2556ce56d70b3bc84bb8bc80a5455c79f43ad715d5229546a162cbecd2d09430

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a594e146cbeca3e0e9f5763fff03df1.html
Size

432B
MD5

2a594e146cbeca3e0e9f5763fff03df1
SHA1

e35e0a25df8ef24e512360e6ee2a62081783379b
SHA256

2556ce56d70b3bc84bb8bc80a5455c79f43ad715d5229546a162cbecd2d09430
SHA512

7380ed4746fc2a5f402c18c725d3b936358f2ea8b98990db5f9a80ab920e71d90cbb40d75d0da42622aa1c5a3c90ba5cb692a568ba7257f30e7721424b67bf7e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000086fa91f83dca02394f3b579d2e1fd3baf2e37c4a3fb50b9280f077478951ce5d000000000e80000000020000200000009310a6cdb06ce05cb8cb74d75a6b49ffda8c5a82bf4363e564c0f5e3450a159c20000000baef5002f959380e24df010f831a969c845372fe5e91cce1cfd058393c32ef7a400000006954cbd5eae0e19f7df63761f62f35ed4cf1d6a2eb7275af8958b623f0162f0f274ddbb2b8017b7ce6b54e0d32272a7bd2dea6fa597a95d4f6e6b3d1481a40e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000048522759894a22c0f5f8656666c186697f3d19f0bd3898307992f3e4b17b7f72000000000e800000000200002000000008352bb5788ee991f742e6b78d19d096de86f915537ede1857144995d99a705990000000f1c4bcdc164ddd0a33bdcfb77cd381975460a300132e569bc7c07ced8e4f8e84eb5d817cacbc2793a7f3b53d64ba25e62965c6136351ab7b39c104dc10d606af4e2c4cd59dd0fe65488188674f8d6847b13d225d3d459162447399214c2668989234596593b1ff760cc65104bc3b896cf6f7e20f472f65e8aa261d02f8106735385abd9258319e3d5a09b09dba1f9984400000007a7e526113c16ab393b61b75e3f0fc8b7ecf9b624f6fce6381bddcc6797b9aeb857dc6a7d5ff82b856c637bc14ac77e400ab2185bece44ab07c8a0577a33df02	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410635554"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8093c0e0f73fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B598561-ABEB-11EE-9BDC-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1820	3024	iexplore.exe	28
PID 3024 wrote to memory of 1820	3024	iexplore.exe	28
PID 3024 wrote to memory of 1820	3024	iexplore.exe	28
PID 3024 wrote to memory of 1820	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a594e146cbeca3e0e9f5763fff03df1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5304b2a5cfa9f5cf9689a579374179a

SHA1
9cc0d9fc8b8af68052fb4aea9b37feed39fd90b8

SHA256
274a0fe3f26bfc6eff0481d6a157b204707a467aced3fe0fde207a97689ba5dd

SHA512
3c22740e87561e4d8306482084a2a63c229348ba1ed0644b31696f07174f5da63d186120ce0e2d925c6c788c536b1c4cb5c797fc443325e8202c977bf68f0bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5ce7ddd0e08b08177a43a1d6254ec00

SHA1
b280b530f912b51634fd4eb612b3926db7438628

SHA256
1d5d3f69566cb8a1f36a974bf82ef18659049499231e6b67461d41fb8f164afc

SHA512
248167ed0a1e8fd90b9ed23a9a2a9efe62b629391e40311f9101563edf483bb1a3c317a2f73dec42323d7df704fca2d5907129519b6534abb9a89f33e168cc3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1918ad75b1c010b56ce4a8febbcae8e

SHA1
c3fbfc228aac55ac0ced8bdd8f0f57cf1a8c288d

SHA256
c7c5e196895839a73fca7b8665eea7cb2a20c14502e36e22a70a2c69749039b3

SHA512
71dc35e4398888ce9020a49b323d01dced2e296b91f421159d9875abae8ce98e2f368ac5df501990f86256ff7d181265c4677be94ba84ac0b1751067e72cc387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96c09f591a1fa22367407ff3619f85b4

SHA1
1e155e66345230885e63d796c775c58c3aa45859

SHA256
44bbbbe7bd2a52ac6febe0a5acd48ffbf2df10277a8d2e1f0849fe22e54b6ea3

SHA512
5c11be69558238f95b62728b830b091a27a1dc12b2607626a81591b52a676c695045f18fcd3818f7fa831f7867017fd37d79b22a64cd64e12d916eee7fc2bb40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6a0c9fa7f031a22a4b7c89e36a572d0

SHA1
e79000677507aaece0088411edd4ffc4522ff612

SHA256
b02c8d30f6962ccd8b7d8014f5578ed793880e127cfaa833e49fd49f05c0e396

SHA512
9a44cbf06693bbe1cdf9ae702d8ae2c461631018be5249861d30409050030bba4266c468f0d5813c57efa9e6cac5fc82bee2b34947251e2277418a6df820baf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aa05f3d1ad89a570f53df8a73a80ac6

SHA1
1f846b79e505d24d4681270fe77d2e168377bdec

SHA256
226a03941038b47617d34a6f439ea92ede87b68471fc59f3aa9da13d4b7151ce

SHA512
773aaf2414549ab874ef76c0c1ab47f0acc96dddec95f770cd65a15becdb296329ae40048d783f0918d0741a7daecf92bf183d9b8f575348ccd816f9488ac1f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15d9e7f1bc4c7364dfb6c8f5c7361154

SHA1
7a90b7108328d950ea243ab71779ccb453205def

SHA256
22fc6a6fbaf0b3c143ec8ed47f4a2c4d8c4f8bed36e59571d89824c36d173ba1

SHA512
823faf8132dcd5300f238a1d4fdd6d2145f9e4463cf1d32ea20a95ce0b209209d983bee0ed28546d76d7e38597aced5791a1047acfc5a57ae82e27d505a9fe25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
775e7415e6f4a895f1be7e7c92c2652d

SHA1
018bfeef92ccb2bcf678e1a65a1d13829ec7b9ed

SHA256
6d18b8e3e671a33fcbbe8cea78c085e284191fd7ae904183fe4cb9b075aeee8f

SHA512
f051488253d2718a8d56aa7089e329509ebfc5e1c251e5bbcd4542c70a1cf673bb20003ee32c8f45dc49efb8ee5bdac9eeed055aa0c9fc74d8c320da57124778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb225e9354def7900e4c03a57a25bb10

SHA1
a8087aa47e54839274961baf739fccb65f4ab41f

SHA256
ffc82a005f1bccbee0817da4e96d6be5e625c306b4f39809a512b13c3671410c

SHA512
9e90664fc6f0b7db87cf85a0dc300fe6bb7affb407a5adbed03ccbc9f6960881b3c557315100688a1d6d91cca5ee51937714d0ac12a44ae909f2788765cd7b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a12bc600935256ca7e42d3c21f9a21bf

SHA1
57b3357f5b9a1de88267a46012639b1d8144b185

SHA256
af9b3102c58ff2240b2663f7b7ee7b9725735a02d318b7c4cd9ee12d3f6bea5e

SHA512
a260392bcf9b3b637d87aee8c39bfae64d887768683ed1fbd4ebf417b66000138bbd9d41d49bc318f92a4623cfd09015394be8320a190db1c3cc72a6c2053619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f8bed232d25f264ba5520160f7cfce6

SHA1
cf8c07db3461e5c95f218f111465ac930d7ef242

SHA256
dfcc7e289cc5f16c94b748817f6be9a48cc3dcb3b1a374d91fb7c80fea4ca917

SHA512
09211925e3fd3c1ecd132081192ae1845b1ddf788e6eea2abd375b8fb62dc7330931f61747cf5e66b97dab9de755beca9c3321c96da40572659bf401fdc6c2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8b258cfd4ae846d4b1278a3174f07d4

SHA1
c328c7dc9ebf6f8a9c8628553f0d87f1cc8d7359

SHA256
d77bb0748603086c6edeefc2ec3fb0b40100de0b8155bfa659f241cad5823fb2

SHA512
2f25351a5583d674ed9e58989846b9b1bca5bc0f5417f0ecd0ca25605c40e828ed309f888ddf972f28cc4f528978461fe144c97f4048ea4a8f41a31919c1e5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t83hqs9\imagestore.dat

Filesize
1KB

MD5
5ea0db052c66aab16b80494cb3ed7e86

SHA1
9b07be1fa8127ceab0f4cdaba01e43d975bb9815

SHA256
4d3504caedccf48a688a93f51b205417f95d42e0f3a676c59858892e89d9c8d3

SHA512
4251c35a7cccce4532775f25dbcab4fdf05ff0b161b6ab0d608934042b942aa66df2214c9b96e5e44535a43438502e4d543e9db4707c401fe724239e6a957f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab68A4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6934.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit