ca38454bdbd70829417e9f1a3afce869eedc9ad9adb3478ae7a494e89175a07b

Analysis

max time kernel
120s
max time network
188s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a59d9eb7d70f8b324ac7e2b9eba9efb.html
Size

2KB
MD5

2a59d9eb7d70f8b324ac7e2b9eba9efb
SHA1

f340b988d559a4877584b97d394a1fb8fb616208
SHA256

ca38454bdbd70829417e9f1a3afce869eedc9ad9adb3478ae7a494e89175a07b
SHA512

d8124849584206785a031e888043823af135ab999aa0284b15335c0c3ef4c7b06ae0c9ac19b15aa0d06cfe4981ff0188407a12b8d3c2aba7ee17d82dc3b4c45e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000031720dc1f212ed6e2d9199fe904bba86aed62fb7fd814645a8d86a8ed89a9500000000000e8000000002000020000000b2948eb3198eba28280d69bf335a2a62a212a2f001c5fe93c794391ff10c65a820000000ae99dbcf543a62676e5c717fff5197ddfbaf75f271f7929edcfc1579522603734000000057a423a71c0492112867d73cff522cd6fa8fe4ec958e9705baad6e2f76591585956e97acda6396a5a1bd8eda21b6a41b46148a3282ed20f5b8f8fda443e756dd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8065abef563dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410346493"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c86d4a21ef35a2536769373ea6c72a0442d933f808d2e696294103aa6f3d7c92000000000e8000000002000020000000227aae6dc632864ff0c03cb6ca72c78b06cee6070afab531a4dc144f134ffbfa900000009d4530795b69e2f0f112c27e4cb97293ee7739951824a39e371054cf84dc35d4646925172d2b8384f9f7c917059784fa13e8460bf506dba582300e051ed00b19f6e8a068bf51c304566f03c373140c0ff2d96ba69dc2e552730d6feba0653594081b9443c7d8a5e88ffae7d16ae7b9938542e0c5b9991988551fce6048d411c5e6005cf7e85df4a5133dfeffb48f355740000000e84066571ab3afbce16460b75c89273b087242de01224df5260f42f3a05047f210ef1f93257db9fa57ac8492e8ae6748ebe5b2e5cf3839e67e4e72d34236ba5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{185DAB51-A94A-11EE-BCA6-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1212	iexplore.exe
1212	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2696	1212	iexplore.exe	30
PID 1212 wrote to memory of 2696	1212	iexplore.exe	30
PID 1212 wrote to memory of 2696	1212	iexplore.exe	30
PID 1212 wrote to memory of 2696	1212	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a59d9eb7d70f8b324ac7e2b9eba9efb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46ec93a1b612484434c994156d42ee16

SHA1
f9cc64f5ef4a26e42a831e21f6fa893949a6b74a

SHA256
ba149fffeba363a2fa506accb0139aa052868c2f6591d31c5485edc599de49fd

SHA512
4788778f92bae0c988ba73003dd3525e8aa10acefe2feec4239099aec5719d392d9dddd7c947941c5b354470d94583afe0e50bc28119ce0096affc1a42282345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
460854b3c9dcd50bcdd3fa8e0a1466a8

SHA1
d4077d182a38da96dddf2f58ed454dfc236bd8e3

SHA256
b69961f6c23d358ce8dc9a2b58fed7cecfe6cf18f84bd9cc8d9594fc0ba9d606

SHA512
411a644fefffc89e72d7f62daa7823bcef9c77a1812e1709a29e665731aca46c917aecc6a0c9b2bd7d3bd7af4e961fcfe80eeb43b9f05cc5b6616e495437ec50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a678f39c13cf8440dbfddbd4e2a175

SHA1
5c40007cc25cd08cc5dc85e20b66313a92b83d1c

SHA256
acd4c0c5ce418b43cbfb022876127bc819d5cd9a98d8662f90bc02b92d334ca5

SHA512
3b9b7624d11a3dece1e03b9e1b5dc480329eada407d54931b7b971aa798e60b01b93b5e14639e56bc4119e1582b4928eb35c7624ad5e34c7519d3e1f6f14fe56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c729054c233bca35060c8c6be975667

SHA1
58cf00f82607f18941ded1221f30433dc1f295b4

SHA256
9033233ab56c388ff80d5b233a6a9a10a98c22d0a0d60f7e1a53cf4c9b7a1817

SHA512
acd9c13d4bd1ffe18cbecedcd3f7309303437bb86083e2b92c66b6938195737cba52fbab5091b2ba411265eba1bebe2e408c82d15136b9b6f2ca2b3087aef5d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2a9caca73084530f8e80c16dfbaafa1

SHA1
2025321e997056fc5fa1ed6df4cfa1ddf24eccf0

SHA256
2faf35f06f71e1ce80d95b612daf2cd069b6932f39f7936a05baa1e0ef2e85c0

SHA512
6f8ba17e0eaab6f4a88db8ce14ca5681e7c12c5bebffb20e328907ca8dbdb1599cdf2a6770049bf76dd3af179b5b16861aea14618a9dea7e6c8b9c55cfa195a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c2396648560dd5dcfcadbcfcf0ea293

SHA1
24c97de985d045760af9a0d3525ee2bbbfc66dac

SHA256
818300d4e9da5a46f2b5c514902fbf1b43fbee1be1096ffa58421a1e45ad3d78

SHA512
467ddfb74620f02150d12ac75ef57fded0e9957a8811358dc024daef880ad2e75de866c01b11a8f1680f577dfb49539f168e6fd72f54ebc8533d1dd06137d433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10849d9a8b389a82aa2085bd20295ff6

SHA1
8c044352f1986236bcfd79fa613c0e0b3d4374f1

SHA256
aa17ba93c51d6e2add5cfaf74728f6263163a9c0f182d06610b577863cbaa338

SHA512
9b99ff9596292d17e83797f3009044ffc1936dcec17732d93d05aa3a17bd25e43285946406ef2adf0a4291fd67bfe1073d180dc981bf869a78f39311fcd58404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56fcce71f0dad16cfd2093f644b5df1b

SHA1
8b951972926259baf3a7c4c59ecd327240ddce2e

SHA256
03eb99d01ace9229010f67ae7f8e614407e3dea5f38850fee010dd62e4b4a376

SHA512
c871cafbeca54dfc2c627427a2ee4cb0af3cd20bb136809634c22122a45f0998c154d0ebc4cfa10c1533bf6cff92aee510cf84757ad06171f299981a0ff48d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7803121ba8a546f154a29df3e9a75c31

SHA1
557dae6ff8429ec6be8a1b12a8fdb5407c6c26e6

SHA256
d4afa5be7fcf662844f9610d96b94c662cbfbb1451094ba06337f9130aa5376e

SHA512
adb3aed22b0a57dc10b79cabe227f0a36686f2f2be4b793abe9e3fc77c4ef15a22feed00f7f6d1611367ae1f739b6a34c6ad871bb79e7b0c56546b74d43aeb13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8ba48916354b29b237ef81f2cd04176

SHA1
f8ebc143d52847bcb4a543db03abe8541f44f4da

SHA256
3c853bd6032bfe0931ffda4a2001543662f54118827bc2e7385194407ac2414b

SHA512
ad8834e734571f955ae01afdd63bb9a86194062ab12e4a612ebfa8aeff1c786ba693db6daec2042dbc2cfa49071571aa8090827a703ef87592daa0f7cbcd5ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab963A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar967B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit