aa0c09d70ecbb1767bd49b505d3695b409cf1d4e7714f644f217007f87fa1ab8

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Play Voicemail 45 sec.html
Size

447B
MD5

8f846717509d0edb73f782417028983a
SHA1

3f13220ed4b125d11bf4b3d28e837569f4f82cc6
SHA256

aa0c09d70ecbb1767bd49b505d3695b409cf1d4e7714f644f217007f87fa1ab8
SHA512

5a509ab32daa6244e5d7a5fc60ffedbe471a4c30c574441a5dd5a4b86c978a874d5d1311ca77b91db45db735060535c2d6743b1ea2e3e4e5a684225241b9fc5e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07d02f61a5eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413949119"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000280a98cac76bcb0d75294e4d77b2c46ae1a05906a4071e28306bbc0558653f63000000000e800000000200002000000097f3542acbbcc2e1d720bb1ccbe832657b08e8b02f3c633a8e564167df50864d9000000039c9a8e08e0ec5120839f9455e2358d322e2be4b60980c2954f4855467d15a573dcf7a313a56a8f369fbe6793730923aba7a8bc7a3ddc92f6b0331eadcb42b2c81fdbd48c8bb687707c3243bb20c853ee801c7869c22ac36ce851dd8b91df89b84155055987853fb677f03f192d0f0f625e990d7ed974e96ba952f033727b70d7f3306aecd70f79fe1c28fd64fef58a140000000b7233f7016d7497373653f478bae393f2a669b637da63e147f98a1cd738ef3973f4f522964ea5eca026f1cc77410700c9c1c85273a7d81dba526ba15cb6141c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{202C7F21-CA0E-11EE-A80E-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000dcb29c3f2661af1e087c1c1f8756814d4539541cd5cb0a10a3eae020321c9a82000000000e80000000020000200000001a206a7256524e3eec44721cbb89345249a9e7eca08773c7ee5aa6229d6dfb79200000007dead2bca2447788a03fd58365af6368cd916fe2512ac564eb6dd5a1f21cb7e340000000a8d56c434b2306deafdc271b9c5bfe6299a1937d638138aed8abdae714d6af6c504cd6d5c61c3fa6227ac0e43d1b521ffb4b94fdb33f3352e20c8d35856e114a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
624	iexplore.exe
624	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2672	624	iexplore.exe	28
PID 624 wrote to memory of 2672	624	iexplore.exe	28
PID 624 wrote to memory of 2672	624	iexplore.exe	28
PID 624 wrote to memory of 2672	624	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Play Voicemail 45 sec.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e915efc7f30282da3eed45eef09e950

SHA1
ed935562206f7572f0644efc06368dca08b4d4ae

SHA256
e7797a75b73ce1aa3a8dcce3bddca09ae9b52502d266ec0214c7c5a442880018

SHA512
4220564d92f9186213a4d55d2a8a09ffa7b2e14fbfd67f1a0a07f2edb8e66a373a4e2904de70eeb2642086c5798dcdafb4e22efabc7be61ad1e02d8bcb64b8ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c08cea2fba0875d3748b6f90556b3dc8

SHA1
852d7251dbd653ebe98bc776cde443196a084afb

SHA256
c7af9d8c900e8c25061e72e8b96a18d8fd790390991c71d626617ff53e86e327

SHA512
ad352ebffe3214f0b263cb609c5c8d3f951a515d3a60138dd8e4da865122f1d9735a587d7e556c8cd2c57887f3119c747ec372c35455275c42aaa031e91e15fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4c351ec3a6e8598d07014bff1fd34b

SHA1
ebdd815cd7a9f1182f2ed936c82b728bf40f3a7c

SHA256
f14f20f4c87ad62be851058a165ffbc4b25f69e2bea006083317a9785ccc8f20

SHA512
12527cc6b33817a7cd11e8e367d876eb1d52eb05ad60727bc3306607beb415ea660bef75ba4462b543340aa733b80578444d7bfdc64094eb6242632644548358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dae2370b7c2deb6204ff2a8447972340

SHA1
da249216b2e9a0fb6679f37d0835264743f3ad9b

SHA256
f28901e2fba4706d0be0b834c794d0c0cdbe8fab4d052617c63e2ca1bb845b1f

SHA512
75816347de252edde7aabe266b5d7cdefaecad9b2094b4a1aac778315dcde4c00a6839bf90e8df8f70febf8294e7979e41842748ed3ea520d37040ba31777d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24f693956cde50ccd7cfae32a9c4da05

SHA1
e5c459ba278e9b6d216b7a1f994d857d430fbb65

SHA256
074ee50cc8193709ef353210857c86dd68e363e2468cbf34601500a1a64a60f5

SHA512
06d0f4105caa0bd2d882c52c8d990cddeead94cd36074150b784e115d6d26d71f55c77f5a65c279f08297b0688a66abec07d56b5fc2d42b41d24ae42072669c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f00afc6949c862ccac0802f79d1ffe4

SHA1
e93d43fa0a5c0b7a28f214c1da2b9d8aed908cf5

SHA256
ebc27fbb15de7b2798566996b516eb0afad8982c43120d25226d28419fb43642

SHA512
18d0fc47aea2119270c3a1fec29d9b3b64e20c175b3d6fcc95c392eb54fe04496a66a6ef2b68f193533400dbbec4e098471bd9905f4001345e176aebdd491979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4e7159c42c213dfab7c8aa5a578e112

SHA1
300543a636180c6b532ab0d681ef57291ed4dba4

SHA256
31f2ec6670b1cd8a87aaf1bfdf7fe5e40301a43d764fdf6540d4bc15b0dc1644

SHA512
dd88f5d99e8a4d6e479cea7b719ba459fde31fab0e8443339151c843112aaf1a175509431fe6cee1164e48ab787bc4a631a08d30592e6104b00f146d01022298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4baaf54bf1327c3216a7539bdc17fe8e

SHA1
ad021ad35e2acc9dca48e2318c3a16649f7e7e18

SHA256
4484b80c1a80a6b761994d4149c29185e42f54ee01d6c2f99e26b2e7519444a8

SHA512
85688298c96d64201035fddcf3d0dc335c428c2f83c632fc03af5534464f491a351fd74dcc52d150135c4fe956b9ac5088239256dd4499b39bd2fdef146aa1f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7670bf474c9e091a484427ebaffd4f30

SHA1
7790a773f5724f47f5ca630051d292cd2e01b818

SHA256
ecc493e6921320d2f5cea3f23f76d2cc13c8d5bc84b449e4e9abb03ed4acf45f

SHA512
e1aa552c0ca765758de1c741bc65aa282d84c333bb562a12785aa2e71a133b797fa6908763b94bce8e77d3c7c2cb3d1b4bb9d4ae291c946d3cef585b93dcda05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7153cbe2ef6ccc2184c8372634f0c69b

SHA1
a251f887512e47e4d0cb1e259ccbf184cd5f72ee

SHA256
407430b35d5888bc81ac7b52eabb282b8ef6afc32d0ed4048a72b0a3f1987eea

SHA512
946df5bdcf5ccf92441e358c5906df4a67b847909f9d4818d9d0871813044da03793266e2013a496a5abe008817f0b6fb42395951b51354008d3020e40a7a30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f27f4411c87f6cfa7f27beb958812ab

SHA1
c92ffd1837c382efb981551c13d37096ef1182ea

SHA256
96a29d8a853421006587da83d25d7961250567baca509c7ab86f506571656fa8

SHA512
d8f721164990298a98ba466a183cabc656c34960821ffbf5713014c8097c8d4cf1605c68ad2a2bcfb280639019d89534ac291bebdcbc23f73a622b5d57c82f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ede667b6ff7171f89ed994f3a7eba4b

SHA1
604f6b27839740ed3467f58c517c8eaad3d6f9a0

SHA256
d8542a08cf4c868799040513c5162af797f1b6bd9f67c167f5297e27a298f41d

SHA512
912ab7db494a5be98048d67f2377dbecfb13ba5c2879292d02a6545ce49dfa8a832e675bbf2fa5ebf5ddac9e0dfc17ac4a29d984a86836c048eb471b89ae65af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d741a852c22724460e470527f8c36b1b

SHA1
bc2d4f88253cc15ff91b6b7b9cf1f35ca2d31233

SHA256
94f2b54332cad00479f8e7ae7b43a2731c43ee0c0a9c75faa41a80ee3dfa6bfe

SHA512
bc4013f13db1a8ec4623a4e7b6da37d09a8ec9fed169b34b785d0db37ab41fea57c3530f89e39f6fa5d4330bc9fd17143316a6c8f6c3aba5fdebaf7cfcd52e87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd41d3f94ae6b3242342f951f6a2e344

SHA1
630155fe80af41578d6f5495a0ee81ea86c0b218

SHA256
a82d13088f8d4cef749dc5dc529cba683cf424121fd58fab766f6faf03eeb1f5

SHA512
1c396f9a29d5262b357c91662f7ad073fd8a644550bf54e184c6a7612f8fa084cf70068c10b5d18e566bfe27655ff2e3fdbe75f0faf73a3b376ca0dfb22ac23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00164c7f7a7f6394eaa3ee5f43e1e2ad

SHA1
dcef222850a31787de0bbbc92c39def14d34e632

SHA256
bd9c380311c4d87c904e5a1cad1bf4b726119aee99f71b7e670f0656e279fdf7

SHA512
79a4b67c6399e93cd6ef9c4b3d50d9fe1e9e5a60e21cb6c3b0f7201ea925b0a64441ca85a3fa502f1b3b4c966f415d0d3d83e19a23e03d3d718149e015d7ea24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fe092cad034c65adfb3c4f4b8436a60

SHA1
fe4997f7a54cc6c97a03f1865fec257507ff78cf

SHA256
703b59f4951dac76af4ef54b51630acd0c4a087f6763db4772fcc8e84b1d7cd9

SHA512
6db4ee6cd72b83387001adfa7e22683580dd2bfa696ed3cdda5428f9f1e614ef3ab09bc32e66ebe9e83f0f7e85fb12c5ac33705f4be7b5d6c8e7b1beeb841c4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3279.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3318.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit