80b24e124c66c62e2105eacafc9bf436a2125d673ae123218f4de9de17e669f6

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57eaf84f68ced1ca054594684e3dec62.html
Size

2KB
MD5

57eaf84f68ced1ca054594684e3dec62
SHA1

764a0eaff109b1bf1635656f396a516bd6b8c37b
SHA256

80b24e124c66c62e2105eacafc9bf436a2125d673ae123218f4de9de17e669f6
SHA512

e1b475995567ccf809a365d02337591ad6ac9197797e01d8f918079fa8acea54335a07694735a85b748370b750d64ce0269cea19966336a723a42fb0bb2a7cd6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0C64311-B1C7-11EE-9C0C-D6882E0F4692} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000003ce8468dcb45ac6df20db3c1256900e7cd22bdcddd0f8d8766b886912f55eae8000000000e8000000002000020000000a0bf3d73f80ed02d1c3d413f66584b9174f4bee6eba799be5fcb5af6503bf5b520000000ca4b650995baa35dce4fab480afb6848e691f356302b3ecbf0b8750ff5acc82640000000667b37edc5330e36834c26cf3501f4041137b7d955c7e93ff6582b7ef5c6ecf29dece4dee7794d13b9d234cc2b4ee1a7607d3c911e89cf0ba52d0b6b61385c18	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007f20b5d445da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000058cc544dda2edfc720bb0bbfcca0f0edf6c00805d75cb5035f5a10f538f76e0a000000000e8000000002000020000000c614431c0fe7e05ec13f9dd6f1fdc996749c2436b0036e2ad93328c77c17ea1a9000000065585646cb6fe4ea322faee3db523daf41861a30a44911edc8e10917ca27bef8d927e78547d29bce7c9f54857cfef5c1d8609b00fa3bb76405157d4268458811a51c79bba4a2497651b8e71dd050bd35526ba92a2cddf3e295ade520e3f72c938381d0a7bd1e7686f1aa12ff0fbcd69966ae2382e37e162b56d3a0e88482c225b7489dd4abcbe6eb44df81ff544d731840000000a2457991d2634eba650f859a9f7b7c3eb747c27f2ce5dd9f9b1b9d48516fc051152df63629b52b9f677b2224f81959dca10a9f81d81f00aed17618bae4b341c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411280132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2196	1644	iexplore.exe	14
PID 1644 wrote to memory of 2196	1644	iexplore.exe	14
PID 1644 wrote to memory of 2196	1644	iexplore.exe	14
PID 1644 wrote to memory of 2196	1644	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2196

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\57eaf84f68ced1ca054594684e3dec62.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6633877bbb55d60fa9901a500d566f70

SHA1
91c45ec642dbbdbbd16d8e2c9ee0b761de7b713d

SHA256
502a8706ea2bc40eee3649b14b86325218e1439c73d53922982e36612cb762bf

SHA512
d64e216ef5f0aaaaae580e750b3de4c7e3527447f82508f49788504e798459925341596e64de0806559f4205c0809d37051babd231469b50bc35dba60ed735e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df6f0972783ce62f8e35f802eb845443

SHA1
c25e8c322b6e8e9b441d8ff71df046c86987edd6

SHA256
5b7c484b493acaa65f76d30646d731709a3fec5305f1e3f6536d030ce93600f3

SHA512
9c1f456c1d7595d59339347c815fb0c17c0884ed7f95f917f2dbbf958a052d335a41e5726cd67220b6008babdfb9ff01d32c8668838cbf8bce61b7d308892c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6a697a9951d2f2b64c49214b6ff0145

SHA1
b1046a13b7f129a65b4557b617e406d0cf92bc8d

SHA256
e1229bc1301fd8aced0b64514dd845bebe6fde032897499ea7d56d7dc6d57128

SHA512
3f089a71b5cb92a8e69e2e3b7517128f05845203fb2b80acc146e29efd17acf595cf567654f426568fd26357208fd67f5375f0cde201cdef3fcde896c5f78ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5b9e72ad1d0683e5bee6221d1c9d1ce

SHA1
8e2a7d3cdbaa8faac27611853a9f83dd0636f11f

SHA256
77ddd64aa9372dbcdd29823b9c7f4a98a0aa98abb6c8e7b69b9106de58dfd63e

SHA512
07c610c44bf1dbf8827897329ed1820ab8b3dfe0c295e4ce9b553b484d1f1799866271703d9d061094f8c26d20c59ed65769739feadeffe1d15d8fb9a889506f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0978014811accd405996435e15498471

SHA1
a1eded024eaf3e52075ce4675e683f10d818d226

SHA256
1ac73cd437bacd56d0e6658e6c5d61397cc8d8f40f95fbb8d6882a7f43be0f9f

SHA512
7cb11925a7ed7cc501e79fc4cf9edb933367f3542260e15cf07603bb6a36f9decea9f9a611ad620b58c5e21510f530661da13f450392388305a0d2a1bce2e886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af16e506506b4989d254050df54829ca

SHA1
7f18bdd3d1e934b3a460396c74980ee4a072a7bb

SHA256
bb13dc4fbe5d716fa14f113ca5d3168e1981c0f32d2d92386a88ce7a36d8940d

SHA512
c8763124b7e136a323f08ed5b32fafcdb22884f6c75608289cf61aac823dc630e2888cccde60b00fbc1bd50c43671a1446e4a79873e2dfe2703c1f038398312b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e4179164710b98e90a129d2540ac609

SHA1
4de81f89bbe3aa271d22129b1b0eac3e999123ea

SHA256
1ceea52041b28b2545b58ee41bf27844a190a0d76580084774206544e94283b2

SHA512
61c9150519825dde3099626e647fea3fd0b58f9dc9e51a397e02715d2adf2e5fde7f76d6b96deb085e462128b17780ab2ea817264948dce581706099bc48d236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
283755c1655a2e2ff72df7d1b4f9cb8d

SHA1
e6c4866711275bb380509b96b018e88ef0bdd9e5

SHA256
4dd49b2a1a0c01de549e5a6fbca720daca034bf6fcba56a82bc1d6c6ed8c4050

SHA512
f563aa8713d0a480ec55171b3649a25c65011d043354dfd024c3ef21ab5c1c30ffb499553a48cf3f1ee5748b916a0152a897a61be2d5f79651be240b1438ef96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21f4cd74779b1aea0390ee9b032d09f7

SHA1
a27b6d4bb3cdfd317f5d41583da55043758fa7b6

SHA256
75be2c100ccd8946bc4b60340a600cf0069ceaf3a31426b5cd906b74a78c9792

SHA512
35bbaaa31590c50c78fcf59f422052a0e6e24ab1a6cac0478bd118929a23f566b1d23cfdc5cae7620509d28e0080fefa062803deaa316b64344626291daf0ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39012d9b85e9c805e261866beffb32e9

SHA1
08c289191428363197a1986c9217dd410dc5d01f

SHA256
b1d95f837f551c414561ee9be89bef8379315e02acf2d800ca5e8ff399ec15cf

SHA512
1565fc19e0ce637f48fe7c1160bc2d72cac9457f2c3ab6fdf8d68550c6e14c61a931e6bc48c76a1b516d2431f2de12aec3f60b12eeb3b6de9e45beb3f75ecf6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25DB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25EE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit