ff711ebb5106beefc7e73cf5ef7b0126c0673f1c91d371cab89500ee97e5be4c

Analysis

max time kernel
119s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bd3c254e8e901e3a8517a4d95e0478b.html
Size

430B
MD5

2bd3c254e8e901e3a8517a4d95e0478b
SHA1

1e4a99071ca3accc09de849ce48eb061a8bc1848
SHA256

ff711ebb5106beefc7e73cf5ef7b0126c0673f1c91d371cab89500ee97e5be4c
SHA512

4ecf174ebd72c9615008e5c7d7017eac10b702a9e255ed1cc725cd8c681f204e13bd3617799733c07251b9b232c1951ada18015aeb8c86ee8be77db22d4c722a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a986017de6ad390849137b07a55f8eb26092f6a098e3437a172c380e5c4546d5000000000e8000000002000020000000e6e1fe5f4f7492e9585e311a5e177c555e82ef5f71a9eb90738a06df15d2f190200000001ad0eed612137e8fbf5115e74fac78e328ed9c699b6fb67c3234e60841cc76a9400000002c9d67b69c38e5e4bac44969632c45ea35395433d00d7d291474ba7a391194e275f788dee93d25147871eb51f468d196c38d4bcda6760f095bb1d49a69c64e87	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08647be693dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410354596"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F731B761-A95C-11EE-A0F6-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d662ddb8457153e4e9490aa52cf8f9b0808c128c6c39b6b0431ac8c78f509272000000000e8000000002000020000000f8ac27efa6fc52ad98a3d97779624922551d6d3044e1fe14dc38a58a329c079f900000005c92c1f5ca0772e028898f986739d3b498199f6107519141a4e3bb08cf6b4d6574a0c52803c8817e7e3ac88d37383d5d5049536b19c49b4943f27accdddbbd9d4560ecf89d493ada1c511e111d3ba178a61734bcc59f307ed32c28c05b0874319e81f61104d6e1223408cb34bf5dbf60a3cc80a19dba1acb7cf312753117b9c71b99ec6eff0dcf7d5c2dcdec1934878340000000338de6072c0ea93c558ce9fb8fce26d6755513acd2455a23f503ed45139ed3a7aafba99398c0a83c2ce5cf720667c90a70f891cac132f56e22e2192af555edce	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2004	2256	iexplore.exe	28
PID 2256 wrote to memory of 2004	2256	iexplore.exe	28
PID 2256 wrote to memory of 2004	2256	iexplore.exe	28
PID 2256 wrote to memory of 2004	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bd3c254e8e901e3a8517a4d95e0478b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c48d1507da6ef8f442806b295426d36

SHA1
69a6e00a9393303e141462936d2de374bd49da97

SHA256
1a6e511b7a59f25ba833799feb462e38ad8cf1e972663b4a23b8264820ff0124

SHA512
5890393838912efb2e0be984514bfd1ee11f2c3e735df149cc94277212c25463f2f61a4dabe568037ac7ba884077ec953f267ac17a4c6921f625a22c8467fb86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3710abd617c461a40f4b234d139d86f4

SHA1
761fbbdec714f193f975af290cc1010c678a55ef

SHA256
7f39f6a8cf5cb262224998462d61d12554f62ac7502ab0cafef7eda723bd5257

SHA512
fa095801148fd6d71285d87a9369c74740c98dc3b50ac69821a39c127cae1e10f2d682599cd35a46b8dc804a18abfcef7ca6db718e1101c68436588cc40461a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1956384dfc909077f078752745a965f1

SHA1
fc1c3be9e57faa001a956d29bd42bc5c1fdbc05e

SHA256
3e2b4fee699d6bb6a223128c8439c25c3b439ccf6b6c042997b76044dc9947cb

SHA512
50bd1c87ea7129da1d5cf905eeedb4a282f8d52add34b5452ef8f2fe7ce4fbaca5d0fed0c4e602762860dd44f666bfd3b5add9d51f8dfdfc86d0d1cc08dc0a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5a07533e2ad8e1e65bb2e5310a4c21a

SHA1
c798498342d610f9ffc705b3ca657a5ff77cd5f5

SHA256
5188191acfec7165aa335060436d6a6ff1b08941801fd4f0fce6ffce520ebd90

SHA512
ed58e127b47ade5cddedbcd9411df3300e49751cb68db5cf5d75dc4f980143703d11fe20888d87d59254df7012ef7f63369eb233c2e757417726f8d91f3e0bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
194451e701ae887a2a062c96e44ce57e

SHA1
2d5b11da28c368ce3ec42ce4c446b9bb9d48a1a1

SHA256
6eeade39202ad1a5999a0f393204ae4138febe229deec59289861d34cad6e3eb

SHA512
3c6218bc6bd787d5cbfd97473ecf55a69702b5df908ceabecf6076ef0b3b2240148002eb2adc8583306bb16c748be733dcd4c661314952b23197c441bff3d463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21fd72533430c8f6fb107aa786bd5967

SHA1
82ea0b9b1850213e88a82dd9074385115ab9d49c

SHA256
6d933ecb58b13ff3a825b8291ac7ad1a7aa12b3f57e0029ce18940d9b3958f42

SHA512
a710b776253d4e4c2e075b7978be8c528cbc808e7d6c1bb12c69f73e848f021b4994d66d7212e6f33a3fb4ebc97c462f10704fadc00204ed7c0256d2a65e01e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c790a260cf0d5d7b61dec33c119c2c2

SHA1
9912ca90985bfa8cb098a5118afa17d0b5d62fde

SHA256
b030b6c36e979fadf38d6b6b3a52cc5fd082c38f339bf7ad58c3827826c500cc

SHA512
99b3ccd43f87011bf583b47cf00619702855982bca9435e67327220766da6be010cbeaaa815c0b2d391612f917b5d501fce10e5b02bceef03345cf6591205e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25b48793b76f9ee9f9936bef3fe158eb

SHA1
f4f720ad01eaf182950a0353cb5ed7ed906a3533

SHA256
a417a74314981614d7c0505d631b73a76fc561f9d685cc1ff08e1cbdff4a034a

SHA512
453d6ba1777e48829d1301594ac63162d6e3929b1b5aad55449a1a558a057bc85bd50091d3f11156f3b17ca52dc9df426431263abc2a1e1c664a56a66741b9ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ddfbf1601ab66ba979e8b5c938172be

SHA1
001e5928201d6c04e644a0d7cd5a03aa499e4f8a

SHA256
dc4af41dd720faa53f630aee886510890d0279f11072ca1c1072c9e06fe1499f

SHA512
a8cb76c0fd08a5cd636034a6706f1678c14b3b8076fcc1b5971e3987b7c5dcacb11b746492d14b9d599dbd11de22f5e85eecea21315fbc932328b447767b2005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92f1dc7ac59fd9495c59a2616bf4b6b1

SHA1
c05cf1b50e20015db58840c36ad19aa522511650

SHA256
fcb02ae3e182f6e16916b9e40e9cfe1f7808816c520f8c4d784ca82384ff935d

SHA512
3693bb2978d4a8656d6856efb9546e6650562b9c9f255ea70aec663bd2914840c4d84305808892b4543caa11f31e254534da6b3dc12d5fa49ffcc4a9fbe9fc5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ef2eadfbca0cedbd59227625a185f85

SHA1
bdec5300bb750231d44b2dd863403c66b4a697c2

SHA256
1bc419392ad925f99198fe4ed9844493caf0b0c0ffb1a7d96ac99fd0b75ae45b

SHA512
03a373379803d682aec7454d9f4a8e819693edd193b1e9e90773bee57c7bcff33c32230ef37bcd3b1840d4d95f8ec5ae8d45b56c5c6ce9342b1a55fe584596ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43cce326b4c4e41bd6017d15c188d134

SHA1
b4328df4cb34d702f7e4555edaf16fe49ac2e2b5

SHA256
e990575336c13c9c1fce94b4f1e10585a35b73e4ccc8560e94feb776fe7e27ec

SHA512
a8ddda1fa8e30b76710a75be5bbcc389f038321476fa85ccac5fc184010ac779613ef37d099d1c8ed8eff02912b1b24434f469fa352d35f3aa2872dea103846e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t83hqs9\imagestore.dat

Filesize
1KB

MD5
c98027e26be621dfde06afc8d7d59052

SHA1
56a3bc7ab92b7926727740e8a5ba80fe047a605d

SHA256
5874dc02b1cf5b5bc5cb9700f0c6eaa7da34595bd20e2d165c14bf11e999bdfd

SHA512
4cc6c025a2623d095772892ac15e70644c8737d641689b14bcac6b0018e8529e7af16fdae533e261bfd042f6d190ee1d29068f4026a2a69d19c8f6cc6137e4fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab407C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40BD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit