f2fc3328ad6fe46b66900ddd4f4ad01a5c6bd5a849489b9c208eb6ec0e0d5681

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 20:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Unbenannte Anlage 00013.html
Size

317B
MD5

c1e7bf214c369afc14dbefb37bc52c35
SHA1

aeca6fa738163833146ae556cd179f7fc6e0ed23
SHA256

f2fc3328ad6fe46b66900ddd4f4ad01a5c6bd5a849489b9c208eb6ec0e0d5681
SHA512

78d2bc1e0f8a723d04e4ce435a3cf7d901cc70489d6c7bf9a6b69e66614aa7287acb2780f8be69ffc52b0842496a243e512ad31dbca33d02ccc0be4007603958

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000455963546a41fe673e759899c51ba8496c2462e72c76f8d7554ae4624b544151000000000e800000000200002000000016f19294df085974352ff424a2a2a07b67576e4b154c6c5b5e3e9130f712229b90000000e02c1717a23f27a4f6bc1b03a59fcd84ed63340084bb4533e26804f1a01f70006ffdd06b2cf764c34620b9be4990f6ea64946275942db362a9336d45ec5c08ed88c50ee0f587de93bb563d1fb1e2a12405607588cf665697db3411ba3ff96160e80511c2ac4ebcf3b8355f4529103c3478c83fe1d2dc834aa868575334c570d7c46b07069dc1e0f38dd4bcee50a0798040000000d080b901bab4e4f09e2cc6cb2fa3fb83f353da480df91108856e6c563c8b160b8a8f440810a6d450aae17e4f6839aa846af46aec058e49e893c56c6e36aef2b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000013e238131a7eceff59461b9c1e8183dbd78098d1a960d6e737d2e66dc789c3a9000000000e8000000002000020000000fb745b5ce7e4c2e3ca653c711c6ee90ae29589d424d2b31e9c0fca548d3f1d22200000008abd89562da6d428aed7fca80a96d23367ec1ae142fd9777d7dde3a1a345632d40000000fa9cd99f6986de34bf9f50df78f31e44afc0ecca6b2bfe86c3a6f6ff621f02f2227282681f669e0c2e272137d927cf12a73be8926af0390345e72c8d56a1a5bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77CAD001-AF2F-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410994759"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b001604c3c43da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2680	2444	iexplore.exe	28
PID 2444 wrote to memory of 2680	2444	iexplore.exe	28
PID 2444 wrote to memory of 2680	2444	iexplore.exe	28
PID 2444 wrote to memory of 2680	2444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Unbenannte Anlage 00013.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fe6be4bb4892c800cc9915441698ed6

SHA1
acefe39174906fd4f1cab38cda37a1568a4dc421

SHA256
bf4251e9e142684663d50cae16de80bb1b745ac2a7ca4f4512d836df79c819d2

SHA512
9fbffb5708dd19a9fa28424effd63157b94b085acd970a77c4c92f4c5da826e72f16fdca47cb7274521bf0a93caf884b1fb47224975a3156c4775d4c295542e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a63fa1d43e2da3d5f3b87d15790380d5

SHA1
11bbbfff9436bfd344fd594573c5a2901e250322

SHA256
db4212be8f19fe34d03aed2ea0f88d7449c10388f779a45954d957e8192aee12

SHA512
209728d98e52f0b59c3e8605c4dd9895f32f38caad399d9621c048667310d21ee36f08017e300f8cfd90df6c0ce28ba70a33fe529f705dcf9041819904e6c9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d932f1eaf073c362d9b9776aadd335a6

SHA1
f00e2a4236565a555218da6110d6d1e7a589ec9d

SHA256
ed902e35307962ccab8c326dc1d328f13ccd3ec1b966a9cbecb1aac5ea69a25f

SHA512
f1031b69f5c5808786f15d1bc1ad982763d96fc5355c05f419d6a453c2d447aa07244160fa22e08379566580053e9cf3f3fa45466c66c098f2272159b3d4116e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5710fde81574668470837eb49871a6cb

SHA1
205366c270f55720a3922d1742ee146c649967e6

SHA256
a503a7bd694a2c94eef1debbc9d1619751e60918547fa99a9ad07daa7cda8447

SHA512
2f4ff0306e36c3a0228ce94dfe17b22261492c4ad1230727c7dd759c49d3319bae431f7e85964aa117961ec71866c569fec865d20445a6c80cee8c3ada31a2c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d524bd75fd8b1e87f811ddd8ebd06835

SHA1
674823338a04e8fe2a9fbbacf71f1a8dbcd68ec8

SHA256
e2f5baf58b0a1a2c0a7051c77cc69e5044cc69d2232225390dc81f8c1b1d2421

SHA512
3eda017712e99ec4b9c86c78aefa89ac0f6e7a33b6abf605510e4e7cb09facdde0a72a658a37a2eb7aec5ec0554caaa0bffa1a64314b0105ef96ba6bc01d09da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3da7f2ed5023ba4670ceadcbc6552f6f

SHA1
f0390d4b90f76f9127967a4929d6d5ec914fd42d

SHA256
057e061f39982a5903441eef89eeb9af81f4a9e4818716e66ec8e52d9af016d5

SHA512
9796a8aa97b46a382f4b0adfba45264c9b334d35c6f91a44a8a7eefeba6fee40b956dd4e94e4ced1bdf53e720f785aeaba313815679a778b30dd5906b1398e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47fbbea28e7f1498f2d4a254756ad5f8

SHA1
8916593853ffdd9a2c0d2e2bcf81c501d537666e

SHA256
f4d0c1c2817590e48affff8bdcc960c5ac5cae3e1c9064db4d2ac3d4fdf2f956

SHA512
e5dbce5236da925d9787b1edf2238ad577859739388175594836c1c1a927c82e936206d61b064a8ab97b70c91a4e10d04ff3c49036da23ca56011504b75f1ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25499928b7226660a971fa49b016a2f2

SHA1
e1eddf53a1dab53e983697cada4e89d7db20bc59

SHA256
f662956ba30bf07e4223d919a86ef5ae774a5a5b00fb97e4904b7f21b20abf34

SHA512
a193d003d51454fa7a168c2c791fd556b602f889d637e5e286812931b484ece80ccd827ff163776efcb51079098fb92243b19d787e1bfcdaa1bc5ed5b49a9e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
116c6bce5320cacc05c1e46af8359cbb

SHA1
0deeed8d18aad6a43b3a02d6952cfaddd8cff951

SHA256
6ca1a1f4de3cc8db037fab764d6f90025ccb54ab2373e8a6092ac102b82bb4aa

SHA512
05d060f5081e2ebdc527b4e7a665fffd55942833d0dc4ace944c59e473882c7c1a8025467cfb4af18216175dc8e974b862cc69fb45de2c22c25b0476a687c2b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d704d48fee1ebf52121850dc0d2ee630

SHA1
b4470f4a02b5b828751956b9bc4ce0612b58d461

SHA256
850f96ab05ae58477c97f74df4edc652c4dd58e8e3af643643e015067dc2c262

SHA512
a8947938ee905b945ed0cf47eadc766cb00a2309c5290e5111be594bfe823ed77086948cc0a1ff2121421eec448fe807a900079c9f6254eab384e60c0d6edbbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f2b40a2bf4c7e88d0de69e36ae3530a

SHA1
62d2e9d4464f161a6205f62dd16a94c6cc0a1546

SHA256
3290c6ba0b05ccdebf45fbd0b07ddb0b1aedae78769fb2211b8657fa4c439e58

SHA512
60fe2baf5bfeba60c53b1b99ed9e4702e03cce995ee7d6022c2827178d1cf899a9cfeeda22a6b80486c4f01e0931814fe55550a5f7953263e1a03bdfc4471431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2446478ae7ccbf5dbaea622437780917

SHA1
c7a2aa6363842a880e640c51f4507f228bf8b8b2

SHA256
5bd8005dbcd7a3bf62e73c601f27a52c43c666fdc60d20cff9ca28f0fd79c32f

SHA512
910736ae85cc3bd9800d82e0b9e72553c5b9435d71ba3cfbeefa999ed87ed7e00208daad976adcb74d093778696ef5d9ae62fcebca08491c31cf4361bdcabe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29FE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EC4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit