c60e05d81d6aa7ac3d9b09684d1dc948c04d6ba3fb40775749f277b40947738d

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58a0bd7db20ab7aae8eb1864184032ef.html
Size

1KB
MD5

58a0bd7db20ab7aae8eb1864184032ef
SHA1

6052689a4975853a14ffaab67f3ca242897423e2
SHA256

c60e05d81d6aa7ac3d9b09684d1dc948c04d6ba3fb40775749f277b40947738d
SHA512

fdd3a281317f2271e64e9c4f8d5a2971418819fbc1fadc06f788f8dd7e04f2b5b1d053a3c61716efb356be216bb12ce0e0c203a55a3308675ee655435b0a68a5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFAF78C1-B1F9-11EE-BFC6-D6E40795ECBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000d60c353a555db90ba998f293940892b5f0ddf3b949a92fa10a5f826665ea9372000000000e8000000002000020000000ae13b890eddddac7907be4a46085e89969c63e6d95d1bdb8760b937dd4d2a61a90000000f4714c3dca5756041c82ca61d639d6250ffd40aa4d94d58785187ddcad66038bca8f54fc661405a343a6a09f58a3167adc46578e8a83670d87ac36ac8f350e5a9f3ccecf2d823a1b07b9727b20d253d7360054dba457f8cceeffa51baf1a27c37478455544099f8a93f0fe9f42dc9740cfc395143341b41425fe971f839ed1961182e3ec187edb87e1af7b3de01c5573400000007f267b3d1bee7ac796709da0d1f26f040f80cde0664a154938d975c1a5e026e7b01571b9739aa56adb1a5ad3c09ee76932301df396af78e1a8ef940c345d315c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bf47b40646da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000b92c3bec652d536615702cc169bed9c8276d443e04954e073516fad7174e21c2000000000e800000000200002000000081ce6210c9fed8f42dc6db86d09ec41085369e54198327a04a8081b6e24cfff320000000b5c87184718fd7a737888789c9bab12024e856e42ee221e30564f4714dbcf3a840000000457687be8a100e19dc0a7881f81fa26dea30dbf4385f30bd313a09f88ac0d63a5644d9b7165fb00e7e2a0a92a47c5afe1bca5c067c779b4521340e1d8a9bd782	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411301594"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3028	3004	iexplore.exe	28
PID 3004 wrote to memory of 3028	3004	iexplore.exe	28
PID 3004 wrote to memory of 3028	3004	iexplore.exe	28
PID 3004 wrote to memory of 3028	3004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58a0bd7db20ab7aae8eb1864184032ef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
11ba7fb203ef1b5e19df99828a2afc33

SHA1
82dd3a8a6dcce6961fe985488952027ed7181c13

SHA256
2ab73e3c90eced79c7b061993ccd89e53dacc8afe6c7c553980c19e315c7ba23

SHA512
0ae3054ce5884c23eccaa8c7d33a7057d32d4439157ddd9dc49f86e698a40a04a9f84c48b1b49b49911615fb41ad289a2deca89f0a5d65eb17078d554634021f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c31320dd455e2022f494b3f3c7a310c1

SHA1
4971558f04c475a01b25de4e535fa0fc2993ac77

SHA256
d7f94d932af1271b4e5390c875c827893adad2ab33dfb42873ea82485570f13e

SHA512
ed5e3b80b0f18173e9d84bd683274425aeb798596b528ff8199a13543a3f027bdee5d93d6998cf4da1e1c2baf7a7b1f8918918a805f8aa8550154e0398dc68c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8b3105d8232bff1da9fa6acd0d4c76e

SHA1
abcf32e4f498710952e6434af8b55493be60ff39

SHA256
c5909eb411e9062856213cb16fcf27f609451168b38c615aaaaaff182c571ac7

SHA512
c9fa3ceb0d94da8b7fa838e126d89d8a722d516441652c8bf5792009ff5e1a88e606f09bfa65492659f3668d728352f362208cfd10d670becd41ece1266e46dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2966881b25de9fb1a13a3a070d65f99

SHA1
0511969d67c7e0a2576c32eb03793598ba7564ed

SHA256
4cd39508ea584b826636ab07eaed7fd141ac031294de1b4a95ccaf445ad18ab1

SHA512
a8b86c6f037a6e9aabaa6e87df77e53a084805bb84743b695dcf1ac47445d3ad2a6d22cb33b13d69634c108f442af0e2cd364c75d89790680e7909bf20da09c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05fdd0faf8ea32dcfb28727ae6d0db6e

SHA1
7960df0fb2e74544adcf4587c4cfbc90b02ec554

SHA256
fd2d3b8c9c7e1d637285c7f23b4fab41bf974b35802c057e99db432ce9a4ab7e

SHA512
077f35e0155da20d19bbdedbba66f80204ddc44f10dc72e6e3fecb91acbb6a6745aa8b6a685e89caab54f4f8f7c4996df6dcbc8b99df52efd164726d4b622520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97741ad7ca3e437a114c14e3a2691b0d

SHA1
2e863f933c42dd0dab1e276ca1c758c4be866d44

SHA256
2302626208cbad0ecc32e249e62bce332c50b7d9cc6d15e9333fc2bff5eca313

SHA512
4b1b71cc50a811185563bf9ac073a0c86b64be32868f62697925316bbd69de816e8378883652e73c8547409e389a53fc0f32a9835d474f1f496b7a592c5dbc3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f23b3d176bf6fb72409ce62eb0cb3eb1

SHA1
50bc33224be7a899838f1a166f0ccdc02b4325a1

SHA256
c9b2efcc105fe852f87d22c1f1a826f3446956edd8a3acae60924993de8ed872

SHA512
abf68573c2dbdd230915b3c63fea3203f6e847b390295d79f2e9ea97d2613ae59ca7d1c7b3541e021ae63c720b29c23d1e82b4190b6833373ec1f230bdbd3504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fdc154fac1641f182c9010dda08b26c

SHA1
555d388f4f41e2255936f263c2b93682fbc7a503

SHA256
8577b58705c7ef861e7c4f709dd1299c0485f75fbc08ce96e4f8f0a3019c81f6

SHA512
264b8645b1e4983a12511deb8e9ffd1fa84ba83b56ee7eab6ec91fcd37510912db19385e52dab492de4c1d2aac169db2c75e137aba1e3dea6b1c2abc4f5174c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46d01da0b04c84886cd7f07cfd8dab8d

SHA1
4c62725c9c74572ae43f5953ec5ee291d3761233

SHA256
636633503b157ec3aeffc43de16f6de5abab7a408e10822902105b61beddeaf4

SHA512
f4815e84a461f0bc8c681e128c77197cdf2d44ed47955a92e17c261e32ccfa4fd9bcc40da4a9e485d57655421eb8fbe31b7ac24b2a283b89695c813b6104b150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aaa0299cbc164ede4401962a50ac7b5

SHA1
1a9484fedabb803a5dbcc13c024f511ee3e6004b

SHA256
662c1ce15e8279e3973f47e94b34589f9f9ed5dfd1c0d757344fdb264359edd9

SHA512
4d95e526f595d64230b4c9d434683e60bf6db47a38a4402e0f3f4fff9140c6433b8f0e1c4cc5c2635be2518448de14a75890381fcef5ad64b3df008108ecfad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f40aab5199b7063f587688674a7ea214

SHA1
479dbe64dc1933f92e9932bb9527ec41a6d474e8

SHA256
298d1e402ead5e27cd383a8993a8886b37a41ded4429387d168b10dbe8c9d295

SHA512
a47ee3f2e1151971d411424e062d492980214f6a49ef8930c4bc54fc72c247f8f9b732e8a4d926ee4ed4f49ff7a762922a6babc6e5eb97f7019a9603e0cf40db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd532a72d3eec8abd940eedebbb5412d

SHA1
85b3bbddf327a3833d6ab96b3e71f56f37a45cda

SHA256
6519322486d1718b88431d3b98123e671a02b64dffe1097d806af2e26d59bc98

SHA512
3b04bad681faeac3326e5929c55aa92a771cd7dd522c1b42a2afcf6f29e260f7a124f91fa7464c65c532a3e2e2b80c629a41e7465b39fe67a1944cf63c42ba49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1e69109d9328c34d3cdbffeab556da7b

SHA1
75a2f2bd92f264c3944d6f51d0ebf0aede1201a0

SHA256
b8c25d23b5f5b1f12c479e74415f8c2bbdf1b849955d9608e1523cdbf9ee6b24

SHA512
e2c5af47ad18434163e335fe0f0ad7771f3d0fd6cf3d28668a81a17c72343867e140ba0195a762539e12c94663dfa3ff6b4b6e60f380754db1702b4767455ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar431E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit