a39ca32406bbdb6b1e595cdeaed1108e72a98fddea0cf2ec5a8a20a0716793cd

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58b196ea04b7133bcc0bf913fce532fa.html
Size

2KB
MD5

58b196ea04b7133bcc0bf913fce532fa
SHA1

dd8dfe522406eab68500c726f449bb133d7e2458
SHA256

a39ca32406bbdb6b1e595cdeaed1108e72a98fddea0cf2ec5a8a20a0716793cd
SHA512

b2e98d5e8d627a439ad914ee642d13f8cbe3da1b663f062451139c81682d054d3fa4945a327e5ecaf16bb61f20cf7f86d282c292db0cf1401476f61a6f128085

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ae2dd465055166e62d94374bbc31fbd1c79e427aa120818ac09726e838dc1042000000000e8000000002000020000000a05cbb73d6b6091ac4f6bbfbf8b4902c2cd72b6864ddea59a3b28fbb0318bab320000000cc4c3ff62be16d588cd092e41757023fe78453ff67052ca7a7f67768cf760ffa40000000b315ebcc048ff3b8aebfa7b78ba4ebd233232ee82742dee71558e6c30e45f65a87563fe2ca5b9e80346dd2aa9d67d247db30dbbdfddaf5a81c58c02c5a264903	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f775a40b46da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ae8ae3257d3c39c4fb2f15cb0e44973812bb84de41105a2925cd8eee943df673000000000e80000000020000200000009881c5076053a32966776d0a6508f0129c7df0c01c02d6fa7b7ba722b13a01f590000000c39e59b96f9375a10822a943acbebc8a05ffa07e24b4bf6ba4e16a6c7c773de6d8994e4bf70b97b7f3965caf0ac68fd3c862fee8cee6501cbbeabbc1d154642076ae8c16627ff703465360d30b4486ac01f5492c0deba327f2123bdd60b8b8926ac46931898e4ffe84dc50ca2c0264aed1ce03e24a0042927e58eb84a6f27fee0ec8439eb676285ae630237ba09da14f400000000f7e9be8bdab4ec7eaebcb5ccc436814025e0b168d7250e07669ebb46e7ee3f28e5f0e4859930a8bffecfc76744796db4e9a4ca8669c0b1d9ca1eb6acf390b7e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAEB4D61-B1FE-11EE-A552-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411303710"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3056	1656	iexplore.exe	28
PID 1656 wrote to memory of 3056	1656	iexplore.exe	28
PID 1656 wrote to memory of 3056	1656	iexplore.exe	28
PID 1656 wrote to memory of 3056	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58b196ea04b7133bcc0bf913fce532fa.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4b7cbd516aaa4629367a7a01534d3b0

SHA1
5a96258bd750b6f045f9e72f0b239499efc35005

SHA256
4efaa71ea6bdf7a9b8d6ef0cace6cdbbd5bcc2e8d04b7ae88794f4427daf4548

SHA512
ff75fd68f127379248a29ebdf3807be021f799380fd54a4e4d28ae60dfcbc9e71c771ff1746ac02e9a7c7805be3806ff069b04062e6d5b72ea1fc7200a7dd69f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb93b8c5b81355edca192459e1f78210

SHA1
550541d66d5fcd2be77a775563d2f549c2a688cf

SHA256
4e555913ac8afff8b71de8b16516fa32cc314fe82c9c8f3acdb80242b4ff0617

SHA512
f040fa85386e0680ccd9a7e990ecbbd58000e93f936993a20d4d21b23b67edf4d301c906d14a558f9b84dd843492be70fbcfe8d82686e2c9ed959f0d953d312c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbf17464dd1fefe04ff4c1900ec96236

SHA1
6e48dc1fe33be3617aa120637c0ca48d0b57aa89

SHA256
54ea5943bddd2772aab25c46aa8508bf40f1a52a35a0f0f20d03239dae138829

SHA512
a3fdbe7c37d5bc226cf48f41b7f0217c42f479b2f35f32b9b3bff8eea624a60846c2568c69dc2995606f95a73bda331cc850693374075bcf4151d9db01188b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f44a5e1e205870ff52484eddf4bb31

SHA1
a2d5504d482cb1d8aaf7f3cc295cfc8c129874d9

SHA256
f12330ac684954ffd6efbbf1d0d06e66db84234bf6c2b02582b7c89db211e3f5

SHA512
5aaa400f25e97bc83b272833ba770b9c231f35f338cd229960301cf98e300ef912133aa1e2745b5aa041c27b50f745dfc9fe156eca482f8f06ab11a8747c70f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e9134959e0a759e1292d060e10a8dc1

SHA1
0b15038bb6cc91e867e589beb929bda67c60c7e7

SHA256
d9cb617d7297946e247c14bec5f7b79b196b3528ce21dce0e0a4311b1422bd30

SHA512
4018571f32cc78a484c60f9ea4a79d38fccad278165fdd78b420fa8aeb944717f408c1d677c5eed411d4417c0a1f3271cce493e9425857af1904abe1b7731d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa594c6410b5e14fd45fa1d7e347dbdc

SHA1
c173cecd62379ce0e7090b8013c9871956436be5

SHA256
32ded868e39876cb8a2ce4eb138ce3e44c7415eeb053801af61fcc455265ddb1

SHA512
a3d666684258e5ee0d69b227ca47d6ca9a0f6c3380c682661df60da2c37b945ec69547c1196fa97022572ac0ea8c25d4c47cf748174f79bbfd927b451b1cf6e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eccfce1e2dbc638d3bb7cfd8d0b73e2

SHA1
b30916836f56203cd147a49960475d040a5d855f

SHA256
f3cf17c63810aecd28be58ad93f751ba596dae3090d45d5bb1cebc744aba269e

SHA512
9f529c0218371497472853288c822395ba4543b12a496da23afb81ed368098ce1f6215ca77097a73d3a9c4b93fdecee43759b07a5c11fd460c2721bd5127de5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
341afd499d9b2bcb08c756ba2c853e2f

SHA1
c75cad28cc576f81952f9693452b64e7ea230306

SHA256
759e53a42469c78bbd78617c545cae274430ad1d4eae5992b50a9048c1b6df1d

SHA512
27d858672b77077c8eba548d774aadbf9b1ced9adad0d370dddb6afcf60d65f9c87ffc66d86a1ab522d17b65448e54d74a82bbc00e861b6c428c30ae25749cdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f522ab48f1c7f926f6cf2cf384f0e440

SHA1
50a106de51110be5398e5e4b71cd674f1516190c

SHA256
e82cec335ebd1d412391ebc766cc1fbbc9044491d336f129804e48350211806b

SHA512
df427712f0264273f9d02ce536734987bf1daa5423a97e706401bebac91d34dc3d709fecdcdc5eb8249534f7a5e08b78663e7e23e5f3e5abdd5f94f2acf15889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56668c9d219255d30b8e8f4c881d186c

SHA1
1a721f9a6da036ae744d43290fedaef3d0352098

SHA256
a11db2a698af93d61e6575a3739aca3b9504b129bd898f31098dfef73d4fe8db

SHA512
a94e13547234011da357ebbc3ff3890630900f43ff3e38aa498437cca5f62be028d8ced023e30d0fb3c404783eb467d967fb84af9d99f0e1be4ecec20889965a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88770c07e11b0fe6923336c3b9264b3e

SHA1
06986bf83dae011b5ee5b0f1ac0e3c8ad4d0245e

SHA256
87d6563178c2b929aea5cd6809c80f3d97f8857aab560eb34de432a78abaf20d

SHA512
5971e2f39ed580d5c94c0f5fdf62cd9114d114506d05333ea1ff83a4c36132ce6b17bbc46ab4ec793db3625dc1438b4b772f22e69b28d7956ea61d6311b485f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
414c425c2d1293dac93818174c954863

SHA1
a3122f27c606071a2496916b7ddf8a1d258512f7

SHA256
ebb3522b2e122e6664158fc7a6a0dad954f9cc1542c682f4ca6a225dabf8960c

SHA512
5b577f5b2b55537e15aa0658e43fe3e789f2f9b1652f4dd0dec7a80f154146c6112bcbe54de04f5079dcfb5fa15901f5522c47cd0d97b9316a19b3d2964ccf97

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA75.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAAA7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit