f77e37518d52b1a5834bbe53a4981b05d8e18721c839ee25a05d10b9802dcb14

Analysis

max time kernel
120s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

746B
MD5

0a1b650f58121e9248e8bc3279c52e03
SHA1

7b707e10ef9118430e7056d49c0581ceeb7f9468
SHA256

f77e37518d52b1a5834bbe53a4981b05d8e18721c839ee25a05d10b9802dcb14
SHA512

4a6e72283a17e197126dc30e66d62fbe3cc7338efc094e451775058a2f4efb6c5667c5784032468edbb6533214ef5e94e0bbae10cf3a58fca6ab6692422e08d1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509b963b05fdd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403274506"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A87B7B1-68F8-11EE-80F7-5AA0ABA81FFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000074bb75ae8e62a7fca362a6272fdc1b1965ddf72a1a76e75d799d0bb39d1c98f7000000000e8000000002000020000000e4f556f3fa952390204d4e38504e02a4bebd45d4d6d0986fc69624d70eb39d51200000009a2616d4727cdbd8c9aec9dbc4920373819866ebb4f1dfce7319a442c6b54f53400000006bb70df9e082412688e83e3d87caa23558ee676662107bca25ae85e1e66ded78e6e77cb7c3ef1ab86bb3fd08c8aba299383f3affee73852f3659a06bb8ead9b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000abf8a6898b4a12365b6974a040c95b54ebaa7295898dfc4974e206c30d89babb000000000e8000000002000020000000125267049d834eb387571fca94ebdc5bdf108d6100f49a4bd06c88408a2f72ee900000009913576b93e670ad5c0275f960de46dce2df8e72d76d3b09879c3996cda9905103b47ef48a37354a922cd0370782527ab480402a6b62f56db07592572cc318fbc663b1237f5db663f9e4a2b3a5979013a845e11138d38779d3344a7d6237f2585ca07b4727902f3a6e8c89fbc526f0ced5db229ffe47f21523361c0707323a60306e75ce272488e129dfe5152bf950074000000045120bbd6f9ee25f79042a04ca488bc316a63d893f0366876a57b842ed7780ed110012e39a23f97a795b6d21fb1e9ace8f1563af0542a2941984f57118c6437c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2056	2752	iexplore.exe	29
PID 2752 wrote to memory of 2056	2752	iexplore.exe	29
PID 2752 wrote to memory of 2056	2752	iexplore.exe	29
PID 2752 wrote to memory of 2056	2752	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943071cc9f1b300cabaeb2701b8f5f60

SHA1
74a60b8590b6a752f0af636bcb0c131261740ba9

SHA256
d21eea26f78c3a533dc91d8a527f5d19644f0e7e37f188b9bcf300df2428dfee

SHA512
e6c6dee56e1b06c0add56d0121bfdc7a27b81dc04d571582210576eee8092c272d26e6cfbcc05cd8f3b5b3acb05cba72d8b3c364963fa424f19ce3cda6e22da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
061fb94f903b2c476fd2433d94cc32b6

SHA1
9148de9beaeca2156554328ad42bae25c06de10f

SHA256
6e6065121713634c60c45b9bd7e9629cd1d8d9f67f38b2948bfbfb948bd70969

SHA512
348b124712d554c634ca44ce5aabe8cc703404e88eb650a455ba12d993aad7ff131f51837bbb5977891d6a2073aab8a7e4d2391d84ed1a0f86a9952f15436397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1799b57c5b3c48455b4815b04847fd3a

SHA1
794686ee649fd0373860c55137d9d92125a142d7

SHA256
ec89fb5d5eeeb5963133670d4ce6a7c4bb514eac7907840bd645f11427af46a1

SHA512
497162c50142e8fb6298142bfb883ac6d16731cb241b3ee6e2466adcdacba86984d0fea22c0af9e2047a5ad5e5311accd9c4d9154d579121cc88402fd451edf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02e518afa0d382c988288292caa7a03c

SHA1
764fb6fad9a87dbaac3b4b783fa3e33074cac32c

SHA256
2ad35394001fe6466034c77f902fd08850bb517e160d19ac24846af8b8c6a29c

SHA512
16aab61e14d84444a573cd8e46c8b3f2be729240af4d046c40bc39c4021efee51e00a46ea8bdd2fdc0d70dcb69589f5c54ddb5da989f471b66c4444e94560623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbf29b45a0903f1570e5ae8a427cb406

SHA1
d33d661a356da39b52da17fbd2bfbd780214aaf1

SHA256
1e61ab3d264eda4c10a1fc14948f34837e8a4845dd9f115aa0eb3d1d12a15170

SHA512
70bbfc3bca0e8a617ea100e88c4ba4198b270f8448ffd2dd195a61e732993cfae7caf9cc8af73bd2879ea761b2bf83d77cfbdae3426e0382df288cd1a35ab45d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
365196b57d1528f36ad05998c7e9de5c

SHA1
3d4f425551f58653add53a913c2a0401b9ada5fa

SHA256
88c8cd2fa6bd430ab6e56bb25eae3ae093264885413a52b4c58862ae3fa25b0e

SHA512
99b69570073ea96706ac2a43db9e48908e7ac59eeb27690ca3ad5b04fb9fb01a70aaa4b72600f987f9d6b618522ae4c0a6c2826fed745492d84296e016dd6525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa12a6e3a743372a36b935ad2193c157

SHA1
ecc041b979e4453399799ba692a5555f99f2e94b

SHA256
d6b0149b6282437142f1f2a2b484b0694d3362085c9050ee998a7db58ae6db3f

SHA512
6b4f90b9136430c6863c8003db1088010421c0d6eae3a05ee939a5b82825a714fefa505d2e822ff5aace15602aa76366c55439cd9d450874622699057a58c734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9597ab139dbf9acf23822e74353ae1de

SHA1
1e07992bf3ebdc7a5955fbbcbdedb02993a805a2

SHA256
af6ab0d7f0c77807673675cb2d348b6b4ca705a7a7be060a80e6c4d268805e9b

SHA512
9f78732af6618e1a070a951e09c6f8c742d49f42b8f63b0d4def5dbf055657a14bf9eb2341469688cf131a91fddfa4e09e06d18a86a9a817064de51c67ce9925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cea2908ee90d1e42c55ad6197a19f08f

SHA1
804198bfd653a93ef3c081ed19a593d65ea262f9

SHA256
c0817e2fc7cd016054f66d66b933fdc4331ce840dc404dd1111b9ec54e25710d

SHA512
c59be0a5ae4a04d68ead438273d1dbb7e2b1ff94b974b4e89e57333cdc5201c9aabf9a6104b2568c3afaa075391908891c41d6b79b1f2eb8ca9d826122f4e440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f89ae4f41213f643e8f054e9fb00d627

SHA1
7133ac2be9d1ca0d7034d0262303ae5a06bd8059

SHA256
a63bb39c4da4aa129dad95997513fdd915a71f29444365e00278c927f2777e21

SHA512
e3e1cec46a4efd93eb2c0305b93ccecf14149791493035edb188a6bc3f5927467bc68c50ac798861f5682d1b8278f443b42e677c6bb33e4f4cfac42c413375bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b2f380fcff81654319d0445e6380623

SHA1
c26d2e6c14ae102895eb44da8183e2d684a50854

SHA256
fe940470fc27d797180df6b5c4ecabfc3df6eb155bd897e31aecc310af6e337c

SHA512
79dc5110d1c8b4babce5c6a2b309e236038082e216a36cfef0580ef917a9351adb45933d1e4d81996ef1ae97dc533151441cbfb55757ad64a10dc0e911477949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cf06100287146a445804860a10c53f2

SHA1
f39fc0fdbd344f4de362961f1bee27211d85c750

SHA256
c021fb9eab5046e7bdf4446396b846516021832a37f85db819d576854beaf090

SHA512
ca082668fd1cece71478825b51f676195b80fa73d6ca58f13509cbe40d1eda0f9e20734156f465c16b588b4dcf5dcce388d394a5908f8b293183a8d668f383b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1105cc5f62018087129138c908b47331

SHA1
edc0e0ff0fde03aa0ff7f72175945bad01fac4bf

SHA256
3669390c62f8a509e8c6dd57d997e72f61565772bdede248740d3ff207f7612d

SHA512
9fe84a4779c7585c1c33f17faa0e754d48b5f038ebadc0531909bae90e4316c2d3949e268fd70c1df6e6564ddfe9b13e85fabf87c9acd56aac4351f70bb92917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c37d7ce956893494f1fc744dacb236

SHA1
afe69e1a78510fe12bffcb84d76d6455ef865cdd

SHA256
084067deb6376a969a54eb7b1197a4620cea875bd0ec4d053bc16f734b598cf6

SHA512
1d0d97bba811394d9a60ebab6613eb58fd3655de94c944303b0e34ab3032c995427079633fe930dc9f6870ee705bbe2ef78bb54ed4619310d760fdcd8079ca81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48e1cfc4c6f6c44ec17b4956d533552d

SHA1
68b9e0ca8a43e786ce0f4447b5eb9e2d7b185fe1

SHA256
bb23c5087b774abc69ae7a43da296b39bf60ba7e9fc60026b648781a419d1449

SHA512
f3589b39aa9f9eba3cd80a517ad4883d97b5f359604ba97a0306184b157ec0681748e20565d2ea9ab188f790ff82aef91fc3d3d63f43aef348124f95fb70613f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aea85225b490f041b2ae7776c07c394

SHA1
02c78bd1afa5d4b4fd776f926937b9e8a9f4aa13

SHA256
7b654c445ad1078f6d4d97b51a345ded7dc80fe9e1ab738485ff20fcf7a4be75

SHA512
855cf08134556a420bd106ceb15034f34a644c295128c4cbf851445c09d2a58bc7d3f0945d1fb415649d93f1cafe7c1ba7e9cd4af722a216a280682a42a1d12b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1982666f36873765976e387b01a2ef2

SHA1
ad44754952ed95e510b2eeaef121a3e135328a2f

SHA256
82e17bcc63099938bfef265b3a3757ef8b4115e1a412ba7c3a423fee3f4f59f0

SHA512
bd1198cacce4952e9f4766ba0c51b90aceb985c0b19abc808af7ff7ad3859d9fb10debfcde2232ae906334f405f6cd46dad5092eed8b9bac249044a8c5e3606c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7EC2.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D67.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit