54f2ba03e0e341cb547e35e293ceb05c89488f8c47fa7a4e5539fcff9084b6b2

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

web/list.htm
Size

230B
MD5

599f0856c395ee8d5908e59b09830031
SHA1

4e526a265eb440f4311e4d3441a624e757470fb9
SHA256

f36f6f06123aed41e5c14daff2ed891981f8f9ad06af71d21e97cce7800ef983
SHA512

fa42ea8ec1f4cc59ca1d674c7b7786b9d2489ebd01a460f1b3587e1ac85d1d928392a570de69d0961c4e3a3999361c091f42030d27dfd44ace5624c9e4d2c5d5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF2619F1-A92E-11EE-9D5A-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e055fdb33b3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008a1178858ef3e7aa0b825d4c58549a0cfa285e683db84073da34d58802aca2e6000000000e80000000020000200000009e4b576835ccf2310052fc86108e5335ff54c62556bed339040ee473159417b290000000d0c8835fb7eec6c9de75631543dbede7487518a0a9ad1f415f3b72586d9b93a352ef4a0b543ed9e71d2ad2d9c9f7594dc304cef906aa2b3e30389ef9450ecf3910531d00c3028db40d6a4ddc3ed71be6d3f234bd0c2c34086ce77e0f95eb85f26bdfd4ce84e7cc59ce8796f6d6976223b7fed965175f7f69241957147e3f0a8b44472eb91497e88f7f507ed1abaf8f39400000003d0324e45c9752159d35d532e86629dd731ada2aed25e9e2c9a27053632ba7d49640ad27139fde1f783405964c61e8ef3ac8b79e0fbb62460e161f4c1eb8354d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000173fb65f56e261e0234369289f7f7fd4cd16d307fec191dcd0bf6c347d91b7d6000000000e8000000002000020000000f868c2c6b9e5f55d3b1a968f5d09cf7f376bcc103d7c22afe086ba522a3a579a2000000015af757622243e3fda3e685844392febbe18c1842485d431e468473a1b5e0cf040000000166ea0d6e56fa4b1fab36cfc5fcb2e90857608c353740825a6f58a2e1d7db432c03ade63358e10fe4c0d4f3122e49200855ce6d778a1ff17713b5ce72b6436fe	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410334801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1984	1888	iexplore.exe	28
PID 1888 wrote to memory of 1984	1888	iexplore.exe	28
PID 1888 wrote to memory of 1984	1888	iexplore.exe	28
PID 1888 wrote to memory of 1984	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\web\list.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb6995113c46950f6efa01161741e800

SHA1
cf293fd7279d8a0970c0cf0cd41d0ed918db88df

SHA256
c2398581bbb77eb36a407228996fccf8d722a7b2ec65b67a76bee547d3ee4cf5

SHA512
cbf1355c586f672b1646ac1ba8966d9c6501a11523a286f326eed621eeae456329cf21822bfcba288d0e7f8e1c95164277fbf85b0560447a38e3d67c8e03e2cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
089c056127bda8303f94a97ac48f6e89

SHA1
43f81dbcae6485ff287ac1541018f0be36a50483

SHA256
6c3025ebd602f28def38ac1ff0fe291a82b976c185a0b1252ed1d608d02784ee

SHA512
30faf4c9338dd647a5b87e481332bd207842f54466b1328a985e93ab8c2b923b32adfe1859180856a1c4d074522d59cf28503eb7b8e5cd1066646e48771a1460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d16e21c6146ab782c01071f14e82071

SHA1
6863ad2dcd4f8e638357828646a102775c6bb6c4

SHA256
f1bfbc688e2425e02d9e371e2f30c74835477b9fa47f95a40ee22629f75c5eac

SHA512
e0ae78a92847c2fc1fb1161e11f693ae24c55b888a4c8d60b7203dfe48275e4134fe4e45887d44910dc3d146c9a3d384b3498ef6b1842521622362e3f8a6f519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4d98fc3e0fdf8876cb40bc9f1a1e0b8

SHA1
fcecfa3313ae9d3f9b9379d19e9af9f8adbc2ba1

SHA256
86b9efe439fbe37ffd337aadb282002c3b1d7737f120f6b6d631c71a5d608809

SHA512
c065c22059bee82eeeb7aae689739a906f1c60d3abe3ed321f43611f1a0e0d2229a2a16dd4b821dec289cd8fff29056f31a9349c94b65b429327a2cb2b4ca3fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04694163a777ae11c9de220a53ae5aaa

SHA1
c8e5230b9cd3dd8f1459ef2c7597b7bff37fa51f

SHA256
8b8f7d6e1d587c024896bfad8f26901a1cb244b597955c91a739836dff0e3071

SHA512
b8ae8df1b05ec3f538b5353714a48cc56ca89fb0169e79fda72039c86c0f93113ab4efa2ef61e4c5f811fd93604764eb591651bcd591cec903d25c53ce4696c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
779ce3f87a8b690b28f4d783356670d3

SHA1
2fb0e0e21369bb18d83984b93a0ff09780b81ea6

SHA256
dad3b414388223006aa534c2d6b88757ff26c111e6a10ac5c973282c911b4b66

SHA512
574d929eba5815f615776644c57ffaf3ba40e03145047c2da3de508488d90867e6eb864502d3414dcf3d008a1e57239c6c479b96915d727abecb49063948b8ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c27d08429749fffa628a4387a65379e9

SHA1
64ca77df6f4cfe63504b4e1be8861df5b22bce0d

SHA256
ebde764146447c2aa5507b8e112c7d0bbe45a95158dd8d88d6fff66b94f98937

SHA512
77d3b12369d61132b4fddcdd0283ac7b2247e783bfecd36cfd5233dcf7168c999ee459edd79714eaaa8342886b72249f34606793fa72c846f97b5c425244b78b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71e975a8742b9d8d6cf9d53d3fe7af46

SHA1
8c8b42abc49111778e7671539a81e8c473affec1

SHA256
2ad3bbc7fae6a1a06aa0f046587a7261e9a4933433ef19b5668ce83240c3d68c

SHA512
acc4365ab794f217d7f3d55676e8c63a5a196670b8e57f0490fcaff0356f5b3a84067d9a14b93a552a858b7490d619b526da6088acf41c1190cbf28a86b3fad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e51a03ebc6a79fc9932baad9c6dc60d4

SHA1
8055327f21e6b360084d8f902a682a214a388804

SHA256
78b1a3013a20aebb8f4afe92369ccde672ce3f2ebde873ce7e92bdc50c61fad1

SHA512
4d7f8bcca552b3362aeab85b2ff467e4b1dbe8b02a11cb500e73009de0290e1d5b4c63aa7954ba1b702b8e9b3298d5cbc69eeb79e2c04aeb5735bd52c2e1fb40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b635dfbf6fe46df8bcc1a1caa14f3a64

SHA1
81ad1618c6a475928bea84ed788c035c4a6414b6

SHA256
aee3de90a6bf4141759d145370aecbbfecaef244a1fa75a4504f611424778f9a

SHA512
61e63364901c517d6ede96d209f890f3d31ada8f04ba9fa9ea06516e5303a2f615a43cabfa54e14388cadd85dffeae133ad2c7ff562e8d8d878039cf48fe8b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e82d1a8455a8a6f4b26f1a46846c4b7

SHA1
d545be073b59915052165335c6d4730643f50d15

SHA256
66ebb75a19064e5a5dc4301b03af0cd81b936a9612493a399000e55c64db8abd

SHA512
000bfdd9c01c29e188e18f4a78f2b30b8be5111587751b53fab0f7c9e6cd49282b6deb3dc2966f284a3e1581e5cb1b4ebe2ff0aa0097a069a8c5ff4af66c9fef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5c907beb17904752ef270203c587c93

SHA1
3630fa07e4c688619eb883d4e0e6a91efbab8b50

SHA256
16191778979241b813b62e5d067c87926119212640c95b16c7d398109c5c46c7

SHA512
2d46e1259740c472718558edfa2848d0c26bed2e761bfd19b070b0d0a05b100afed3eae4407941b7a920d5a9e5d19ab2425fdd4c4c7ae7fbd8abd238fac7c7db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8dd3dfb079c71d4b6a4fba8164fb809

SHA1
5e0273a0cd38a2d3cbcdef00930a5a1999f6be9d

SHA256
1f6dba2eff2f36880d037a271b8ba9c2546394d77a6bfcce04d0fb4fc314c067

SHA512
ecd804d304f50395371a64323d546b9b9515606548d4e1449de5b15c18172acf85dc421ad22c5dd5ddc799f4248f194c2aa3c550eb29186661f946f7672a96b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d0bfb6f0a44c14d872194bb3fee5d4e

SHA1
17c1afd062aeace6eea33951683e0788c6c6b28e

SHA256
9c431e9f012a678e5f82d45791f7dca9693e2394c3e55fbce8b1afbb85ddcf99

SHA512
d3d7e6cda384a0a41915380133fc7c8c05efc81063d416b0389c0c97dd4bfc45e873324c535b7341738a52296017697ffe795e1af650b2d5653c93ae53d6713f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ee9b9af30747df8afebfcfaeb0bbb21

SHA1
97bf08db98bb405d2fd3669132b8166b014f7fda

SHA256
588ecd5691f1e73f5c036933a6baa0b75cb57f9db3cc2e242657b42adfbd8d3e

SHA512
c254a78e08d60efaf1ad5508c65147769a107faf929b3734465b96dcad945e047a9031e553ffc45d82f059d12bbddd72fb5ab5c4b7f8a48e5577699ea50805a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8C0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA8F2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit