1eee140441bb2cd3f3bc385d6bf99d22a9134d06e157bb124cd9f5afef60f529

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b1f02f4e6ce834eb1e10b5997d1a06.html
Size

2KB
MD5

63b1f02f4e6ce834eb1e10b5997d1a06
SHA1

57fa65572dfb3f2e676550bfb888ca2e0d50da18
SHA256

1eee140441bb2cd3f3bc385d6bf99d22a9134d06e157bb124cd9f5afef60f529
SHA512

2a0e3bc813cc9332f1b4fc0f8a563b953ffb0f8d53dcdeedc1596f37670a8c601387ae4a03aab7a35ee1c4c93149ce5353a1bba947777dff22db492d59d9d9ed

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F191F91-B582-11EE-8CB7-DECE4B73D784} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411690076"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705dfe338f49da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000076b723ebfea1c8239f16e456a6e375a2bfc35130a9c4327f1a23d519d6584804000000000e8000000002000020000000ed2745265c09af4d1a15b8e7e63a3a3f5d43b55711d4666b478b80c1fed796f190000000c8edb49537c0c5262968223a4f6a0b447e234779a008d80e8f414e9b9e65c440c0f2f79193a9b25c14f4e3a846e3d18f9019c8e6d109b9ceb76d5e5e4001fc416593b8e9931b1db34f7de13faad0956e9a51dcbd68c7283b254fc5bbd91cdeac4d37f71323e93d2509e1d319f0b45c9599348ee02d187d42312e1b2537c1ac172197839d9c480178ccd869c2c0e7944440000000e382fae38d7f010ab3c91377d7b7585fde178a57289b72b655d17405da051d639699f492eb3b3253d30c2293bbca160ea8934a9f231e90f24484fd59e841b4dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005dbe6d3d08ac40970751701e30d6d5fb5df51f4abef71c5f6563121c2a7a6de0000000000e80000000020000200000001bf6aacca3e3849000404b3f4ccadc70d51856284d8d69a21bbe9b3920a53c6d20000000ed3cca478dd3716d73ee81267459763175a06438a4384ed35b6c7fac5ec61710400000005e485f69f7c4dbac7823000b066c1576553b9e28e13d87eb585720f6f58c38be8ed0ae18bc7f5c48efd462dc58b2550fa555156a50e06e9d7d3e173f1ebca351	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2280	3052	iexplore.exe	28
PID 3052 wrote to memory of 2280	3052	iexplore.exe	28
PID 3052 wrote to memory of 2280	3052	iexplore.exe	28
PID 3052 wrote to memory of 2280	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63b1f02f4e6ce834eb1e10b5997d1a06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb49b60d43b4fd9c564d83a5a462d6b1

SHA1
ef4c30c9a005a640f3a1f2ccbfcdf2c01b266002

SHA256
3c7ed014b446fd63286e7c0432ebed0784424e733868f99da21bec7a979aa58f

SHA512
c694257220048b3d0a8c12adaaf665c82d060fc78f85435614415e1b133cc2d0fb41437e2a952b2509a72631e5ec7012642afa49348c0eec6a2154c6e57062a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f4f2529d84d6ef74a55526af324505

SHA1
6df56f09d846b652b569444d713448687cae9176

SHA256
c7598bee8f81c7ce3be4c0472a615a0bf485c1fd52c11492086b3f5755f503ad

SHA512
53a8ab7ff7715315c8350cf921dfd26bfc96efaeed0fb767a7cac0d6153fa056e0c388767f519ac7d565b8c037e28f5b9bb4d0108e94033384d59d77048829ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
830a2f47712782177ca33cf140faff16

SHA1
43026cff38d81d210d72349d23ff01013e11ee56

SHA256
8babae3b35b169d6b04ebe278fea2b8a40dee34639ed8312c858ec63c2ff00b8

SHA512
c4a8f89d9d49dda6799944df3c503986ef74e3e8d96858c00f6d446ac124acb5eeb2e707a6713bea2a2282588ed1b3f4d4d4e1e29353c17e78526fc4903f5f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3fc353c021b75f8544714169ca178db

SHA1
00c54f3b95cb2123a71caad2d297442135015e2e

SHA256
e21632a33bcbab181c8bd91880a71c8099a42d7b8460986cf654687e7fc006e9

SHA512
7007bdd388bc7041fd7260eb23345c0f64a0cc2b0e95ae4ccc00629f55d0f6da64943f63d78e3632f8e6d5d1b039bf16a9e88ec2a9e624f1153dfc10be144440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b68205a01b4ceb1013b32a1dd0e424d5

SHA1
2c3d04af68440c2394ceabf2149f0f5f793bf0fd

SHA256
da55d18aaf7569448b4a893d634cdba0bce143c6fec574fb077163fc06e0ff36

SHA512
31da57cbc7a637d0760fa3deca0e51b0ac2baa46a12bb6f6581ede1e977612ed7ef5b288405f28f0ed37b9ab3bbd8ccadd75d2c0c70cb5d945c79db23714506e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bf5fdd92dc8b4840e0976c7512c0f86

SHA1
89ffa67217b5a2cdc9d874158d09e451e94307d2

SHA256
830742c318893bb2408dc8050465b254d0860f4b2246a6d2c08b49c5266007f9

SHA512
021a97520a00760d72cc05dd5b4665ff559014410a047432b6164a57ca7bf4c0e71a6f9257c12df12b67f204997c939a96089186093dd6e7405646fd26dcf89b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3ed558537ad2856c2669bdfe69abcea

SHA1
d30429abeedf72cbc118e55bff587033bce3c3f1

SHA256
c141cc48d8e3389cb8eb52d0221f0ac508e6f9d38125600499721223479553f0

SHA512
332f0dfb4c7e046b5dbc0bc3fd7209649553bd875981ae880e2a0b301eddab025ebb22bad91834b0add04b9a07c0d7614fda0bd613b410c04dab8251d29ff09b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa769c9cb1f036ec791e18ecc780bd8b

SHA1
882da521c84423ad06e7279d76eef89612602950

SHA256
467cbeea687937730ef0a3e550d27cb44b2769fdb183637eabd0ef67f9706d9c

SHA512
7ae7672a2e8accd15807f293d79a5c96818b75026e6f159e8191efa8613fdb5967589076e8acac4580deffb2c37122842df688c81e57f980742eb222c90565a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4359b2e56afaa53f5f3edc67588215d1

SHA1
03fb4761f0f3ccc0cea8e9a1c164676177a9f572

SHA256
fdb3dede25cf56dfa30ed0ad9cb489c9656db59d1b9b9b9db052dca96486df25

SHA512
ce74f436a06bf51793bfd4d2f546963f728a83e6a77ea6a6fcd5757cfa26084ff3539e62b35a6a92eb9aa0434cd17d35e619f2b7b2945bbc7a8f0a6cfc41a9b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29a2173c98abd21f4ecc110966d57768

SHA1
6fe572c7d480d31ae27f449c12b4136a4169a189

SHA256
b508979aa13baa5458415e8b9f947787f8b293ddbbd7d3c0d821953a92c962b0

SHA512
5bb00e0e93235a5ba8691da85d8327522939c89fe4a6715c3e2896e2e8f0c48ef435c12c8cabde8feba14eaf16346d56c1c3a2baa66866850224632bc30f97d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03d70f64ffd41dd2aafe4452afc70b4f

SHA1
db3f2ede1d71d1d802f284a59917b81407d1394b

SHA256
e55166d83cc4a9401e60173d8567bb08fefb85ca777ad0fbc7523260f8e659c4

SHA512
6b5152baccca9e439479aa44c659eee55f0a03672e2c9e917bc0b64ee4e668c8e6ca783ce510786b8780c5c2cdbf99e75669449f5bd03808aafcf778a81259ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58bd736354b2c55c5cb6e5c8181a0b7b

SHA1
a8c9772fb2f351db9ad199214b270d88d9d1bad3

SHA256
cd2520b91a03c8cf8268fa2f26afc1fc1c76ed8e8338752db9747cf68c39b53b

SHA512
48b87e43584d528d0a13ae2764e538a13cedeef646961c6670036aef8aec3235e2d075674ecb54a38b5d8a2c1bfe36115288116a2e56b68c8deba7baeee0e353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db2955364a4f29b2265199c584b5cb1b

SHA1
d0b8722caff44645b90a14748cebba2839a437df

SHA256
b1d2b7d95412d716891da8dae3623c2e5724a90dfbc288b8f7edd3e5a7751b56

SHA512
272b6d481dac23b2fb6aaac5dc507330e08b826053b786b9dea0f63db6c38770b4de5056d87f33b7c68cd3d6a416fcb6618189fb8887d268c423cb38e7ddba0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
890918a3283e58b3a7a4ec2724478eb2

SHA1
aa6a541f7d7609ac438bb0ebb30c12cac8405619

SHA256
7de380b43b4fbf3dd0fe73e44863c6fd06191f324700db3dd9934e8f9bf12074

SHA512
3007d3ad357fe839d21a31e29542fc4178335d68cf7a10d0549312fd50db84bdb4642618b7bbe85287fb2232b9fd0b3d630c9752e2deb7f0c723090ee2cba44a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea256057379779e1782873d53e795e52

SHA1
2ab42183acc9f692caa52b826d0b1fe378c962ff

SHA256
0cc9ba0f07e24caafd0b897be56892dcc0f44752a5e971cfb47617fb4a52c31a

SHA512
09df34b1a65b065b45a21dcf97fbce58a618e6ce3310fc153494b6f465689e6d35aabc2a78d96e2dfaca36b81319a12ec042c9c01d830077320ddbafd9d70b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c3402499b5082b902408b4771b64a2

SHA1
1666ed9c389b13a99cb7a043156235f65f201863

SHA256
e6a1e87e7515fb2a1c28994c20684804d5391945ba49907877c4b2b7d789f27c

SHA512
429f2f511fded43adbe27e5f28165071fc53cdec649bf5d30db1996e3950e8ae04a32dfa301eba6c10b8f17a316049126b07a48d4586bbe76c49cd3add6f93b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87D6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8887.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit