a0925e6cd839389067b2ca3122919b0c1503368d03d92e81bb093fe576ba3dbe

Analysis

max time kernel
143s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2864d8af643cac6816cac8000230e2c6.html
Size

1KB
MD5

2864d8af643cac6816cac8000230e2c6
SHA1

531caa06307d05efa4ceecd4f8e54f6369ddac10
SHA256

a0925e6cd839389067b2ca3122919b0c1503368d03d92e81bb093fe576ba3dbe
SHA512

88966d785dda05c99f4a3a90e8924f82f238986d5293b4486c1e6e2b0c8249c98436395a4ef9dfa2fc3636cdf6fd77b21a1a9fef050646bd13a1d58175251e5d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000001c0f1f6ca6dc330a50872389c22cfaac54d19b4233bc2337897ec7ec0296a36e000000000e80000000020000200000000df20a7641f65fde241138bdf7f28e00e8d7abb9b34f0dbcbb68175267b0392090000000893a2621be81bc03dd48ed9ce299425dfcf11384c7ff09a079c5e5ae67ba03d2020912cc7128fe4c69efff365c4dfc2e7f17b85eb2781806aaf0ba58faa96cfcd96e98e55bdf5c18c9292843ae3e488bba0b3d9ceebdab8e535070358eaa576be7113c559a074cd4db12f0e5294aed225e9f4161a6b8259065bdb40c22486af9502958e23e332f76706571b04d8a7e3240000000413e9ba3accbbcdf8983cc177d653a93a8c28a2eb26d1fd100e416b62455c9009e955adc8551426b7475f90d3c5457fd7949848bd9dbdbcae673d981cbddf74b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410335895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502901423e3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6977BAD1-A931-11EE-8A74-66F723737CE2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000b9b6908857247d536574ee73f940a27be41194e8e3fd33d516ffecd02f152515000000000e80000000020000200000009a48d20b2e3e515ae63f6b06dab9179e861471931595c8fc45b63062988083aa20000000c310dabfe37133923446646b57419cfa94ceabb60a43302cca48d63b34459a5740000000e27ed5260c85fc2a2f91ac119ec6de04f3867d0e7968171f6b7cde245b5b6432980ee80637caca2a694b8fe85414e862c8c109f6200016a74fec8345ec051a2a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2420	2064	iexplore.exe	15
PID 2064 wrote to memory of 2420	2064	iexplore.exe	15
PID 2064 wrote to memory of 2420	2064	iexplore.exe	15
PID 2064 wrote to memory of 2420	2064	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2864d8af643cac6816cac8000230e2c6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b53c674da6f4a937b08407eb8c027a2

SHA1
b6ae34deb0fc41310187ea5dc1a6c1d7550a6254

SHA256
3e1d5de1a59a4d42edcba810b9602ae86dde3846e7d8ef75dacdc60510b3feba

SHA512
c4262a1ef39346d5316d67f7cd6b85194ef2210b9188f2ca04ce99efd7e39dd976d9d2688edcccdc94591da68b8f46ad6bd0fcf9d721cd887e87a36455512d4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa34d670d6871c730b046f1ee7a4f5b4

SHA1
b497ba25c393fc581a9a8318d51da22ef24dce47

SHA256
283f9c3c0678b7c4ebf8560881e124dd942c605f087f32f09e1a4fb0c59fe095

SHA512
9a2052fa73adf96d1aca1a9d2719b50a0a33baf55f0f83c65147a2444bc2a6910d65bcf19869b4a54942ecc88c4017faa0aea805c0dae0461560ac0d3b16dd46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f3a327a3a9c14afcdd0ca988e8e971

SHA1
e965b4c29e212ef4c943366aceb1ab97b0474478

SHA256
d1c85439a8308d2c1efa46b34519212809aec0a80e5fcae200f917eb3f807fc7

SHA512
834e1a56a731be5b67b87d14cc602fe27eb147526c39c9af58f07231cc8a51d1a58e36e36bdede1d9828f8ac6b70baa0152bfd6c3871f94ac5f4590306982c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f7d2bad2763f81360c356515d584e09

SHA1
751b9cbc55f7cabf242b8266f50462aec7c836aa

SHA256
9188b6147412b887310b963ce877004701446bf4584fba530a0e4f46a4bfb51c

SHA512
0525bc36f569fd04ccd1df7936c4a730cc1342fd7b6c053363511e44705ac3e7a4c94a7c5d2403287faf064f5968809ad3e6ab8a6c4d0c334b742cfd8d2038b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78008186f4358249eff471bbb27b13d3

SHA1
fad1e38565cef7c9d944457bcf7f0902edeac99f

SHA256
afe539aeb2762fa53086873dd99c726a6aa942d4d97e41bf3ddc058e21cb3824

SHA512
9d8d589700ae5ba315b0ab57fa90f2c37e1b97957db12f2a4bf1af5a4ac3fb7011a5b4a90c2031e794707ab62253c7340fcecb23ff86d51a276891ee255d03a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e633269536e6a277e459fd3493e7929

SHA1
11e877e2b7453e6a3ab3a39728568d89f55c492e

SHA256
c9b5dc9d0530b48864fe7a8f8b12a21afc807aa91a159dbea338a36c57701933

SHA512
ab66dd21ef76545e7fcd16763bdd03b8ffd13b9f87bdfd3297d10089970e7cb5e542ff62f038c8bce32eb31ed354d13d6a0182c28e7ee6b66a4102446530e222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddd896311e497a58dfe3247e3b03584c

SHA1
a7689bf283a75a524d86ef98aa5b06a3361c5cea

SHA256
f438934f53f266964105064ac6330a3ae1847c1aa75ac8849782641407f06583

SHA512
8559b62b8d1315a0ca2666d734570e766fa0b546b8bc584aa017453285ff4c92db56ddbb6a5430401f7e8ad88b60dd26047440eb4304d942253ac015e408f08f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aabf532877b75caedc1d70386ac5ca04

SHA1
f8f620e570e9564b83035c05fea41ef40b9c3fef

SHA256
345f0b030a46fbcd22e31b2204c7537b1cab7ddcc8e0c1f6ef3533fbe7e5bc3b

SHA512
31e70471098e2cd88a0a542a0ae95446a9d1ce9c4bdeb9fd9f87f22d435d4c7adb9efd31c8053947705a6f760409722bacaa58cc95e9d9efc95a1afd02fa2b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6988d561aa8c823c168fe125c0b2e5d2

SHA1
05d0200b0987b64a5c0b8d1f0b9642c2be2d3bbc

SHA256
f14584fcda9bf825c0bf77722a0da79b8611551362232afc9acd84138dbe3308

SHA512
865e6309f9cd90bf627174359b2441c0813e5aeec9fa8d1bf382fdfd130d2f869a0f6e7894f746216371ac6d242125a7a569600d35c43a59609602084d1c5bc3

Download Submit