ceeb95fa5a18f5fa840f91337ee3611662a300e2472543fc49020fa1f78ab0dc

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59cb846a4140806270aeabcc45d88be1.html
Size

2KB
MD5

59cb846a4140806270aeabcc45d88be1
SHA1

87b2bfb2bbd9d9533d8b414c7c9cc518555d20bc
SHA256

ceeb95fa5a18f5fa840f91337ee3611662a300e2472543fc49020fa1f78ab0dc
SHA512

f23ea597dc6123701f1564970dcd0b51db68b8dbcbc7095e4c3422ebc1b77b7b8456af1aaa0147c6e4ab01eaf57c6469bbc7fc757fcd173e5bc68652eadac758

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9081f5d87f46da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411353628"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002ade1d10c7a1d15804c946ab5ff8dafd24582c523a96aced1003b9b4c4ed67d1000000000e8000000002000020000000ec3751936a1042eaf3d59bfacc74db43d530af1ec311c57596cc952773570a5f200000005e1e2415f9af2c96fe345f70e750a424e443773b9f9e97a05e11867e0d1b778440000000a3d13280724ce2812c51251d3a9717e2e1d470bf0ae6545a99251ea4efe57f413ce1dca32f273e6e871b7d3e3c5b9ee4ab8cb3b51ff74d33d3067e6b44eca3d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03E46921-B273-11EE-9317-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000599761459d92b208e4a7ed353b9b4b27cf3c1f23a5fac4ad6ac13db31478b321000000000e8000000002000020000000d35ea72fdacefae9f10ecadf956b59480e86c1dda679e0a6af86b64f9ded3470900000000b6cc64b7affd4094e7b00ecebf0dbd7029103ed2a05935681fb2e27356df7d183383beddade137c23e4289c6bcf0c715ce45637350e9d992a6ba6fe758b9d611e97e2b93b4f1364fe41e3b3cf21ac7fd9dab10ddc9972c2c6fa057adbb1ca104837771c2c26cbfb91346b786d48eb20a827edb94baa1097d5ec2bb7768b02ad55db4101003c24858a4652acc674047140000000db987eea029999abe325f0955b6912fe4811d6d31f1147eadcdbd4d9d89fdd52c0e02a6e36c3ffc27d89785cc19bead158d79a5de1e8b308ccfb8563cc58f38a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	iexplore.exe
2636	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1272	2636	iexplore.exe	28
PID 2636 wrote to memory of 1272	2636	iexplore.exe	28
PID 2636 wrote to memory of 1272	2636	iexplore.exe	28
PID 2636 wrote to memory of 1272	2636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\59cb846a4140806270aeabcc45d88be1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6c907a0048071d79a36a5d152bdf4b2

SHA1
b16043f901ced8a85e86405da9110efb067652de

SHA256
d8ce42ba4cb461450746cfa9f223f8b9ae730229bed95892b3527f17fdfb1fdc

SHA512
589bc7ffcb71dc65ac93ff0df4f5d190acd85f8b2e1f20ead634198e640d889d423fcca17ad2190b2d6bb18e1c2481fec833731139df4c5d68873093c919492f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9c4c6302d9cdfce66b1f8422fe5e1a9

SHA1
331be68124b44ac112d8e2b6ca1a1b1e637df0dc

SHA256
09cb47fc47ca3bd83ebfec0af5f47ed43d07b7d7c5e598f50f5be59c13fa28ad

SHA512
61d544e924af3e0199c8269db9998faef2110c75f734ecb88cea51f5bfa3f021d64b8e2549c6418af05444e2b876c731f94027657867764f972220182713eecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c6b6e21f56bc7ac88be2767cb35a636

SHA1
c038b9446428bacf33dd256fe68dae269a170273

SHA256
3e352b75416d7cd8afaf61c7165abd896cde8f5f9bfb186bd40894dd2a986258

SHA512
187986528d4f74ffd9e54ce3f07cc694bdf5765c3d822312391d56a91401e1f6fc4c1b46b61d5994aeaa1b7f443489688fc8a58c15887b5a5dfec0502d306453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31eabeba7318eccd41897fa62cd0a10d

SHA1
9203536d7fd69d091ce2ea30f8b01746744022e9

SHA256
67a21d4c3c43f4f8bf3c6d133be80365012de54329d95bd47a6bba0f96eb29d2

SHA512
9eb4c135e0c56ef6cbe46b2642c7c6e5f7adb68d51c9ff16533d8714e41a36ed9b3fae9adeec250d24ae406543fe365fd294ec7ddbf7c36d8984504fdd91de30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31fea56602138750450c3b24d71cf33f

SHA1
804832d1f5d7b9d52c45f4e8b7b1de7332d8f845

SHA256
343331636a8eaddea3fd9eedfdabd393f35f8dfc36ceba610daff462abb024d8

SHA512
0be8110fde319e0df5523ceee2dcb5eb0e40b96e8c88de9db67634276520cfd7ff8183b0ae5d4b33896287d6e05099645e9ef282c95ab506e0d483aae85a15e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faa8b75b57b583a054f1d42801fc89ae

SHA1
0cc606ecc4ea454fa29f8440eb51510c002d0ff5

SHA256
7115430c51c0235daab442c96e46fbb3fb835de84524194fe08dfa5a239c25ab

SHA512
4202f4348e9b30e034ba773e9d874edc2a24bac86fc6e3e0c6cf24edb55055b9eac49403be2280f0a0fff0ffc37c8ea07aa709a769901e1df8492af707ea23c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fbc4d56aaba305ab706f4a6dd86b66b

SHA1
49665bde44b3e07c1c60cab6da1c726989121c69

SHA256
f2a2d4ce141fbe6a1c01f03f9eb9f42356f360b3fa3d0a1089052b3bb014948b

SHA512
eb283318ebac7d321aba8811b63a0a1492e99658b27cf1f26b1379d1048772b4053d1b33620627c5aae21ca2f12347d823b9f4584bb380d8004f37b5962376c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed268834afd366b2b1b73a4875079e84

SHA1
d63021e9673c946da86772a8f10334f16a603e0a

SHA256
09bd070d4ff1c599cb88b6accdefc7fcaf98909d68e0b82ebbe55b7875a0b034

SHA512
b3cab48ad5110c5b28b8fe136903301aafde7ade227d3fed1a945932fe834cfa270273189d4a656729a02e8db1afba13b918d813514d98ca05afc5043f9d3f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
400cae1d2a05e5eee2b7976957d2d59b

SHA1
53a226290be94faa288c246f4137df0fd0a18cb4

SHA256
807f2cc34a83e2646ac50de7d5e3948beb49ba0ff4f7aaad6f564b29db321e12

SHA512
b94037fea01fe29734dc6d42d6e83ede4ea3707493d34714479f2a17a027aed9d130f8fc1168e433b76240d68a292438d912c7d67ae275ba4afe948ff98001e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d1e18c827ee09bd060b3a67f37916af

SHA1
53f4f41a2eba7b6bf674aadfce057ad49d74754f

SHA256
29b70bcc28dcf905ff1503b7cc2a7137639916393e5566a786305f6d536efd98

SHA512
a984ca5eefe8eb203cdf8a3089c57c11e2ed802db77774fe364dfe63a12ae43ef569a38894349183572b78649a57b8b22004e4d2001ed4fbdb36d71d55673110

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac3a8f438ee819518fffb2d2b871ca1e

SHA1
1f73617c2d2e9a42f0e8d64f27dc80452adf9d2c

SHA256
85fad780bd24c08cebde0de3f0c443e817cca0128848d776b3fc7a573fa7246b

SHA512
e25c4c3d5d1130879f931202430500fddbfbeae470170c8b76e90b63292c7de3174b9f20c7426f7649c279dacb0ca4e5a23661f63e7558b52ad9ef5c5575ffbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e36d2e2889dfe4664e27c47c9b4a7e1

SHA1
95c7adc6bdb64ddd7d266a64bb7fc8da6f1074be

SHA256
7911ac412ac124380a1920e8c87fb40e16f008a472a839ea40076760ff2cfb30

SHA512
85f36dee07c69cf156b10c244d0ce4586178834961eb728aefd1e06d2a70f02c183826c93a62fc1cdd67220c72292c4353ece39b10df1b3f34a16fa3d2a4fce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6be23b4696718f6142ae2170789b3c8

SHA1
a78cc32b2653f68a84324289ac789def0ac425a1

SHA256
fbe92d49c94d8dda9ecdac8d765fdb69604f991efc18f402c33f938a8c6fbc2f

SHA512
f27ec004e08c066f44e5f01af49b8ce88d83f257f009b83926c0b80a36f8dd1e1b7ac760242d0aae91fd08afee42bf8c761d7c5cdecd444e6025ca3abe7b318c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eabb65b119e61ae7644eb0f55f4481bc

SHA1
e4839a84bd59631d52f6edfba438e9211526d347

SHA256
b2f82cb03264722d46d30e78589ab6a4de0659415e5731f09f473a5ae5807949

SHA512
4aef9f9e8eadacb1c9bfdb45e42dbe7aa766e59d4e751dcd9430e23fe15f96fd2ec0e8473dffeca28865ed493853151d1b038a8b08cf82ff0f42cf4ec7ab7b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83adb58813f0a55fa798c87165e4b017

SHA1
45132abbc8628e6a972e89bf085b0a5f63d22f5c

SHA256
50900e5b6c51763d8a31f8087719480459a3de55deca17f076065da4e61ce9a0

SHA512
fcf429b35d4720ff270f91752b092906bea1d5134ada5c21be2c0a6ad1ead7c8ffcccd564ea426ccebf1c81cb221260ccb52e744a95cf199e53060c1ca11294b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab739D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar744C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit