dea74d51878099bf1bbaddb7939d742bc93a0e6071370ac4aec99abf3127f7222f61dfa205ca8ee76d0ebb1d1c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20f836b18ce0156e5a93a765b20c706a

SHA1
7616c735ca6dc9090e2ae97b8683332d8a944795

SHA256
aa361e6db7352dd1bb72faa6d0a3ab6311d54700e7790f60f84b55d1b1a0e56d

SHA512
b84a7ce782bcc21bdb265fd91973b7d2a6b38848c285ab5f4eb5f130a7476d57303638f2ac7cf5acb71cf0be3ee5087c0d96d876ffbfad76a9414cf63b04d6bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7701c813e18d45c45fb10313341acfa1

SHA1
3ac946c7bda8ab30eed80361840b3ec1aa496e1a

SHA256
acf016ff2d57f4cffc3838f5fe542cddb572d02bc463f2a5f1af7332b9915565

SHA512
705b9d06a72317583ee75b655507d361dfbee8045a954f7e5ee3d94e1fe8b0c21f9e44d71eeb492dd77f94158296b90474b07a424de0a72f4b62a2959e6f2c35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f1331e13ef40856b54e9245993d477

SHA1
ebedaae3c970789a268692e5304ce9f1a8c52613

SHA256
05c1295bc9bbcbe3e34c20329ae87fc2af799366954950a9868baf2dc92ec527

SHA512
73e19e8c614aa92eb7458e5d112e96705d3b88d2aff04e68f96b7bb402946b94cf1a4d238d6bd247128d67cce531af2dc6ab2aae57b50d166b7f279875b75281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74764f436949b15c1471ec11ee70b565

SHA1
77ef0e092f00c5d6d3e937afb5405712789a9ac6

SHA256
a9d9431d427ab615fa0476eb784fcdf8efff67bdf485199aeb9a47ea548a2f20

SHA512
81f0a49a47ee84a5eb17507e29cebbb3642197c7eccb92616a462ef8d8eeaabf98c119155e2759eb765951e163bbc407d6a2c6af5c0b9cf0704568f2c52b66d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed1f000e1740062077250dda1ffbf875

SHA1
7c086d47de3fc2ee42693f90bf8c447ccb7bdc98

SHA256
d9b61939c7d72371b0ca71689cb5dd7a2c2de1d829fb0fde1e6a4c4a797f8c31

SHA512
6bbf29af2c7ee885c0165c33705a6a080abbccac7ab887063b991d69fd9448fbcbb9081c46c9b776792d4756991e310732bea2e63103adad2fc92b162cf90c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef7c06c5cde5fd58d781baaf38660b6c

SHA1
8cb6c7902eb992ee91ca2411de7c18fde8c98b53

SHA256
ae246b2b3f9831b414c85a3a89a384288335cf756e07a22da36fd8d3b30be35b

SHA512
9f28c7dec899f063edb49e2477b30f1fd862c72b29570f68ee4c9e8c32d94e629f357469b69126623b094fd330c8020b411fc78c0a2473c964bc53e36cab1094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8277a92a253fa8e9badd9a0f4ee35eed

SHA1
99df64e872c862fe1b96c619777b5d3c6f1f2095

SHA256
3accb461262152efd0e173388f1b8f2c2c981535d548d4aaf51a321eabea9845

SHA512
34d5a3c43ed40a5b998b78498462bc7c48dacab31f0df2a07a69c40f18ad7463a47cc12c60cf40ea78deb98a92a91fba5b8899a0ea2d85308e7fdd3ce1671597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
477665e6bc193b64a17813e4f1e4ca62

SHA1
524cc48ea78f66ac4d9ccc8524265842b7cabf35

SHA256
4b84fa2538bcd8eca4064a202933dc154499663c4c954667b4cf05c210d2b69e

SHA512
2a673ed53ad5519f39c523482f56810afb8095c5d9f17f2212e1cad3247498b933ea67e6aaef8fe28cadf2b6042c8a9354ca49fc900f7dfdc06886b72319353e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab738D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73BE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit