187d532a5706a9473fddf300c119c1e0bec1a3cd7fc88892a7cc9e4da413af85

Analysis

max time kernel
120s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aa60d5ba8c14a260944f02d2ee370cc.html
Size

432B
MD5

2aa60d5ba8c14a260944f02d2ee370cc
SHA1

ac21f5c16e4df40b65b6d0f33f192a0f244a1322
SHA256

187d532a5706a9473fddf300c119c1e0bec1a3cd7fc88892a7cc9e4da413af85
SHA512

a420cdaeca20aac625970d98a97fc25fbab1336d331b229bd7ea90aea9653d18b71bd51c4695f6001d39bf6ef914687e0677bc52d8347fe160a955b64de74db6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b5883c43df910dc7e4e205cd51e274554416782a152c34ecee6b07469d6051cb000000000e8000000002000020000000df8039654c8e4d793ae6fc55534f67b9a27ed78c1635f03346343b09543a1ee990000000539661ed65f35d142a2d5f1ace336397973364acdb952ddd202b233f1ff6f9cf99fb84cc70555fdbc8b51e499692c5f6aa8b254f3b85130faef437e331d585db91183da1486fd5e549afccf33ce838f1a7ef58081c16126937ff4e43346d39f7f38168626b63edfdcb261d0611756776d80670dfcc6c8cfb9e1ecc8ee91710f6c1fb09403a07e19ef844699b69bbf93a400000005e11b46b4e65a060e1d197e2c1dcc62c4c2f32a7224fa904b76d2b377a20a0be56b8e6b8a2f0fbcdf6a8aa75c5bb99961eb72181fe4f423f23cd525bc66eb533	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000078e9df32c958d7321dca796b54bb62f0788b3bdb0f715f99972a0b82fc652fae000000000e80000000020000200000004b0358e2ccdb146f945dea16068d84de4087ef7dc2bfed34f7700bbfea9bb70a200000001d7701ca2277bbcbe8cca8d2ca39ba1afd881c16a7469cebdf44c9e1a0682772400000009ba73521b0b2b883c8a7141fb0d03fc5cd276e600b44ac926320b3cd1d7bceb5cd21dd5bb204e494910af6a2ce40376b0ac4e276637c8a6ebba5f99cd975816a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900912c75a3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0045A6E1-A94E-11EE-839C-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410348174"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2736	2308	iexplore.exe	18
PID 2308 wrote to memory of 2736	2308	iexplore.exe	18
PID 2308 wrote to memory of 2736	2308	iexplore.exe	18
PID 2308 wrote to memory of 2736	2308	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2aa60d5ba8c14a260944f02d2ee370cc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b499d45b9e058c6d720bf7441f6b916e

SHA1
dd9f189990bed711a68b389d2b2e213fa0fbdbbc

SHA256
6f307e1417036af96977f4900afd202fab3dd6a57d1e46a572b6897cb717efdb

SHA512
a0cecbaf827befd44e569cdfb091476d4fd6ea1fd1c1e8db43a9af1a026107bf9ec65666d95605b4058355d7ced5108a53703c02d3404d9f775e3506a049d1e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
668601bd152630ba7d26fc43c0fb4c41

SHA1
9bb8dcdb49ed29b70cfab02e92fb24293f9113d3

SHA256
a3ad27b95c99968ac0a61baa200c39606c7e47a250ebec860e57a03793ffb2d5

SHA512
506864e9346d2e3397612d80e0f5cefd0fd4559a00cf418c5e47972c58251280eafb8de130242d7e8698e3f36e7d0f708823e2b7adc5340a365f5df3d04a184a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26c63ca9a3a1a25af3f21d4b9df43b5b

SHA1
8c9bc556c602cb338410cbb4b20ca6a77adc74bd

SHA256
695c7ecbc19c87794c676f7b165ea6ecf27581bb24f526dac96cf752942877f1

SHA512
d3374861f1ed23b6e3fdf1c77fd715d83744bddca3c0446a2c7a575ae4c815e4603c406186b53e220acbe39383c196fae08ab7c5c6c306d3e8fdafb98b9ca5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51385ec71219c42be6ff93d8ff091651

SHA1
ed08c1ae2fc9e5725254c9c43da397e15c637690

SHA256
01bb9d808cad6872c94278e390ae548690c436bff5e645da3169e16cdda3cdee

SHA512
ee7b2cecc88870064a3b87ab618e952730de563e8d5e656f8621037029e6a2a818d804102cb029a899277c106b35a679007106444423e5dd76b4a5b040f37630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f48f4f33f32016702f7a982302cfcd20

SHA1
833b3a84afeb25f722755eaec0a914858a38278f

SHA256
9f97e9e951d4a8f3aed85bf41be58c857fabb1bbb9d1362c7a68b6d15c30d809

SHA512
12fdad3bcddd87e489a5741c90a8715fde2f702f97f750a39d0030805815dfff746c5ef04e1b85cc239399ed3e515749de2d265b75087f0730b10387e7a9ae0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e24a4e3004f0dfc94f28ef9728f0f0e3

SHA1
cc141b5f3183159be78d3ec1a92abe1441f445a0

SHA256
84c1690ea237bdd51261238b0b6d93253ed030d01113f5c7da1cdd5ac4e9aebc

SHA512
b8ad1e89c6abfea52eb03a0d22d8ace533256749de82b41db5d4aac0170f639694f4a57c620f60e0e4f080a24b1ce559d1635d8f734d0164037d4c4fb25e16b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed23aee9049224aa6f5184b6b469d056

SHA1
aa0d23b8695bab9a303370dc21bff84b8fbfa09d

SHA256
3d275ece78174b5cf2c3bf90d729bca29dcf1e7f53b658ab353d3105724529d7

SHA512
c7385f2b4788bd57d050b0ed04f0ebb060527a2ee0c3cfe0a7efd0e1696a64b8b856447818522d5c2dc83d2378825d86d1e1b345759bc0f64394821e31993d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87fa85a658dd42b40976c2ce7df01a28

SHA1
755f291c10941464588e76f44ecf094ee7e0ef99

SHA256
cfa302d412e65a890a74a04a7cd4e3c2f8070b96c1e6b0232586ce806b2afe25

SHA512
f674c0d7dfd1f6045d2b3a16ac4821fc73606344691c98153c2ec4ea7a50f5eb1810f0312fc2b7c0393cb0dea74d6bd0963cb360479875166ce1b78dfc7870c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce12750c76098fc8dd3d29cef24351aa

SHA1
4576be78037e345a0c3378b28478d27bc3fbff8d

SHA256
dff1ed100a38cda39a026651450ceadabddb0852fc64302422946554179cad64

SHA512
459ccba1a7074cdaa4aaca0b0b1b99c54db4e48656bf5e388e1055aa54003febd2cb9794f3850db47248990c6a3736322272e046a062a37bb06043d5f34be6c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54d74a8283341c0525fe885da879cc5e

SHA1
26170f8d7d49bb61d225e11884e7648d3278c9e5

SHA256
72bbe16251985a51d137af2b181ecaba1d1060f29e371494257f4f891b3d3039

SHA512
046f10fb41bf77783da351382388a6ad111681c6534c565788cd61a9ee43d95543148af9b4aa58d7b7c470cba2107d1d7ac7041b95935c239506ef140cf2de6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55d7ae4a5cecba396f25b1f548fabd58

SHA1
9839630539f780abb5bf80c5b27ff8194107bb02

SHA256
15096a1deb33fb956ed7c63f0a00ea0cb35f203f3ba75ba4fe7e18c01d9eff4c

SHA512
d6684b26b057b7c9e5d9ce3e6bd6d5375bae3eae65131a49f2e71d0c8738b4d5729a00fccbe73500b33764a37e2ce5afb924f9de8cf4175aee6c30191afbe68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2tj7qpw\imagestore.dat

Filesize
6KB

MD5
48de4b3868b1b0c03ff2cf0f1e23f91f

SHA1
b13550b7896b2b1ffcad040bdf681e3c7176f1cc

SHA256
4c5f2b6766ad8e7258e12e2b8c1a7873225a57b4e8b4ce61889d8d0b38d2ccd8

SHA512
52d52511ddb70379a64be890037ae755e6477fb5a446fff2c18b55d341d5904e8af5b647686b3a427ffd792d29702cce9e8d33dea11695fed5e0c3286fb39424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\favicon[1].png

Filesize
3KB

MD5
a75c230f34b9296e6fdd8b0b855df5d8

SHA1
e0b9e32053d44532fb4e8bb55b54c3211965517b

SHA256
8adba20b1dd9747ec8ac6ed5a26a8dfbfc7ab82213d8051b76ac771c76b87920

SHA512
950b94afc397ac760f38f4c68691bda6b541832e1d23f496e36568def2b9f9dcb6984c6a42ff6b5abef0e19b76c37e40baab22e9dcc9360091b609333029b24c

Download Submit