b8e18d01e5ca9cbb91305e485f35f3a2ad2c56a665b8d6909baeefa1b523afca

Analysis

max time kernel
138s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a15c0e58208c3693925f29d83f0dc96.html
Size

2KB
MD5

5a15c0e58208c3693925f29d83f0dc96
SHA1

5a332dbfa7bcc1381ce1f8fbe0149ec9140fb84a
SHA256

b8e18d01e5ca9cbb91305e485f35f3a2ad2c56a665b8d6909baeefa1b523afca
SHA512

aa6fa6669a5d55771ee0782799845892ad66c2577f70944ee1fe2a420b171e8be1e4be60593ee89665afb7c474235851078afe71316ac6a4b6e511d8bd056a9e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000004c455bb52402c213b24d8ff7e8de0ff4f4dacd5360575189c2ddb31d5f310f1e000000000e800000000200002000000086c84391261b9ed17969e8242985a010b8567c5f98bd88eba59d916d6993b64a20000000a4408c3125b53989ecbf0866beba317e56bf3b0d2f47de4df133c2429f81142140000000a29bdd161e5b89bd6ff9696280f81c6d4db6bb91f7ef4c545d81c9b51a5ead4a96a18fa245fe2ee80ab0c8caf9af0bf2a90661b5cdf6388254123fdd4846f9db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB260AA1-B287-11EE-9295-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f432c09446da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411362604"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e369b5ca0bee6d26ec0bc058890b30ae0dfe7d735d91feb39479d206f502b878000000000e800000000200002000000014dfd72ec429f1368df907fe295324f71a021871c2c85dc9940d4b49989049f990000000743d5b2a30ce7c686f4a02c5cb3d43f84013335e613d5c875302ccffad65a1cfe38b6fc3762b8dedb82ff23d1e5c28aa4e8d09654a67fdf5f1103ae92239a115584f2f29304416a960f9850831432bd1cf78299145e7efe7810d4fcab941ef38a30d68cc9e53653aa8235ff4fdfcbb024d4394108c1ff317152507d062b6d6c58def1f9344aa8431a5c18a9c84285824400000006c71674a0a21e602adfbe8e02a7afea06d911f146b6c1fe02cfaff8455c9f60c78860739f849dfcf964d5ef3849eb218e088142402e1b98d102d35cfabbc81e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2792	3036	iexplore.exe	28
PID 3036 wrote to memory of 2792	3036	iexplore.exe	28
PID 3036 wrote to memory of 2792	3036	iexplore.exe	28
PID 3036 wrote to memory of 2792	3036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a15c0e58208c3693925f29d83f0dc96.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d2d24a903ae7e6d332975f078281859

SHA1
7158fa2ce68015e8bc71f82e095504ca70cecdab

SHA256
b259f025e1e0c0c5fc8db8da932da97cc7794b47723927a1d2215ea672f68da1

SHA512
730c984581309e5becbf274452d758e8da5d996fde159248acc3df9a69307303e6678a7350f3a7e4df04c0b0e04c62179fcec14c43b20bd6dbfc2dd30b4da411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a84ad93c1f5a98d1156d32627de3511

SHA1
7dbea95032cf09897a02ac9b7fd953336b5faa7c

SHA256
75e33677a540b545a2d64274be353283f74807672281e99b585c0713bd40bd6d

SHA512
17a7197e449d21a637612bbf15fb3ba6c2aa64054d5e3d58fbc004118488b65c06c9c382aef907deeca00ddaa443d246815150a358b7c23cc0dac081be83535d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c1db7c7e7998d7576935f62d7a943f

SHA1
3235dcd679cfb8d7aa1d8617288676713faf631f

SHA256
86e93eed452b2892b3c36e26d766c482fdbe4a2703de61409f1ed6a548bd3b94

SHA512
e557b0a5388c435417ff2ad26d38cae6e04e0b90ac12d3813db4235e893a31b7c0736683a201a036bfae2b73c1d46f6a9dc344f3ec023b1264af5b84dc62dec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92307dfb6c635c41612a3f8f581beec9

SHA1
728aaac248cc998637b4fdbbc69c0ab29eda577c

SHA256
22fd1fcbfe8e69b6b97ff37a78f66a3602c4235d9f85364e15d17a574e4f098e

SHA512
8b253485ba06d0d01e831eb1aadfaba280e56ae78734e25082de8b28e08cb29adccfdcc33ba47b5a8dec2354b7015dffb5a89ffa6e4ba220a6b704e3eb27dd2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb1f00068041e477880f5f5892808862

SHA1
a0909dd619c7f3c4725b57a970b787d981142632

SHA256
0e78790789310c20db4ff3b1632b55de294912d4c52b923fe80c6a3b3d158517

SHA512
5b5184317a0519437feda99f760322128bb2578c12b02ce173b8945896bdbfab0a1cff8fb451d761d76173864a2c559ce506d6651c811f7b623c02db3bc93bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44d58cf3e5bcbef6afd00256454c6932

SHA1
d4197e11b0f35eafe4bf324613358a6fc48c72a1

SHA256
a4daeabdc4153905fbb93c678c7fbb841f377c0e872c391b528d4e49f3c2c459

SHA512
86bc93d8dc7c2ee1fbb429347914a56972884e272b238e33c4f7ad587767441a9b28545134966d135076db712adc04814aed157609007723f9d8dbd40388538f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd274ded1dbc0edc1901f0a1947bb33c

SHA1
39b67d25a187498dee2e729ba96ac143f6bd7ada

SHA256
f9f76af4587e6b1b84a63e5af1096e50f85e90260d65f31f848c42e9ef6a5f4a

SHA512
c7dd71f6488ff09e2846be268e06a1d7367c8c0070c95f1a364994b0ec1914622088f3ea82d7746b4fd56b1a9f890e2a5c059a08a1fceb0266a9b18aed342414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8750438317ba0d2c6d730a1cc3a869bd

SHA1
93966cd874c953fdceadb53ee3288370ee0cb7b5

SHA256
f991dba935ab25f662ecd4d558bd972e392380f8108e494e582b9453c2ed6b51

SHA512
e1dbfaf5d249925a3218b24895be3ec579db6bd50270cead9dbb96e3ac328f39db8463d26f322eba92ab91d2079bca6885971650b09484e33c783e743e3cbcb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5307d86cd082afeaa3d0837c8c3b2b19

SHA1
22b988819261f87f96dada6244f24aca6fadb908

SHA256
45d270690ec1671a51eee3935c87f76dc3a3fc2bb5c7538cf2be558506e3e4d5

SHA512
5437837826b38698acce9906b7f2c08ba93a9a2d9e7a054b73f93909dc3e0ab3f4394748f68b1d1ef065d1d8f62d49551ced26e48768149e0b75814c94a463ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df0cb79c786a321b0ea59b90ec7c02f6

SHA1
2f40837b47bd74bf6fcf408543f56c2bbbd2683c

SHA256
72c8878f29f0ab62a6f5c6618b7992cf600893acfc347ba1a298b74791013df7

SHA512
d7140707b29fa9bf7b1e1baea25ab97cbcdfe76818ec48c6e0b0cbd3827e87eacb98b58dab7104d475de2eac20ff74efdab0754a7a3d1b7012bd5515c03d6001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2969bf27d15ff5716cb6692ab2bd039b

SHA1
b546928f4d9d5e2091f5a7a90144f63cd2db1781

SHA256
878f0b63a06d98d5380eb3322d3921efb571684a5204649ba2aba4e68d90ac6d

SHA512
03c76d8bb8f9da530b5dac27786e03b06200ce34cbcd4b406187c8ad4eb500a5758b1581912ce1c3cd1d5b987add9bba3737251eb1a8ab44ab6881fd62974a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e435e0b668f258bace73d679ce9d4fae

SHA1
251718cf5562c123173990aa39cd37f633af669e

SHA256
2a3a6f62ae67b431e90cc460234f96ebb190bdcaf11e3526a862039ea10793a3

SHA512
0f815138ef5e173bbd4450898fa0610a8534d6a10275189180c32540bcb0f496e9ea1fa4a43c863e6c482d8e6c6771318a5b4693f701ddb2d45f773a6b303e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab677D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6889.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit