5aa119e439a9c62cd5334df2a0c24fa853733ff78668616f3c34e3ebad4ab541

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6389850cd8cfabb70b22e6ac821f8aed.html
Size

2KB
MD5

6389850cd8cfabb70b22e6ac821f8aed
SHA1

66b3f6421333bef4ea3b76c2ace1f83598cbb2f0
SHA256

5aa119e439a9c62cd5334df2a0c24fa853733ff78668616f3c34e3ebad4ab541
SHA512

18e7d7d0e1a5a61d88c90fb8fdfdd87c1f9f226ba43675a9071e2e5717b52cff957ffab359775e2510f74834fd900a09d1a596bcc32b8ba9aec21492f6749371

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cd64598449da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000059cce52c893e4972077d237b9218a6fbbec7828e90742fed83aca12c2f244e34000000000e8000000002000020000000bad2a7e66a4c8ca69089fc75a1e8277958b00f2f4e7bfe5d1c95d31bb293e93d20000000ccfd1da36364916168310bc57ce72e1a1f410bf48c5bb9b57f50681053e7bdfb400000002be47ef01bb0dc943af264fcb8c83b277db377ecfe0bd73caa6fa8bc8b05f01154b0e44ab2afcace70cc224f0c7894200553f41b0c9631c31dd9b387df78cecd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411685412"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000bb8ed7b91dae417b972e709ce88fb75edfd56e3a5eec28af55dffb136af29447000000000e8000000002000020000000f813de5b688e67d4e65d9a851007ff544ea3d1409e905e8e0e039b479c3b3314900000009e76f3b26c535293b8b24f3707c620d8ed8d6191d736151f168c36bb3c230ba73a6b8bfa1944869b52c849c17a95475c71e4b5103d59891e611776bd1f2a4108dffd4d2e28778d581a48130ffb99067515809f8cbc406b5ee551f5a3efcedd449ccafcc3c713e2cca7086b3020feee4972d5d4fbeb7a245fa37c9a1fa77215012e2e581e87fe6b4ad4b456a3ffc68eb240000000d0fc7cc24699822529499c12d889318701f68cdc489dd6853c3d7214cc5a8c851937ace0fa1b669beb37fe443cc729d72dc376af16d58b9185549d917d0f3ba4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84D9AD91-B577-11EE-BF7B-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1204	iexplore.exe
1204	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2440	1204	iexplore.exe	28
PID 1204 wrote to memory of 2440	1204	iexplore.exe	28
PID 1204 wrote to memory of 2440	1204	iexplore.exe	28
PID 1204 wrote to memory of 2440	1204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6389850cd8cfabb70b22e6ac821f8aed.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4932868ab683afeca8e66f9ab113793

SHA1
caf7e0d3a2eb6c87e18c66afd4ff7cf1d3ffe5c1

SHA256
faaa91f8aa6e4c91ccdddaf37c22ee675f1632e6bb6604f240ba5b65d985a3e4

SHA512
fc0546459b8d34ac636a5e3ed0e7ccb04c434a177c6ca5a67e9c785668812718a69cb4cdba83ee936df2391bff2fc636339653bc33fb80cec16023da3e3d068d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc684a7c8c4d08dddc15e013b3717713

SHA1
683df2bc44af11d0cc934242175fab166c5fa998

SHA256
633bd53f7faafa909686271f5682f9ac56c72748920c1978e5ec9fce2c430bb7

SHA512
a6ff714b783c92b79c6ad5b6b454c0ae8175d2686890a1789a292ec59ff341f1ea50d9c561bad2080645e7fe29d57d89e70089a9058d428f814eed0590a3cbda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11d2a3a533dbdbb8ecdbadb4e7a7f26a

SHA1
540aa9f70f6e7eedee4368c35b2c59fa6baf3731

SHA256
e451a6248feea0199c05519b1e88d79e662071ad7a8109faa5941ae0cb8f0255

SHA512
970d7ba9b8f3784b04d832bdf8761bc3cf5b851cdde487f55175c954c5a33b4e7f7e8967f62f0a7d6c5d8fb2403b93f3369389a281069fe64195970064011f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed51b40f1980292f352b496ee1255e65

SHA1
22892310cf2c54e2e901596ecad14357e8c45354

SHA256
c0366516c562e79ea3971f9cb924441a4a0256a71ce3c675035b7241e6853281

SHA512
b4db3a8a7a0cbde80a7f1ead611cf1b719087fd8ec4810798cbcecca1d0420916bfc4ca92e389f2034465ad4134b979e6a7ae0408663b6117cc779bd3b8d4e62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61a6683b8e9e138e4f61a9f48861c6fc

SHA1
45ea916459f2a88509a2def74cb96b91d316de4f

SHA256
2c9f7e3a993ccdb4fbf8320f1dfcdcfa13680799891d43b57f71d3cf5c84b0ef

SHA512
ec6f818de59841b713ff94086be8d2466111110d8fa3b429760187b67bddc82c75d85daba91eb4b907452fdb8e95f6717462dc91c03fb236e7e66079fdc0c413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ae12e2424eabf57fe10d9124b97d8a3

SHA1
33da79db48aec7b22d0169f8be8fbd480e25851d

SHA256
e3e8327af18beba58390e78dba01efb5500a6e8adfcf64df17af40ad05e30a68

SHA512
9c98468084de289963ea3d7ffff4b0b147cb67af9c2cbfb00a5dd95e02673be6b656bf2bca8292f74ed89a8c816452abdea5893b8b3806afeaf60ea5398890e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7056cb83d85e369321c424b0a16fef42

SHA1
d4187959f2117301493c705a3daf424ed52c86c9

SHA256
4faea9e455cfae00a660929ca46bb6c5f5ba1693a39121d8dcc4913e3655f8ce

SHA512
fbe787bc551de82b26ed40592b823469d6339fb21be841e4bd58296bbae62a22cd6436a9bf184b71a8362c62a4657fae29c609c4a9640a542018c63c9c26d801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b5b65579841771cee3804129294f17e

SHA1
9c78d9d7e6049e0e728360e80731672898d94853

SHA256
bcc1271c3208516d51613f6799ea31d08a7eaacff2395ddec50d3685a2208126

SHA512
ba08805196d3505149e550d75516056aa9fe6f0e9739c2504b3b035e52179a42722cb7777bf57997134f81b8bfd93ec33e585c5131010b08199fbe2a8701af12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46fbda3495e24d57f0ebe6bba1aa9559

SHA1
a84de5a3ddc29c9ad2d213e24efe2b5c24bb64f2

SHA256
73c645f0e92355aac65a6ceba5c33811ea8f15a3a388f8fcdc5fb73fd13a73af

SHA512
5a62890cbf3c90368594cb50fbca93256496348810726b52b45701f1f02b0a1721e2682501fea4ccf4d766be828474e979491ab34d5c11e8fbc395fdf889c014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeab5c061a6a482c57f24322056407a8

SHA1
608c69de0c74c4a24f2ffaa110fe9379f8382645

SHA256
e4f0bf2742f0c9811dff0e341193687b1fb61912aa020fa14edb0afcf9e1459f

SHA512
716e13d1b669756e59bb8c26ec552c74fa2e4b46593e14e51c1ed0d57faf18e482f70d5e3770e1d772550749e49228cb71c1f3d64d540bf6eebea2fa6d65c7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74551d6e29d92e56739f80bd7fa78377

SHA1
96538a0e552d1a946ac575f504c954e4b9103b43

SHA256
381b7a21afefd9437ac51631e92a6789d1b7b3d99ef8ca7e333d8251352ab5c5

SHA512
4b35e743cdf0562e339c59db80b97038126f421245d2c2613f97ea11ade537f2d51302791cd57b0890587d6caa99f26dfb036237e036a63c67f14794ad368c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
021aa3d21d6cd0d1b4d687140c6878ba

SHA1
200991156891abac549ffec4445a3d0201d703be

SHA256
19a6c89dd3c16093c398d4d90d2fe8cc8a78e41c609e9f38ea3e2e57e11080ec

SHA512
2c8b953addba7cf4ccb73c0d1dcb852da47b64339a39b5c6aadb8e6f9e52931940ecd6fdf950d10f4fef6a2846f53914c797eebfe0cc6e0a266c2de8995ac9d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60d3191bb445445eede2bf9af6ef8358

SHA1
1e79c69cb311e541fe3b8fbd79af3dd91d1460f6

SHA256
eaaf47f0c736960c57c16392c3ca147e6ff483fd3a96cde63d8a46a95edb6dd2

SHA512
d3e5b0fd8ca91fe8ae0c15468b03acd23f42125002a732800b65f7459863b247bbebdc71f2738f5e10c43b53fff96c2a8445fac599e2c227aa08f6bbe8e2521d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab50F1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51AF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit