053899e59fd29ce93b7d1f5e33092da2594d05643332cb3e077d84e74801c7d5

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c1b796f8cd422c02f6cd70e5953ec31.html
Size

1KB
MD5

1c1b796f8cd422c02f6cd70e5953ec31
SHA1

f9e7451cc4e8ce23739ae19422f8a7f9c87a4f42
SHA256

053899e59fd29ce93b7d1f5e33092da2594d05643332cb3e077d84e74801c7d5
SHA512

ece6ecec01584d685ae6cff511b66dddffb8f4981a9aca757bd92cc50f54c0739370b87c1ce8abac546b9ce8b7efe1be577a12cae89b2b3b6cce5248db50266e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A44C361-A85F-11EE-B1E2-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000616463a5e41567ce47acfb974a06c1ab8703b73f854e6d9d204b4bc6010dfd82000000000e8000000002000020000000e798a0a6eef6ab3c94c0f3ab3a42c6accec9b4bc36be3f7b6720133a434f3b5c900000007b4ecf32332ad5d532c4bf15dd855a5545d95d24519b19748a95749ac106d2c2b4da69f84c475baaeaecc76455f778a9a5917b1fa1733a95e92ec2e6280ba27413ded0057536337aa3902bd1e7302ca831877284e6ca4f891945c886daa3ca31e8944ab2865621e8a246220f4d1b2a6254b33f1c3dc34b3b47c4578335fd8b4555b20acab4792e3c14320c68f71aa0d940000000b5cf5c4bbe5d6142c8471a220d6dacaa0fac201e3f31a7dedae438bff3984c71ad8cf12d11c9d77c63940dd85b310aee2af1e1bdfb61a7629118022a7f8b33f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410245644"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102a5a5f6c3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000a7e9d562519ed50c0d5c42d9e8a36599a25acf4f9717ee745e275f19978e22e7000000000e8000000002000020000000f2aa33c6ccfb8d96e0a788ad9386e98b0ee204d52726d6165eb866aec4c54edb20000000b252b410c8f1c0e75ec4b091883a616cf93b6950761e656164970b21258e98544000000001b5245ff984b14c7c383da9c5365f80136c8635983cd775128f528b7adedd44afe90658127092b140f1ad62852766d64492a13a389ee740657312d10dd90713	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2144	2112	iexplore.exe	16
PID 2112 wrote to memory of 2144	2112	iexplore.exe	16
PID 2112 wrote to memory of 2144	2112	iexplore.exe	16
PID 2112 wrote to memory of 2144	2112	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c1b796f8cd422c02f6cd70e5953ec31.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f88d62bcf2ff53c74b584b3fb87807b

SHA1
286169d1ada271a6ff67655568c6e003982d8d69

SHA256
85f52565b9b1593a39b1d53abf9c8dcd137c8fbd4df847e81bb8ea2ecbb65cb8

SHA512
e9419ad0b88a25188b4281abbfe5b57c58f290da6bde689f36675b2d0acd2726e40f6108f9f79cc2a084ef71d564e1dbf990287bec67a4c9671813e7a4cea417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2284629543c749308ddeb7470301f93

SHA1
0cf60cf59420a761554b7e4fa89f98f30ee449db

SHA256
9add9d3263829f148f4f10aad5ced49731eadf2c64524042d4a03a60045bed44

SHA512
3dac35b58cd7bd301b200230212afb7634f7e5a52c8d1ae194ecc094b5dde1370fca0a8a0bf37f2a862d4b28cf4a954d01104ebf375c1631d9e8daf51bc02081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f698f244b2503e1d2014e3a9851ea32

SHA1
b1045ff42a9d8ee5eaec573d6e00027e3116f78b

SHA256
585b68884d27d426ea992a482d9d8066fa7ed372568d63f9e26a451ba87b1dbc

SHA512
162c237aa087cf1815e27dd8e801ba1ace57b63b6699b8c97ec682988f02efadf59bb4724bbc519b7784167c18a344ecf41f2830e883f831638c683fef558aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4817f0f7a2e80a7c6876712eefffe16

SHA1
736e38fcfc2b1a61a565184a463befed82b1ffe8

SHA256
dffac05412975ef1d14a59a3e34cd31da98a4233981f7778a0108e74772f93b3

SHA512
0234862a76627a44aa77394c0d366170f16dce01f1bb7c2bbf60a37f0af539e7af24086bfff9ae65727d48ac267f1f5e19d90284a07ed4eb81d02644d6f9f7d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e265f3db1c90639cccef02f9c97b965f

SHA1
ee005566ee8e01ffca6d71eb7c5f464f0ffc54d9

SHA256
2bc0f61261cb31f9bde7bf4de1ebe5bdaac09bb80d4a2d0f86666704b1a599d3

SHA512
207c7482540c68fa3aca782d2de7bb966dc36f45f5cf6af685587ca4a5ba72d66c2190a6c5bf50269ec7ba7ddaa9d84013bae52bfa3094e801855640aa9c356b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d440dbd2bca8e50affcfbb2fc5d2ad61

SHA1
81fb03a88ffc975e5b7ea8b435b9c7d80d86ce75

SHA256
5f361436f57330857ed8333e74f5d235d80b5c494e560b4bbac55f8f84689177

SHA512
176671eedf4017881a1944b3ea0dd31be00fb430d0988f1aeafcff1b7c579d2ddfdde06f26299905981180ebf096c701a4b42efa7e72500d73d84ff89b4c437a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
985c8fe51f493b5234c1da127226d536

SHA1
a479c5fc66684841fbdceab74e62b850cfc37d49

SHA256
15d29a549747d8b4297e62470e2bed1f75c809a0663f5f4db309c54c435e14aa

SHA512
d271845dbf523479858c84de46bee81f93f796e1db327836ea3e6b2ab791b80e5edff31a0e4b73faaa3d2d3c887b3bb8ff6203fc846fdeee931099ae4305d0fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b70de242ff2b2b854f1b8ef8332d049

SHA1
f5e54658aae04725967e9237d13eb38d9429dcb7

SHA256
063a573e2d82c370535c5d677e456f16ce5e22a9924cf208728a938bf8be9ad4

SHA512
9dca8150c6cceb0880d0b6bf2af7be1694a4fa5e50af9cf022312f44a1dd5f5f67391c445e05a34944e8519660993d6475d27ab663682b834f4f3761336999b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6189621c7db5f12173d3ec18a349c811

SHA1
18439078e6ac8ee4d7b9441429db0ad44d753110

SHA256
dd31700dcbcf8dc05d4b79748a967d90a88c1b2ff55c289fd2171fd51ce96619

SHA512
c348a4bee28985daed762315edbb52f2c48cf6ac937f3af168d84aa27d537f80797c53e6411d18bcb8e1a8cc78d6738474019c04a574959790dd3e7aace0441c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab601B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar60FA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit