99abaefed9c31a858c63b36cb536e715a4972180bc5c5712c12ae8879103cf51

Analysis

max time kernel
67s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a07dfcb4b8a4c887c14c0a04c70f15d.html
Size

893B
MD5

2a07dfcb4b8a4c887c14c0a04c70f15d
SHA1

5e1a148dd0fa65c9f8faa47c74f654959490c5d1
SHA256

99abaefed9c31a858c63b36cb536e715a4972180bc5c5712c12ae8879103cf51
SHA512

9bbc8bc03145105719c15a263cdc5de410b6b246fe791f3f1891020ff8aad363699b9f931dbff8d6ca6aa5c5262e45bbd604da455b4f01531ba17eb1c8f59467

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901002d0f33fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000006adeeb5d485663656ddfc4b1c10f30054e677dd2624b811e2d666b2ac1205f37000000000e8000000002000020000000108b521deb0986bd4517a3aa244ad62964770f276cd3da61afe7e9d3b0d7c7be90000000bb32a0dda999103d8f064839b5c4c4e53c45122d6d7db8e32aa3463d040fd92acfa4863277d9b3c237b72d4901760372c44c3599e7cac3f863b277933c8baeb3f54dafb4c673d3b819a358b469fcd53cc406552325e2d9c68ab6d752120e4525865f2d4412953e66acfd8c14fded6480df3b0696e18deb6c6216334744f95c62970345c44f7a24ec5951f70e37b379cf400000000f007ee84bd3f9028a1af19f8a295efd778c8b0768fe2ee906b2318e7fd08adcca9620823efa3d1958941a9b5ba882140e9c78d9ad0ffc4a3b701e101f3a0a06	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{087CED01-ABE7-11EE-832E-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000063db8851f699d71af683dde94537e57e05573f0a00524312731c07530419e62f000000000e8000000002000020000000a4ef7c1c0ad886aec92907dc33055991b90dfab02d7e358b6dfa78d3b54edd292000000071ba441039c65d5ed0c95f32c2fb25c8c7e8f4f5ac244533ecba57aead02fb25400000008baef46e61f12bf274f9ae1c4ed447bca72b0812105de65d1eaec564377b00b3903ede3939d33cefa2e5427d304c0cb5624948a68fd06d2118eb9548550bff7d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2496	iexplore.exe
2496	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1648	2496	iexplore.exe	28
PID 2496 wrote to memory of 1648	2496	iexplore.exe	28
PID 2496 wrote to memory of 1648	2496	iexplore.exe	28
PID 2496 wrote to memory of 1648	2496	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a07dfcb4b8a4c887c14c0a04c70f15d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33b9a7c10a73455a94c1dc7a0c728ea9

SHA1
435254539cdb7fbd9d01e7f5524c6596eee01a4e

SHA256
79ede2933e6fa5ef220d26f7dee5bd5d3d9275dd9d677288d841518a62c5d451

SHA512
e89a0b4a869491b3758d67ea8e6498f5cc1dad8bb1de231ec8a230949577b2277012acdae0109913b644a98904c435a4c703abc12604b9f6958e17c1b750d8cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2448f396d6ffa2d282cf3c338818da0

SHA1
760b3ba8ffc0bd6e5703126b9a0bb1e47bef156d

SHA256
2ff9c17fcb78d71bd50926023ea7a6c29bd3365d14c9791841cb7bcc7e8090d5

SHA512
cb540365c5a7f26148c95a1c85d719c4acf9dabbc6015ae416ddf1ee7c9148e1c8555a8ca9c030d15d5b1e80c66d1d652b68b52048e4b972c3c426315d29b62f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b65ab204bac6221aefc133e4540a59ea

SHA1
11b6771ae42fe5bf870e2665fe9977eb28702592

SHA256
9bfaa10ac06c4bd1d27a669c1dd17c8fa94f278e031f22809307d8e17a96b307

SHA512
db9924ee85d8976d5ea1a8275d2c63e27e6411babf4d386f01ff76d872f8cae065a2838986fc95cb48018c3d7f86df08e05f43f086b9280d31bb4105de739062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f26bb1e0a4bdcd6a000c24ccedddd079

SHA1
2571240dd84f56699c14efa93c71a96558c26cd6

SHA256
311358a08903046b6e63fc22835dde42711046e41efb69c21fc1d52217f61aaf

SHA512
0f6f56c5cdc0d0dd1835e5435c67021211fc42103d1ace9535ed34af444399dbaa1228d4bd9a4d93aef580f4ff7f4a036ce654272e1005a03805e33aa932540f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad55c389d2b5b324da2eb931cd4668a9

SHA1
c1c34b9ad9b60c7c26bac7d4a11b29e36f7be44d

SHA256
14ed78e5c3312d0a80b155c9cdc063c4f6117e4e9b292c238e875ecf878cb32a

SHA512
c0699cb01134f9cd442b618abc551484b3ebf02715a6b5f19022ff321b86fdb19abfbe2d1914a54af9346933a6dbc7b79894241500c6bafc80f629bac9efd73a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87206b3934dd1345c47f1f45ecf40c41

SHA1
4c58550c8863a0fc13fd07b5b6341dd32b0becfb

SHA256
862233a1dd2e4e8e8f78b529ffe32b35df5625c33167daa1d618b5e99d0a1cf6

SHA512
3b8a0992a73311ecffb8d639ba89079ef2712992aca1944ad4e3ed658e5f9d75e62593a7ca54955051772be4d848a5ec51f772b70f61ea694df40e876217ea22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bce8af7b066996a3167af6ff42158b9

SHA1
c4e85142cb0e8c1dfcf8233c8235e3f45b2b928b

SHA256
9d0a2549666049fac83d787d80d6051a6e2ba609bee2b664ac3c41a43a4d1b60

SHA512
7c7dcd145f2461a10093625b06075fb0ac64903677e3ace21da72c10dacd1e38fbad43b86513cfcd0b02c142eb024316883eeb49c0e1a4f1672c29810beeebe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1fa43900e8d0f6589ff6e676e06d850

SHA1
af091c45a054c72a6625db5ea9526ddeef31b6c7

SHA256
978b203286c236e74a2f2a50f0ff77108f47659307731ab5c47126f467ae184c

SHA512
4e95791a5ad778ba7e7345790a17ed04bd023cac3ff1a0a648e305405390b1489671324e30d146fff51dde1da09ebea9a8d0023802df036724ec6d005e129e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec8f69699671bb946216b56f8c8ddda9

SHA1
8dc12e7e9180e641317095267dd67a9b07db24a4

SHA256
0d25450beec6748b0ed8d060e012c4bf9d890114bfac2a76ee0587ded0629f0a

SHA512
48a58e9ecabc519623aab677d1cd011f7af5e81eba31443d42f0ec1ea54b854ec628ccbbb648175acf6ef33922596086a590969b38d1c581a4326a14b080171c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356717d96621e7d4818205630ea3202c

SHA1
332f7328dd3122fb67111ac5ebe3ad329a60d390

SHA256
ab69bd068e73e7d4b35fdf07cbff17efd8ab17a69c660a347aa2ae58486038e1

SHA512
cc3a5ac0cb8338c4b2f58b4fd8409f7106736aba052b0d6ce340dc408825a3ccf49ed469cf15d207e29c35c01980a2d0ca03c3aa77fdf78ec31d0e829176e636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb61b6afcf8aa3481a7f4f210bcc6912

SHA1
73810fd0c4d02c58a50b77fa4136e58875c8e062

SHA256
0c00bf52261c8e9b948e36ebafae9018ad24773cc86a7a86fdc3f7a4825de1af

SHA512
bf35a2c31982262df592d3585bfa9fb2493a08a531d1d4b59a5856e10e82f0db52a555f53bd48087988a56385123be5914a6d480b47e96d479f4f626b0769c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5474e22e1e7be98c68b5d51f59ec193

SHA1
632ce7dfb24aaac49fb6fe67e054d970f304f22b

SHA256
8f2f0df457ceb6d71a5ca2dd5ee6ddc8f9e33a0ef5a27cb5c9efb56d92c11eab

SHA512
537af2a59952c4dc28c4ffa1c8d07da9bbde5400d764223970559ae528fc63240c7bfc47f266bb6ed863b2b3a9c8a8d62f3e39957d470f71ee932becdbd5ee4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\02cy2i9\imagestore.dat

Filesize
1KB

MD5
2fdfc311781ae7ef4d0f8d3f4637ce89

SHA1
7c2309038c0c61902d11d574dfe7cbbeae54bdf7

SHA256
f4dff1a701a5fb01049970e47e2cebff2b06137a36f62cf87e1459f10ba0fe53

SHA512
f1db8c70d57e795eea3386f227f36ca531bd688de100c8f21748f1f84de811f383260d9dd33bff77e156179ef71210864578acc218ee5187c2cc9c725859f55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CCD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D8B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit