f0e0ea945ce2fb957dcaa59ea137b858e5742e9a3bd75cfda360b0ca4b9d3303

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

586bb94cc6c7574a3f90f12d700fb5b7.html
Size

881B
MD5

586bb94cc6c7574a3f90f12d700fb5b7
SHA1

1e26158056f30a2a7054dedc8373232e595a207a
SHA256

f0e0ea945ce2fb957dcaa59ea137b858e5742e9a3bd75cfda360b0ca4b9d3303
SHA512

24db2cb269b93ca4b61d1a14ec54c9b0a526d24f8e9df37a70838d1c7ce03f14cac1c9b6c3f859d5d7e45cedfc3967822c49caf6b5b74fbb85f9385eab8f5d6e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001a2fae9243888f7739b183646eb9e27b4bd828634891a0d30305806c28ce463a000000000e80000000020000200000000abf70e83db876c6f37857a3273dd5ecb55c4b3dc99aa76521b499d76050f003900000006b686570f841e2bb3b4fe65d5615916bb51726d372a87b830a6bb88d5e4e352edd303340b8ccb6cb4da5ca297a6994365e8b6710a65c7e98b24d81e9a693673ff5bceb4d51de9f9e760fef8a34228523cf49c22d2cb46a18b181bdfa13e6114e16c3697688781eef23abca4a2d1051b4661af2c94011d28caf070ed34e80c78a84aef808e224c3b2b4f67a470bf9807040000000801c8242f825d562516052a0d670ddf02b29dd763f4dd793c03e3794acec73b4b4e317ce31b6355d1588e2dbf891063c64092b8fe8ec6d83b20f1cb78b4aadc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000007cdb5d307495ba5d8517e6791fb4f06c0223593e7ac0acef97126f37532d43f8000000000e8000000002000020000000944d502e0e0c1107aaf065780b88bd1328ddad572933ad3a6c122c333778bde6200000002d6f603ab151730878eeedde3a9fcd9581ab11932c08414fafceacc9ae085d18400000001364c3a311554eb940b575ef21b696daf0f848509f301090db277d64caceb63a02f8dea900aa25c78a7ab5f7ed6125c6657012a7dac2d4151e420d55a49737a8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002808d9f745da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411295214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04341891-B1EB-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1804	iexplore.exe
1804	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2824	1804	iexplore.exe	28
PID 1804 wrote to memory of 2824	1804	iexplore.exe	28
PID 1804 wrote to memory of 2824	1804	iexplore.exe	28
PID 1804 wrote to memory of 2824	1804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\586bb94cc6c7574a3f90f12d700fb5b7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18c25337731261deb4631bb4b7f7f42

SHA1
7e39c4b5973d0d045de2d9056ff79107915542d2

SHA256
c1d07b80ec3cfb2c17f0169458b8b8a44afc20ecc82a71e3920065d84eb7bd3d

SHA512
d2051ad90296864b8b31dc0caf06799ab6c1f4c8fe11e4756cfdad3112c565696228352305e194cb508bcc8348ad15f9a5072dc37e7a5e928262f8d1c71ccea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
182be2127e08ae111399a1041a5c5568

SHA1
eb76d9a5da71e7a0ef578634f6ec128f9cb98324

SHA256
b17a9868a560d9552fdc903eaf7de292a84ca02d146d8f723f21b1dca5b27ce8

SHA512
928b8ed009ab5c78937b758bd86a58ddd80255fbf917672d1e9d931d4f4b1c0473288e95f80fe4c6c4829bee034644564e91507b71f15ee355c451263539b7f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ec02a9660292ae46562fb6f5267a9e

SHA1
c26fa0fe5cb931ccf994815ea26c4242f0aafef2

SHA256
fd91d067f54231151a49e0003bec1d4dfe069dca34fcbd8c5805a6cdf942d0a3

SHA512
866fe142f35a4a82afff0fc059abe6cc5801bbae9158d52b5aa41ee67af97252cbe7c9d4ba45b3d0a72ad67b726cad47d494fbe3aed9fe22cbb796d067c5d5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05068b1779fb3fd51e280df56067427

SHA1
ef2603e47e80229d63883e50dda75f93a6dfce8c

SHA256
522758ca412285bf5b4b36b4eea7124e5e56eab62fa31a2555be5e2bfee7d04b

SHA512
963c5f20a961a7e0c7b1f4ce438659b2448e93d27cf3be2200d17c7ca6a3a069ae5112862212fef66814f1dcb8a80f4fd73d9be73fad8db7b60ce7070c14c80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40f43350ef58687db4db13374c23954a

SHA1
e8758d071017dd4c6dce4a43d0564cd62541a2ec

SHA256
db46e3c0cd667463db59d42781d5b6df78c6c601a6af7eac256dba24787e6e9b

SHA512
851558f79fd4238a6a8692274aab13ff11a7f30592244d8560e9ed42628e5e17fa115f80e078891018e1b7d107d9a9008cc9bcafabe47a5b2ce58b48373a3435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6b999c62aff60277ed17c18faa21861

SHA1
7c6346f9d555fcedc430ca9f5bc03ea86a3776f6

SHA256
5a295f3e0e2e3f960b32c72826c9545d9c59ee98169341172318b039f996c207

SHA512
aef2e727c037011ce65df4acc6af57a93c1245012bd8bd6b67d745658ce44ecf7fca3100a30afdd9d1752f17f98ac08e478d17e2649684ad63d5a9ce791b21b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3dd4ec67f41457b4ad10d460843804a

SHA1
045eca62b9a42a53c49644fe4e598002f17c4219

SHA256
9a1a6398bca100dbe2a9fd326a23ee9532cd7ad3ae02d4467f3e04763ad6da1b

SHA512
bdb9ef2dcbe142cad3128ed2e69b25ba46a4294f91e4a265d6f4290a0d247df0b76fcf4bfcc18b4706a82b4e8a1efbbc0adb123a0e8842ef2b37b2b902f6358c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6851d25e88e7f6bfd810eb6c41b7b6cf

SHA1
96c49e90b626c27fb397c596a3c253d43a14e551

SHA256
14844ace32bba495442da4ec08f4609af1d5bc7dbf7428fd82fc887035ec6854

SHA512
aa25672a9e1dc5bf6a5f80cb387b101a15068061a9b0c4211a5c575b18d2007f189017a803c611f7609db5cfe07c6b0f37bfbfefc1c114d346379a951427c140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36ff8a8c3ac0b4e5ed772d3524898482

SHA1
cb86cb81cc0f45ce0ae332009aab68c1001d9c3a

SHA256
16900328cc76ed32786783aa247d71d7e2156c5ddf1ee39d875e43a3002cc853

SHA512
223f4a57aa34bb10638c213e14193c8b93a440d215b3da1e63877f7f0d994db5e4ea2c94fa86959e761cb0eb73c37d647cc66860fbbff383635c4b2be9d529b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ddf18871a46c3b121eb9b10090a2721

SHA1
834e10a1b10c3f2bcd576b51a63fdc4769c75b42

SHA256
8bc136df1017f77496fa8922cc90261a79eaa8e91a67640ae3a7295c92f63de2

SHA512
722a9fabd879318340e2e20e50e5022d071ebc66d28f283cff47a653ae3a1d0d566ba8b03a030a9690bc5729ae060da4f3f94a2a3e182ba6e29e8de5db8ee6b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a21e256115e81a9d0105c837f55b156d

SHA1
3ce68539a0989ddfd4b9b838324485fa31361629

SHA256
33e44733070b2dcff6c5c031cf1bc28bdd8864d67b732608b52cc1233813afa6

SHA512
4d86a5516b941b279574da2705f85e78ff3792a5c82932f7104096ec8a2748ea29f33d9dad6621be633037d9b3f0fe8c67c46f62b8fec965aa811b220b024e88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4073a3b1f8895a4a895ad0d77978fdde

SHA1
908f16c33a7527c4b9f171c3ee3b45186245a4c2

SHA256
699405b3f19700fa6dfb6df2248859cb7d6a493e068a012839c99b916b66bc1d

SHA512
1c34c55bd083c7b843a1a34cbeebd2ccbeef1ec465a1921a5c317b75cf45dd39b896861e2f85009e7f158576a731f4206ecd4c0850018b689ed9f75e5c2355bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35929e2236dad84350b4336825b69065

SHA1
e88132acac652659ad6942bf48b120503a15c0ef

SHA256
5f66fe125fec81455fa4e0ba8c3bb4f6a0db59b2495c0ca38017401e052f82ad

SHA512
70294d057ff1caa54e05167b88e9e58824a6ad088c405f83954f137fb558f460672540458953cfa06f6b5784953554fb23af3850c245f11fc74675083bf86ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f481f1234cd4fd62200bbd11be8bea2b

SHA1
2e2d86bb4cbcbd654b505b0c5748c3fd7134daae

SHA256
45aeb0b3a267c10c7da81ba649903e8291b34f0cdccd6d2bac3dc8c992275e9f

SHA512
4a711bf2f8991ecbc827bc543323ff92efa51b38dd535bf3677a5bb827b690bb632a49ad2c75b2b843d99ba9b46693054fd3b800d2c94e655f78013de3963b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b624922072e19ab9450140da2822b516

SHA1
6f7304d803a2bfe58c425911ceb4f466f8192e77

SHA256
81bd3fbab3aaedfbdc5b688a8123da5918d8e3270e3f6a67d813d40043d315d2

SHA512
1c01f82b56331ad975876a19ad37438062d6973596090ca333f39d9036a2b241b682aaf2cb29e9ea6d63f379be2041ea853d00136d39438c859b65464a45aacb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e46b37b61159b3a8174508475459776c

SHA1
1b0966b644043f4c685b503b893ee7221c803a8f

SHA256
15e7379e44e7f57e6bb2670c60fc3ff26cebe3d5c477ffd9c9f6f24bd22e3db8

SHA512
d7fef1cbce8edfaf518d0ec789f8b951e267a257971218149518b9344fa8aa69a61187585516c56253d1a831fbe67541e4a8b676b2b54a83bf2ba6daf55c9cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8613.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89DF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit