0800e8903d7b19d73b73eb93d0bec3c3c4a74b5bba1ba02f7123ccacec942c7d

Analysis

max time kernel
76s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39222769dcbdb82c64bf91380ce86ac2.html
Size

2KB
MD5

39222769dcbdb82c64bf91380ce86ac2
SHA1

07ee5028ec2bb43162a7e6d8e4cfbe3acc0def36
SHA256

0800e8903d7b19d73b73eb93d0bec3c3c4a74b5bba1ba02f7123ccacec942c7d
SHA512

5259b161b7fca01b2ae1946c6134754ad4edb5e31882e54995c8d2ee3557dc31fe14b04afa081ae1568cb8cef6c8119c522e612966309ee5d361191e0fbd409d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ad909bed3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000e45c40ddfa3da584e2c81b9dddbecde64fa6838e38adcbc129850d29d8236379000000000e8000000002000020000000fc08ad38db359faa429485d0771d4cb3b2ea6946760d42ab1f26a649f256340490000000bd9473a6a3f14be296eb1b771fad45c6b60c419c17269500430cbc2d6f46b53342bd85346a5119eca26e786e9040bc66489e1bc0e2bc5c9a2549a57b1a443525e3d101bc27a6e1307663603194b94bde3142924f77e885f64a758c8ac7b0503e156d6aab54dc18568f85fa2296b0de640690aeed780f8cf8a2c38375b1e84fc13d714f9036b3c10cc28cfaa3463bebb5400000006304d1d68dace71b8215b384ef8180bc473a8646003e006064a166b1aeb682f85b8bd69ceb117debf33fb5be89a0a720fb77943357392079477942a630b3fee3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2B73291-ABE0-11EE-8DE0-D691EE3F3902} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000e28d9bb874866d5f74dbbfc2df796e98c7a0557d3bf9b0f47130c35fdf8c04d0000000000e8000000002000020000000373e947a7df225146736ee9399e00d01b478b4a948f607c71b55dfe3e3c9b7b220000000de11a66e5b0ec42c49c200e1d13b4a33002ba248929452d125249b78ed6c4d0d40000000c7ac0f3bffb439d948074a4cad2f26574e3ad7e266440b1ddff5ea276dfd6225fe8ea8ca0696524a30f14fe3d8a9287f750bc0b789c5b48e0d9f1b9097b226ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1756	1936	iexplore.exe	18
PID 1936 wrote to memory of 1756	1936	iexplore.exe	18
PID 1936 wrote to memory of 1756	1936	iexplore.exe	18
PID 1936 wrote to memory of 1756	1936	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39222769dcbdb82c64bf91380ce86ac2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8c2a0acbcb8ac95f5608dc1bbf1f054a

SHA1
9d26c8405111b5c0682f392278e2ba8c4837433e

SHA256
e89fa68a891bcbaa31df241d771ad08f1531344ac5229bb018b67da86291020f

SHA512
10975db52956fae6ee430868411692f52e7de9a8bbceb5692ab4806aadd2ab7c5e2c90214b2a3199cac6b2ada678032bd3f93e3f83fb74b23c8978c3dbea9309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa7bec4e033af9933e53d582e371964f

SHA1
a2a33d1c7532d6dcbff0ff3df1fea4e5fd95d2fb

SHA256
787a5467ed3193c50144f2a01e21432d51b3bf1e1530709ac7c2a39d9a8ec294

SHA512
35cbd94a1524a19f20c3818a81f5047576e3688ad22f812626086fdaf2de94d913a7f016fd3be26d4aeb076940b3c70675ad4275ad3d025cc811470cfd1095b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d3896cbbe4d638086a1ed80a45b1d95

SHA1
5d0ee99c67fafbb4b720ce79eb56d8873dab8393

SHA256
201284c4463327a709cb36489a2afb765e657273872c2f726b5cbe6cbe556b12

SHA512
2123dc717513a843fda5cab21870a8d7db2e4012131e53e584a8fe8bc8b11b76d28635ebbfa41d9d38aba315a3671a610d9434f51b3220fe5dbd61daf8baad16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7718226ac5c7d3bc0e26704709f1a273

SHA1
dc8634109dc930cac63917ecb1ae2b3496db1fc8

SHA256
57f0df2ac02e61b15610a10500e84592a79146b0c04cd54437fc8ee9bc8b35b1

SHA512
3ec91b28e18985739c3b2d64cd2af3b2cc712d8d682dde65fdea899e9c63eb28cff7e81523eb713815007b312b7c62e00992875a822c69120f08c586c79f576d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19669a53ce67606fb082b8cc656b904c

SHA1
591066bc350786a31d3fb6864524b8eac5bfb16f

SHA256
902c3070e0301822963af3f6b80ac66d4915fedf8989da635a59bbd26c2fcf37

SHA512
d8d0229e750bc45c99cda1734d0e1216356f4074212129124a112fc9887ff063c2257e768f7d3976a03e34347df67bccffd23efb275c1f923e1409f5aeb96bc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e32091f58d657a6238ecb0f866a98f35

SHA1
458d2309c0bf4a1bb7201d179e19a52ff8c03105

SHA256
f48ba1292f17dc39a8578a615f12aeadce68277e9f1453c3959c1b182cbc42dc

SHA512
1995d9146d197f14670aa08ad683e71888ca64224feed2c0094573eb3953ef60402abd08c8f9388eb25e5379c6c92a6ad3e435ac1f9d48382644ce90d0d1ae22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e1becee5aa04696b79124e1a71cf0fc3

SHA1
f38c9066134d658c1c6d5f704cc26f625e44996d

SHA256
354dc456d229a071f994c4fb462f91646c59872294afcd2fc9155bba8797ce3f

SHA512
c970cbb5d185cbf1ba079fd8f15a882abe3a2ff0b54ae2895bd619713b497b078f350190b465a6bdde7c57c1321a40868db30a8a930cdab3ae4b136cc102e266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5509.tmp

Filesize
62KB

MD5
00a98491737ef0afb30e432e58301565

SHA1
7d2a431277f27346145387b1c044d41781149619

SHA256
4c49923fbc63ff1b874ba44e2391cd840e1cf1957b4a23867261a932b7acc4aa

SHA512
fde3d7064e7ada382b100d5d30cf780f9760ff7840d1bdc47a6c5a51c69b927a42edef4dd95e075a04695a1af626d18896153996b1199f1ca9922f743ead6ba0

Download Submit