e98085cdfaf7bb716ba712179208b177625fa4c0b176776f552a419516f3e091

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a7dc47cbfd7e53f83a33d61536bc3e2.html
Size

3KB
MD5

5a7dc47cbfd7e53f83a33d61536bc3e2
SHA1

0eec23512593e04ba0901b2ba899551bbdc269d1
SHA256

e98085cdfaf7bb716ba712179208b177625fa4c0b176776f552a419516f3e091
SHA512

086ec044260d1c0cc88d0d419266f3ed1a3ead125ece51a8c19f8c6e490760a06d778153585dff536eabf726b4308f2666fe2bb2a63e0e542acf332a39c2cfb2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36F9F6A1-B2A4-11EE-83C2-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000002d5dfccf90c4ea78c0712cebc890c0cca21032d2918752537c0659a50edad385000000000e800000000200002000000067f52eab98df18b3c4e2e193dda385ad80ea276b80bde870a127c520a18ecd8090000000edd8f595b488da834689c784d27d4218de33e91df01cb7762ef4b5ca0f13201a66152a2c7f4add76a58fd58fdbe15cc363c07e5da4b1a39b4a66eae8ff8189c4764d6c3b364a9bfb0ae47eaa26fc155bb270e2e7cda83916727af2c53c37579539c56392faea02c6d49204f2f1c22fedc4fc68263300e468ecce8444f460c1f51da7f113187cb177dff539d19fbfdc7440000000e0069632b42cf8b57fe59f9acda3e86af6c29d7f748195bc3af172cf063262198347127cf736fb87a3cf4d960d7a8b44ca924005f02e2b76e80fe03ef7fc0168	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000063808baa4fe5270f583d3d8cee64846b112c274ee4f2051c27847ebb9e3eefe9000000000e800000000200002000000001c39530b68ea0d13a199d684e07649a2d2f1aef233cbcbaa2bab43f48700c4320000000f3f5a5d05920bc090ef0fa8524830005735cb736cf973b8a9003e11f9d9102f94000000055dcf18501bc476e269b727a9f33493cac86bc2c529369062e7c61ee188711f3cbafc31f52eddb5aa1018f20f967251369745d748784a07626c01985c0bc3687	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411374757"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0595b0cb146da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2304	iexplore.exe
2304	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2816	2304	iexplore.exe	28
PID 2304 wrote to memory of 2816	2304	iexplore.exe	28
PID 2304 wrote to memory of 2816	2304	iexplore.exe	28
PID 2304 wrote to memory of 2816	2304	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a7dc47cbfd7e53f83a33d61536bc3e2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e28b0afb4a50c2cc0fa49c2ed2bdc9b9

SHA1
aa7a47052aa19e894d5acd20db45aac1ad63fe97

SHA256
856011353a7866bc406c511b07db7e7c30e0a17c2c05d6bd12d9abe1729bb135

SHA512
9cdd1fbf24da6af955fe73f97eb266c743548ca584896776d4453d413a11cd7ef70f4edd82c432d0b1d707590ecd568a58d4ef6489163d66db282195e5a1fd7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41b43774156032dfe89373c5cd5d4947

SHA1
5a64d174b13811a11e5d5567e43af0116c1a0aef

SHA256
88418cdb6db67f3c3efc48a9e14488e34b2a175c5233914a0c8178879340cfec

SHA512
c0ac67de64b0b4faae0100160e4fc6022a0586300ac64f3b22c9ebab08402177ddf1624ded02f87ac13b0a375c0af1761414cec6777540906fb3f3cbda40f8b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96414428b22d2bbd6efd38e36a40e863

SHA1
2afc6fe7754e1cd3b8e0f9d79d26f409e2f1ff78

SHA256
ca727eab4a3839f92b21ba0fb9ba7c03701d64c17dd75353dec17d76891fcc89

SHA512
c335fd930292aaea548952268e4f46db63cf91e5465b7acba919fee8cedd5ae8ea83ea06d8d9ad345bb6d5105805b0f13df47e3f4bea017f2c63cb1f1073cc2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e135c3d9ff4d3764d5e0d77aad0c030

SHA1
3fafdc0ada30e16988b008d07dad0a60a1be6d5b

SHA256
a91c3504e723bda680d46f725d3dd0a231548bb8d1c376a4b92aa593057e6fee

SHA512
51c7a83d842e733520fac775c6082789c84b6a4f1beee2773b674088fee5179caf5b07839c13eb252dd2ac36fe2f45d6849df1267d5cbdbccde7381b9afb5a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eebfe422a53bb150fe377923ef48e4d8

SHA1
4b8b5ca14d63618b52b99f2358d0a3c373a70a29

SHA256
a7d7eee1e1355e611d82f47ca1c6b93fcf49171671716cea1762f49313821ccd

SHA512
ee10691af930b5143ef10ec3ca814aa5d78d6fe33407370548a550c64d757169e7b3bfd2bb83290b6440cdc25e004b39ecff099602630fec3f2b615b086abc8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cde76254282475433bb80d3931021bf

SHA1
8e5f6091a7c087a7fe942ef60b4fb2fd25275774

SHA256
21daca534384a48700cf41fa93e260e25c7ec5c50d04c1afa472e34d723185ab

SHA512
1128f4325e2b61f16386a97259dfbaf9004550042eed3fed35110b3accd703d2cf51b6e21511cad79d01ea68d42997456862c640fc142ffca32c6c71295ddb86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e945c2d601b39277ee8c26c9ecf4670

SHA1
8bc016df9b0d8a64e7d75c272e2c3c8509fe2035

SHA256
bfedf7a34aed9ab428ea1a5e01dee1b8ca199336f075e97f02dac85e68e4bd7d

SHA512
af467a09283e2d3004e06b338c3379bafae3be7a7b4368bb1c3d3d5102872c5e7b43d4f2d1a14996e7ce4cfc20cf6478f4727af02a3dc4a79f3417f6d17c79e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5962be48a6944429fe5825e76b64dad5

SHA1
902c82c9bb152f5b3224134fd078f55504a95d7d

SHA256
8dfa0ca386cc4d5a75021bb5ff7646f0f3e4b7602b590d493faa1d49dacf5875

SHA512
ab4bd1569b6fec10f0a909596930aaec020db38da245082002e8cd12927b75d0431761d965cd390f2f26341fc89c921fb3234038ea9a70f70ac7d9e10659346f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7227.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7343.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit