483bca0085321e0ead38d7eecf3f18e9ab8df949e2e5fc21d4815c115496fd3a

Analysis

max time kernel
68s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b15171ec207bc2a01b28e82d1e81846.html
Size

3KB
MD5

2b15171ec207bc2a01b28e82d1e81846
SHA1

e34b1e4e511d8d33193ede92e6a5e25c7f898f9b
SHA256

483bca0085321e0ead38d7eecf3f18e9ab8df949e2e5fc21d4815c115496fd3a
SHA512

b3a7e0b57d06c4c7662cfc0f73be36d8e6ebfd14e730cfde1dbe121f9523d45255dbb05ee8a3f9419df93618c0f85bf88ca9f5f86381572bac99d30a0e6cdadc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008b1eb2fb57ce19f74e07b8b1b6dc11f17b8f2dab6adeee1a539b8e23db7aa1b9000000000e800000000200002000000071ef8c10140f305486a7340863893d14d78a214d45033c20045f2d2b600c48789000000052adfdb3d83476cead552d4fa0fafeb0e1e33b3b53a395612e9f9a9210437819ec6678ec75255b3206e43f128890709512eaa16cdca057e1fbb8a3c9b4ba3e107ee145a6d75bea16a14b4d57c0403607106988b5b8b24eefb4f995289f170693bcd9840ed0393dbed0bcf32f97d733730238fec119323797b5cca2a2fe1c268e3442c5022a641c9a07085acb514c5a5f40000000a4d5a5111f65135da0782c9c56118e6e2e22e3d525efb4e2cf93049d08149fee681fa685a7c1f9003fd0e8bbb984d48adf48f8e7859201c5a9af967001fac616	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0aefb840240da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0991641-ABF5-11EE-B49B-CE253106968E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000009c2db8f83d711c23af3813cd5ac991c76c51e541d4b9c89c78378820f52d565e000000000e800000000200002000000086d3e60fe8c35f93b954aa8d077cdabac19852352d102b59096cb6b7f80eaa4220000000fc457dff910dc99b8d06991403c2a3ac005c1ba9cd93319364e1c4bd5a8843d4400000005b8bc8c21c6718bcb707f123dd00068de4cf66ee7221f4f4d52e94ecd9f6449d8d4a6bb7735c591528a80d3300f690f61180351d0e66d75f824a1cde5b8e0067	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1240	2076	iexplore.exe	17
PID 2076 wrote to memory of 1240	2076	iexplore.exe	17
PID 2076 wrote to memory of 1240	2076	iexplore.exe	17
PID 2076 wrote to memory of 1240	2076	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b15171ec207bc2a01b28e82d1e81846.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f98f0b6805108f4f0b6a5617d6ee1412

SHA1
a2db3a0c355d9bf9e7e0950c824261fe2fc6dd62

SHA256
c97eac35206b29757088dcb878660750ceabc638baa87f46086b6a8715e10877

SHA512
e1e1df4b57eab75883366b46419318c5fc51f8c2cd4b0fbc5189693757d154ac7cdc8c57b787ddacb09ad0b6ef57b44968bf4612f865b21215df768668b4d473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a785c40ed06d353c11cfd7fa6842b299

SHA1
7479d89f61ae5460772d43d286441f455002df98

SHA256
2a6391ee7f2224fca63ce170e4ca5859f0ec2db0710b5a9017a853b9918b72b8

SHA512
93c312adb1ca35fa61984a65ab5c0287e27db360875b749b9d31766f5c9fa0888d9aab0c4709ea6d8343ff9df1beb141c4f45fbb550ecde5647730011f1c1a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9af18d63c4b0754fdfcd90373cfd0634

SHA1
09b6ea5d6cc14f0d415398a2e62aaf200c6ca68c

SHA256
4e9e8fc2f975890a2ca26121256606dadebee792cdbb8a20bec96d5dbe185094

SHA512
f28d71d5becdafc918ec47a7e8ad056f9f3452e2e5cf8d2491e1a29b341ae719047d03dd1418fa85b07a60de14ef1c3dd6a7762b58834fb9af23a1505839d821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f6ced2c6cb7f02fb0ddeb2e12dd7294

SHA1
06fc19d9ad3676cf843b723fd80af58ffdf70b6d

SHA256
16b459caac00678064a916cbaf0502a1454ef704a4041b09bb1bd34c3515ea96

SHA512
e33e81ff93cd4328ea42ba23b656bef8ab4c34364bee5a638854b31e7f2150d67f997ef23146e86855d9708b3a1b2dacbbe9a7fd51ad8d9f83806fb24e6cebe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f73b895d6dc42fa05a96bd7a48d1b84

SHA1
a02f9d09ef596e51f7d47a43664b216629ed87b7

SHA256
a3d45031e1be1f3c9295c3633f02d82e56fb3bdef9ff4e4aac7d423bc978fc1f

SHA512
b0ec27af9fae232a68045b947aef8f9f78d61532081bb0bb33843a973aab99a8f535f2bef7c5d0b91462fd25aa33d516103addae145bceea3a4d7d29bdd1672a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6b79612e8df7d3cc5cf7f20e057387d

SHA1
3b50739307f6e8ab7fadf6007c8c817fce08d7e8

SHA256
966d01ff6372771d5f0fda08318535fc904f90c07765c51d5dcce13cbd0a745d

SHA512
70abb0ac83f9af0220d09fd115962ce444083e3cba8708d50796b1c3b329e63cc27183aa539c73d95926b4563cad0060ab6b265f121638a61e33dc59eb996a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05e3e3880142a39de700ef6d678a7bf5

SHA1
0d106e5771d6be528e7bd2f6484c79274fdac232

SHA256
38a6ad3cf9c29d3e0c3f5e88f4788896bbe8708fc614f47be749a926bd56adc4

SHA512
2311d025ed5edfe318014ccc7aca785bb533de255b8f41ef084e58d265fb15cae5287afb87d427f7f149305e5b3380b79ae6042efbaa98936e37ae014840d19d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e551d552eb6f2b4c39d4a94b8ec69641

SHA1
8fa80388f19a14aacdc90853323064c43c30a883

SHA256
a5042e33cc241bc2b26da025f56c98edf2c90e76c6e4a21dcc8eaec15236e936

SHA512
482613e29c2f365f7f987e025493f4e86765543da3d151080ad3eaef57ca9bd431ef5feb5a35608e29250671fa68de784d1a179e3d81178fc8e3d50a63726752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8030ef2032d7a20b8d2ee55539fef951

SHA1
dc0210686705b58e2c40c84f55113f8cd5d4a5b1

SHA256
f9c2b7760506e24aabbc6e023c3a92fb6b24ed601357a5366d0770516ce31a96

SHA512
d3cb83bd513a7b9c516e7afac6182390c4219fc203ce6e46847a6f7eb74e0b4540e41144b3b2185541920008a572cda3441214e3f6d2e1dbdca8151681c62589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e76a88d0c5041ae54847ef002ea5cdd3

SHA1
b6db591a56f2302df5b788720ca3025a751e3970

SHA256
9dfebb5120e48edee7cdfc8e1a494567740d3634bdd548a73d11f9a409088245

SHA512
fafa93abfcc14a4f2a369d2d4e46d9546c0a1b31585c12b9c794eeb5a6b7e19816221efd50c551fc9a8ac2f11523958cad512e03e372edef3db2437b2caa67c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c704fc2aa909e18ae49981583f60f741

SHA1
60b86792e0441c13f40d6a8d1ccc45197c7b5836

SHA256
ef2653211fbdb427a12c8e6242fb1e3b48d42015b0123c979b78dc6b38b8dd40

SHA512
e76a4a2ef9c1312e0d7eac88e7a32e9d66344c6d8f65ec58d82071624adeb1312c1aadc13403f9082de2793a9b65d8fdbebc526ca46fbac5d4bf577f8d00c977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a51e620655129ddf79c75b2d646c00a

SHA1
992f8d3efdfafc31f4303cd707d5f73b851c8788

SHA256
57e030dee5b1b4998e2a45aeeb662abdb97354530a00a34acce692eb73b5d61d

SHA512
94b172d46a4e31fc712e177a51b4352b1caa2854b3c95a31c36327ef25e0b6093d87e14a78c7a59e9eedac3c129629c672c45730f0d15f5f27078aaf74c58e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
361cf4f7d215a17d2069758b64d01523

SHA1
ebe9c91a0d098d5bd25974facb1876c514aebe73

SHA256
08ad5c8748b9489e29805fc0ac69801e9a16263df3b8f16908e6403c31f496fc

SHA512
c2c0ed4458db1318ec21c61afa6d00dd7319a729c258a1d8e75a7ae519e09cbc10314041ae39ed0d7078656d1811584307d32d810f899077dbd757a27aed6223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
626b4aa812b9cfe9494424243963a725

SHA1
33728b2d255d6f3734722f6790ea1e1374d4c2b1

SHA256
16ec25a827af8a8e3b6d70d5678cd1be0149df4e283b406a6ab23b9d7458465b

SHA512
870f0f3d1c498c1007c7bece39662fcbb9ac3053ca3f52625e70658432c05baf650202430012a14fe6fd15d4c20681b4c3698754452b0a0ad8a0e7bfca9c2e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20e7953cded98971ecd7416be4b911ed

SHA1
0ce47d0851bb5030fb18e762ec7ec6118b32baf8

SHA256
17373bd91a23acca5805a7a7fa2258fdeedc79d19260c43dfd59de59cc3c768a

SHA512
24e63347e8ef742cfd42c977dc90854c3e53b494fc95e79307df352932079ddc96d1a404c930e6ad0d82a753e6dc50e048a41fd7c489daa016dfbae15c49beb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3343.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3356.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit