6ccac9cf4763322d341d076d29e158a6a905e0aa8c6fea6261c0ac17c092a597

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

581f7e257d2ab84c5f47d83a8e30b31f.html
Size

14KB
MD5

581f7e257d2ab84c5f47d83a8e30b31f
SHA1

cfca5fc0be08d5db062ec2007fc8ee0a421a9aa4
SHA256

6ccac9cf4763322d341d076d29e158a6a905e0aa8c6fea6261c0ac17c092a597
SHA512

0e1a6d2c0b17456ebf10039aef624a9fd23a528d56f581de14225fd25bb4eb0ec7d01730c2c58d43e04fa13ad26f0dc4aab4a6cfacdbd3700f877b144314ff9e
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vymlKt6DvE:aioWD/ZmXg8SZQPmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A32CFDD1-A15C-11EE-A581-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000076e6f56f26732eeb3c29c23d9c0a6b79073918d2570ae9df5ad8c756c019baa4000000000e8000000002000020000000d312cbfeb1df4ec4a1a983da7367c59ecdf2a2d1ee175cc9cd231d2739694dee20000000d9864a8f2481240145b52688e8e48ce209f8c468fc7c8bd52bcfa8aaa6a6dc1c40000000870c03d5506156029b5f676f195bdea396d58d9453ccf7fcfebf3f5613bca546f57880168ccc085cd53efe08bffd1777891f9c756da580d44c3ad75ae5ce9d8b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409474842"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a66b786935da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000a4382a06fd5bab1e2179a56d799061d786f53d3dbd8d018e911815d1d50e3575000000000e800000000200002000000018db9e0c2cb9012cb2082f9abbe4dfa91f66e193b9c80a55c417b347f3006b1290000000d2f9d50c989dffdfc7fdd7dbb04fbc1cc9862be2fbb23f1f087c4dedcc42fd9ccfe91b921eb3d28311b9a305d42b0fff5618df1573ea245598bcb0f66df354374bb24054da42d529798065d6802d426be97ffed200f3a56f9fd25a4546ebebe085df55648ece7212538f597ced89654d1e130510816a78cafa7086a99a1d2b86c079c6924946609cd47515b98f37bed340000000ac2f4290c1105e90aa0ec52689a42249bb9e01ed01814e18279fb11584a71eecbe8bb9592ec8950131cc7e75fc355fe5e179e3841ceb1043985ddcda9cb9cd04	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2692	2476	iexplore.exe	28
PID 2476 wrote to memory of 2692	2476	iexplore.exe	28
PID 2476 wrote to memory of 2692	2476	iexplore.exe	28
PID 2476 wrote to memory of 2692	2476	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\581f7e257d2ab84c5f47d83a8e30b31f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
797dfed9eb7e5ccb406272efa65278c7

SHA1
c4d3b07863d006a2dd43744b369c1951ab70a18c

SHA256
e3bea54b2e0cac1f468602b141ea447693d90484aaec5fda36b7fb46f664d8d7

SHA512
0517b8baf5f329ba631eed818734e737a430aaf1fbdd6b7195964cd1af77e8e21ee157b413e050c6ef3959722efcf025b12195114ed153735fa90535c34db559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83bd083fdd8d18e11fe6a41f3212f1bd

SHA1
0dcb0d56d245bcc2ad3df9bb81f654feef57d0fb

SHA256
cc6985e4d18292bffae705834e9fdfefa8c08d409356b36c284be70abccb18b5

SHA512
b737e42af7d7f988f78e2bb289129ac013dfc88eeec2c49dec0e28befed182ae0cae3d7812abed99e7d58331a74767cb60754187fed67d74c0fc08541db8b01c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46181de0b8ed8d3cc3b0d11e75bcc713

SHA1
22fbd4e6452f51d5a7425856d2f1424964e38907

SHA256
b85ff6bacc6ec6d2212d67329daadf15805319b84663864fa02154ed09620ed3

SHA512
8395ee4939125ba6e1880fc6a3cc6ac7e9990c314812fea3437913712d3e346172fe1851c27a794b61529c50aca15b8e2e407af848c51aed8d368e6b0826dd43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d095c9c281a479308523363c303e8a4

SHA1
d73552c7d6054c9abb80e3aedd3cfae9ec072dfd

SHA256
1879c4579a2d5022c80376d774118ceae87dd997dff6dbe1836452e73bce4032

SHA512
33ab61d88b1009bd3f286a42ab2805376bd6ebe9943164c7eca6a46d88e37a82f8ced1aa138bd6d14a5b95ac0a0a76d3f3773a4222ec02e44512fae0330af487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c114f6a6a2c6f65673b6a067af31e455

SHA1
7195c236a80be552bb72427fe96ebac4b3acde23

SHA256
79000ebe8064073e1f4800906efb293c16ccead0cb03a3862e1fc5ca9ae6d207

SHA512
b7fe08311eacf47cc99aaddfb9c5fdd436a80ce4370cc1054178f96cc495993681c2dc882dc4bc6fdc044530a5f26e33088c28d6a2492e0d85d4e5e791c35aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf8424513c76773baea5819de9ed7f7

SHA1
25057f42a17b6d3635b908af729eaa5360914351

SHA256
08013797dfb5ab88eaa2b1f33bc57cba1616c963c95328a2c7e3df7b64804343

SHA512
2ca53a717e24a4f334058953dfdb4f52edc99be41a6724da0e259cbfdfa632f793c03812aa9b00f8be077954cefa4f76df5948d551536d4556687d3364d7c35d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66dd08e7d688b89063deed126c0d0597

SHA1
9bfe0d47968a7f57446406c07fa7f9deb6e9cb48

SHA256
3a4d3b250ffc625dd39c22d3b5bca832b571f7419ace3d909343b0bfb7e066c8

SHA512
0fb73d2d5da6e72fed6c54c341f4e764aa28b372e99ab0fe05b5e5c81b11c3cfe40c91c68dcff8b1e9a69ed0630402298229de673e9bc312704b569f5ee6330a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93cc0b3e7f433f631440faac0bf68009

SHA1
f4b476160ea2c1900c2096e73482eadbc327ec8a

SHA256
37b2f8d75a16f1cfae0014075ea7c29e04fe6b5352f1ae215f04f18868455361

SHA512
d3c1e1ba12e2d9fa0734c72727d4fc746a4e7e871e851ba6846d450c7bf5eb6f24e2cfcc23de7ea117dce992f304453e748ec70899085520fb314505066bff8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6983389daa0512f5cfe9ed7425fce5a

SHA1
bd649caef9294072b578ab7df896563d70f40709

SHA256
6cc8cebdc9e1e58b3c332b3bf0a33c0074a48d2772e21d6dcd8d0b86c812da05

SHA512
3fe6d62990fdba6d26dc2b3859a6eb2d021929e2de246da36b9decb50530887625e0425801dd4afc83061c302aeb91480b3e7278a6bdc820ac5db24434c5dab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06327f35a536b2774f4a5071d49d5ce6

SHA1
4b04d8548921c4d52bcf36a6ff24c916cbb21d82

SHA256
23323abe3227cf95fcee2651a5c3536732e7a3c303b8e577b6d9d0f8e0ecbdb1

SHA512
6911e14c199232bfcd313e1e71dec95ddcba0b952bbf17dfe4e2d5c715df31bcf3946eaf8999f3d74b9784394d4de331b725d070ebcdd8a97a546d00dbd29a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518d9353e85ccddded81abaad94b4965

SHA1
d8d0eec4ece147ccbc0f7d58c2aeaa15cb4b0608

SHA256
3f342f5a3019e14a2ede124dad65712df4c2a23b23c0927def2c4ed52727cc04

SHA512
5cd333194619bd4a76048e99dc699037d4e7d74b547bac3173231fe972b7240b895638f1dacbeb955cf24bfef51ce5ade2c9ee367d07746250d0f98525e1eaf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a0f56bc0e241ae17170b7b4f467bde4

SHA1
35f7cd4ec849745fb72e867ed7333f8ba7a43cdd

SHA256
73822d7828778cc0da01bcebd68dbe660ea5dee6d6665ae3738059f6d32fda94

SHA512
7d48d6a2188d0d929c3397ec6fa7a8313ac695b447994c62a98195e959b274a779625144c26a339e7ff68a3afae4c319d29902f29d74369e7b9c5d74c1724ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
684c525e936a5c2410b5174d90a9029e

SHA1
2d15a747bb4df23edc66891b0a1e8c1f9ecd42ca

SHA256
d73bbe9f6a043110105a797a8c261928f64cf9e84d6f30973e38b32b4da1f16b

SHA512
af2dfab79d0a65696d1dd9fd01dd3c8e7e01145d3dc3ea9282015a22d657bb5c281fc82123b7f9efa98fd5b347656e85ba368bf104e53b6e279423a898d9ef70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2bf88fafd9f265ed4eab64ea7d96573

SHA1
ba31b4f906b4bfa3ae5d2f0faf0e44315db0378a

SHA256
866731202ec82f13fca963a04b65009ae2ddc76ebe03db8ff258b55088ea8c40

SHA512
99d68a92646c8c24f00f14b3f9dd7ea16bbb7c4abf29403c70ba431f9c5d8c00432fb8f1a49ddb771c93c84810c90b8db750dd40e3ab4efc65e153b9d7b23cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a53d434d54ec4ae6479637c62ec99277

SHA1
8784d68114363312d76cd710e76fc75dbe0ee9b3

SHA256
c101d70a4bec83d5b2caba5a9bf0bc71699ddd9e9015609ec2fa5c7b68f70afd

SHA512
76999663ff80bdaa55e40a4fda36991cd5cb3e6fec90322a187ade584d1c4781d39364f3ae922cd028f602aabf21b583ae1964cb1b1deb59727d0026679d4159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bcad6e61bc1fccda4757176ac442d7e

SHA1
6f778d44a11a3ff9243a0fd3d5d28e2f6d394214

SHA256
72f07270920bb477a294957d25eda04f25b19f4ae544b0e6341282dcf95b45c9

SHA512
0a233032dd13f6288db4006f03902a8c53b5dfeadc47d767a03c0e236cd5595348c97432275eccffc8019f2308dfeba848ff7acaac7431820d308a79915fb123

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA1CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA4BE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit