b53a692232ebd4d06ee560453704179a9a19e4f9d3ed4b62f712b003caa6143d

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d2411869f574a0a4e1591bc44308de8.html
Size

1KB
MD5

2d2411869f574a0a4e1591bc44308de8
SHA1

3b24b7400641ed4c27c19841d67a321452bb5996
SHA256

b53a692232ebd4d06ee560453704179a9a19e4f9d3ed4b62f712b003caa6143d
SHA512

185cd55f66e0b883fa020457155899fa4c2395de1fcfa4d169c3aa4e801b516423165756c2707f34d83edf1ed171ce8ff11d4081dbc163663bd6538c7753043a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000003468935d8cc8868b5e128be8fbbc8f294c660e090ff8e01dab3f3c85c75d5655000000000e80000000020000200000000997152378431f4d3f9ce1c4b52a819a91f3b9ffdbffcf5da01b9c8bbe967b1290000000c966ad3a8bb3ee9c61c2fba4d5644a4b07b8fcac86b6cf746a8c653d70021b59a262c5231bc74e3d2114bdbb4c163c1a7f62ca54f8059ee31cf6a55272b68a15ba22ee669a4c46c0168e3a8e2612f594d55945e92d1e81384a0581ba771ee6fdcb4b3c0605aa39e4816b424d560e6ae1c737389fb8afd7f7eb5275c1dc4caae9be88850d7009c402f002e955c9a2a7e540000000a41be7da0525736577f8ed559bc3e4939456108239a95eedb0a0700c24458d5085c9a64abe5ed15d3bbd327b9b9bc20ec3d84e8b1bebf8eb04ec049db93b66fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C87C1E1-A96E-11EE-851B-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410362158"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40891c627b3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d383fcd40cfa3c187d9a4fb3ee60318f893d17ba71ad5ea361ac4daf89f1e701000000000e80000000020000200000004e9915f21bd305ae1944063994c5098b84785c67154e32b85ed7ea57605b0993200000008cad1b113d54e0af38e8c11689ff05beb7033594c8cdb2457daacae79a37586240000000165bed06e20c1559cefb76a69abe2ffc9ac084c3ddad32ed6b5423ec16060adf2dae96c5112bed00770e8a74973b383a095f50a8bbd2d4f6b74ad3e8818095cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2136	2140	iexplore.exe	15
PID 2140 wrote to memory of 2136	2140	iexplore.exe	15
PID 2140 wrote to memory of 2136	2140	iexplore.exe	15
PID 2140 wrote to memory of 2136	2140	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d2411869f574a0a4e1591bc44308de8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f3dece9ad30a6c57305a89f713a177b

SHA1
3f761e8704db1c7cf62deec10a5b0215c6851f24

SHA256
a7618465ee64f9733ec07a6fc92f24e992506cf156a8a0ec1317611d00662ee5

SHA512
e4a7a2565e1e1447df7c4a1642e0646c817e1d9b75097533048f74c9e8b6d4d05c3bb85b3934186a45052c0d0cc69f233e3f3c3b6916507e59c80da4c7cc5552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b57838227a130b22000a3f408c79bfe

SHA1
5727110bf2a2f957608d58b21bca7cc8c009166c

SHA256
378a62a679465f380323cad9c04f037fa7da97b47934f925da017794e914eddc

SHA512
84323c16aaaf4b9a13b2917820c1e74ae7600390cf702e79ef62cf4bee4e09261ac1b6e07058a839727b301bec69e24b2f188ea079cc6965a8d9da05857f1e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb1a463e2fcee7c28d10d1ebf53b4a8d

SHA1
5052fb5ed86d87d7212eb473e2ef46a88017595f

SHA256
e21e155eb5da0a025b5457d67f30f5f537bd6882597a440152e420de2982ad1a

SHA512
e6c0b5b6039bd47ca65aa691102a4ab83eead9b2346813e433ae70eec8f727670132464e2f59e5edccaa6f43caa7e95046588e8e4705967bd4122a8dd8c74b39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6f061f0a7e6c90670ea97fc0d2e8328

SHA1
ec65fc34bf2473a0be0172592d54660a0ec2e0db

SHA256
6a0f623fe4ee90a1e4c7381f21110d7e24fe06f86d139fed2f128273ea29d5fe

SHA512
4e2ab01530ebe9bdf072a71424ba70f7c8ff57215980c7edad46412cdab7a4cbe1b01a6faa7ab036364a6e1e9e79df354e2e13fa08796884aab0c620a1907ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
008c91efd8ad9f2c278ea40108cfa4eb

SHA1
65c811905888471212427c165b00e058014d6021

SHA256
c16ec4af8bcfb2e0fffae08d102a071cc4adc38d2378175ff637bc0633f64965

SHA512
dc0ed4cf6a461149732bae1a09214c376d488dabe1dd06433d00edfa78fcbbe4b2123d0b714c002e2141aa6fbef69cadc8e4f02a3185fcaefe34e261dbecef97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ee671c71fe87110cf487ef6acccd880

SHA1
758a35b43998f9a5df9ee18fe57cbcb594a3eb19

SHA256
59f6da088e9f36134ffa12ae2ca1728ee27750a87968e3bee7b6d388a8980d6e

SHA512
325898185d46442b40c893c228fb07603182a14e5b9b6df7a679dc9ff894e95e0f8a1f94d214696ecf3c6d5750d052d24ec8c2a054104a8d127c89c345355ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fb3a5aad4a77fed2240ae7e5dccf445

SHA1
fc519c1833d443e6a03f0c36e67c613a7272724c

SHA256
2d91f0f28c7c0f99b63b8888934b6edc13641e1d6ef3d7f57f1e9ff0631a4228

SHA512
e84a221e161723c06a8451f06105605ee42fb51ff42a236737c318d9b9941585ce92965e551094e6824997573416dea929ca400d5ab794805ee5b9797f1324c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c29e98fd3129f4e37bed20a2606bc7d1

SHA1
4b042586eb14b5898cc986d8fb4f467d888d271c

SHA256
7a4e11276eee286b9cd7abc0093405b0ab4cf061077d85ae188a6174216ade4a

SHA512
41aec71efe8845d5e7c539a6aba75e3d7133eb0490f128558e599217b744fbeacdd30c3d858170b06c69ed0511470a9bdc1f5fc8c92077e238a0f5d0f50366aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d6d0d1efb7bd125bc45e179d6c206a9

SHA1
f707073b58f01e0d364fdcbfe5d0f4c808a5ccfd

SHA256
0d5e6e1455fe1a837618aee94421e02265f495cc0ad7464a57e2cf11141c031b

SHA512
5eaf0a9397fca4a7d33ae5440639ee470cb53e7c53974e6075f5d1aa7271af1f69a3cf3b7f3807837d5559f4b63513fbc50ac6800edc655114f80b9a92699c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab35D1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3672.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit