00bc211ed0278559f51e627a032fcf8e50cad17a3f1e34100e257cb3716dea38

Analysis

max time kernel
151s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45ea9d7f164cf0d8e6213cc3d537ffbb.html
Size

2KB
MD5

45ea9d7f164cf0d8e6213cc3d537ffbb
SHA1

265f359d508733187a9b1cd2abd9ce6a5148d639
SHA256

00bc211ed0278559f51e627a032fcf8e50cad17a3f1e34100e257cb3716dea38
SHA512

dc9385ecd20bee35f32136cc8d5bdedbede6cca28f2f1aa7a08243dc1d44bb5d082b15d1ea714655ac812dfc0689211ac077973d00ff5c3a85f54f57e8595d83

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002b7e5a9891170a80b38d4b5c819c2cf916bae29e3d31eb98ce7c9964a9057eea000000000e80000000020000200000007a7015f89ddd9910608bb8340376bd6ce397bddd05da0945063c97ebe1465d249000000041d5e83f8a2c308d5a772ef927c9d7a5e83ad7bf01cc905a4ccf5b1c368d868b35f2c28df17fdc2592a2992b4541f45b08b931a1e5f5376e98901fb186603295c17f08e21ceee40742e0edb9101d68bc0f7e7d4b8e0cc11b79358fdc1158c2cf9c0e0f2108280bdd031abe21cbc3a875230a2bf3989c7ef740cbad611f7f792ab3b08001957cf80a1d3d57a96719f7f040000000ed8fb2e28c9462b9158b51751bff6fef288ad8bc3f6d8ad88193a4256a536056788308f5b619d303ff0868821ad9045ca22a4281004395c522a3c54c28bf534f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000090c5576d3cd6a3982426cf1936ed5cd11ec2ed3f94818370d43e7cc6695eb2e6000000000e8000000002000020000000aaac2a1030f387c079863261825173c6d42b4a1fb8181640b077bf73ac5ce1d22000000091580b58d66dbd3bb1011781beb29aef3e2211f0efe4f96f3e6cbf3dfb8efe5640000000300f4c0f025cff3705483835251584d6d0d47b7f5bb930bb6fb6151888730d88d07dacbe3981feb979949ef924a265cb70908e8c1af8c753ab3ca9c48efdcf0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63D301D1-AC78-11EE-BCA6-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cef1388540da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410696228"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2224	2504	iexplore.exe	28
PID 2504 wrote to memory of 2224	2504	iexplore.exe	28
PID 2504 wrote to memory of 2224	2504	iexplore.exe	28
PID 2504 wrote to memory of 2224	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45ea9d7f164cf0d8e6213cc3d537ffbb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08f6013a0b8a280c019b6c5f283800b2

SHA1
603253046583aa396682f57c895f93ed5f8b3607

SHA256
d608dce05be237d236196f88fb6f970e38fc76cb20aa0a0d1e1bd606bab607eb

SHA512
55ef87b135d87e3cee2fd733a5e64be6df1584d65007a899587a7af71b1f676abc014c5d9b8d87c7dcd2a0652ae109d5d2194a77bf2c22e83157f54119fea6fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f287679af1c666d82617e71a3cfe65f0

SHA1
5b373d1ab99974b3f670c8a89fe20d93cb4950c9

SHA256
6fe356f0c130ec69c28f4196f0dc1a6ab35bd601e2026cacff4e0546ce700d6b

SHA512
217cdc8d3c2db61be7d7b57c548af98edf329594038c7dd33b4f6f0ce1a3fa9014a8b493c7e4a15f0b95cd8b5d02b27a2ba58dbf2951d148c189b8bea877eabf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f533c573fa2ecf96643ae5021513fc5

SHA1
b9417905f36a9b79e338a8954a1f655402edff6b

SHA256
1f763f46f04c4f6e75101e16a4d1431a36d82068237ffa05b3ecbe41cdcc6508

SHA512
582872549547e500471bca7c697503891e3d4db16f621eb260b60111544011df9c546c835eeb67020bb8cc2e9c6242f9dc80aa814794a9c3301cdb3fce9cd174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed577317636024f351a0648d40ef0329

SHA1
24588bc97ff5f02a3cb3604a158d49cf8cd02455

SHA256
1642ce1e15b3b065f10decf5fe9145d38dbfe520f92ee58f3f32d2982bb0ccdf

SHA512
e49bbe7fe585d6a491bc51778c355da79ece3611f316bd946f7b5ff2b1f0329bde1a204c36d8842235d954a6e28d438b6c9e72da6f69965f4cc3fbb58606f18d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc510e13a204f2000376b7566869520

SHA1
86baa4dd0f090edf4cc1a70ec529103a2944cc91

SHA256
5f74f286f092afb2e8b1022e613a91bb64e97660aa37a7df64541863d17ee14d

SHA512
74bdc1af71330f23602e4e4500a25e9955673c0d27a99f543876590d1312faaeb6fa27f58b9a03bcee850d76ca44e9b48d3ab54ff8436059b76708f1ee4eb3b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45de2a637d2607eaf0eb559dc9bc375a

SHA1
6f6b37d4302573e005e193471bad51f83897246a

SHA256
5cd24a905b87d625b688e57c0d9f56c5cfe10b3cbe520f625d84336798f9d3b9

SHA512
6752e2c5c668ca4000790fd45f67a90bac38fb2498746fa66f826005c959157a512039ac3f76a2a21aca78823634f5ccfb9e3b31ac307de5e037842395945fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af63020058f190ecd8d2495bb7fe0a65

SHA1
07404098ce6e1f83d5f82c4d85998c6671e45ad5

SHA256
18010f5b52277b0e6d980cb000dcadb502aeed89745e6bb89479939f9e17a450

SHA512
1a67626053353fdda31bd3b32f07f512a49bcc574b4b781092cef9c4113099f34ce555d392c3e98b2d408654608acdfb8d79b8c5c7cf30f19d20192f98b881e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA5C4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACD9.tmp

Filesize
30KB

MD5
6c1e96886c86967237deccda08ae11d4

SHA1
0838435850ec4efa6acfbd665782a0f98429231f

SHA256
dc04e5940d252d5b4c96cd049e75db60394541f35060da3450941a9950e68957

SHA512
9d8d5fa6d8afed9b7fb362562a4f3fd6a73cb515db37bd02a2cd29b083329c87a190e4d7a3e97d0ce035272632829a95065680396539ff992ae4e1349b63a438

Download Submit