e791eae890258c909ec8a17498586ecf436a08c4b6787e7a336f1c2f3672822e

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60fac65dda5121d1ca74fe2e87109678.html
Size

1KB
MD5

60fac65dda5121d1ca74fe2e87109678
SHA1

ee3354576f746cdfb8612b6a4de337967edf5fde
SHA256

e791eae890258c909ec8a17498586ecf436a08c4b6787e7a336f1c2f3672822e
SHA512

708354846df39bccf548b45d7afacf9372923ad2e8777fd676913c6b497e94f4dc21347cb3fcfe9d7624c8d0e14d6b454570bcc65f120d2a4ae9a8262f4c4ebc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02e4ba47435da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409479669"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000fe01a9ef6e4dd8103d14b2724bbbe723c841f80714f5e54f470236873c1c04f4000000000e80000000020000200000007dd9e9c91b37fed73f38a04f5f55c1929c6943e14b86e0abdd40566ca624c66290000000e64478c824737c621aad6419694178ce22d173bca36ca3d7562b17ae69537d5ed41f6f3fe6119624f7f94c4211d6f665315fe141e78481d1e8a90c1e0470d22aba6fae1b41274b94037499c885ba179925747ea91b0d5e17a83b6f5129a14fb6734b437ea70d07a1dd28b184278615f6768d6b37a0733020c2b3072b322c748f2da26d23d937291f89e6004ecb58158740000000225a9e031e40fe9a9f42e62cedadcd4eb1f75747e69cd9070f71b773a0a9de01ceddd716a9bbb0264c01872c4a1633a48c8353ce8ac6d5488b2155ef48599467	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E06A0521-A167-11EE-832E-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000082f86b6d51dbfdd7bda6a35141b47d22b3d430b910d8070ec0b53db09ca1536a000000000e8000000002000020000000f21f4a3a1318890f03776b083213753ca143d4ffa35ff2a25ec7c413d83d371820000000790b98136d3b38011e896e5a7b427c8ed3f9259a88596732fe5a3716ba3407714000000069740fc3c4f1408b6710105108cd463f2e7271811c47585fed4bd40c60a662422abc0ad214e1478c8a7e61e2c46f4ab087dccbf7e6a0d7136e0b33a4ddf05a8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
816	iexplore.exe
816	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1648	816	iexplore.exe	28
PID 816 wrote to memory of 1648	816	iexplore.exe	28
PID 816 wrote to memory of 1648	816	iexplore.exe	28
PID 816 wrote to memory of 1648	816	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60fac65dda5121d1ca74fe2e87109678.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:816 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c25a41710fd7d258c161697beaa7ed63

SHA1
b0c3fe5596a465997089bedc8b1effa535bded4a

SHA256
06ac52df5f8da07b4b609becfa2520844aaba0ecf89e4ea9680d1e5bd2c1aead

SHA512
9456bd5cdb4cabf2637386a6aadb4b4804f9b14e48835e29bddb3653703623618c5c7853b2d84298cb5bd76014f17bb86d4b4268421693f5017ff692ab2d8762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e83316286eb352526f88b279a7340ca0

SHA1
ef8cc98181895d5d8ca5ada8224644da39753e60

SHA256
510c0d9aa4c168387bb01fc5a5bb00b9a00bb093b17002d58614bad35cf5f86c

SHA512
8488af462f3b3b90be6b1e8dffed560aab6c86ccd73b2e899c17da434291d18b9eb4ee23119c540904803075df0f120f198855c942d2f73508b4f0e0901df59b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f049cb81138930bab7802c3d436f8ca

SHA1
c045bc1ed6a31a951ad6449e4204383badfed549

SHA256
003983c941fbbc8192041a242c7de8aa7d5ecef0a2cee37ceca7ed48b48666ee

SHA512
288c57263ac4a7d94170c85d3e3704f77ee8029cc0ccce6a37a7617418f964db194bfa8a0c0064e5c192fe9386f5d751c0efcf81f4af34b1994053ea1c11f76e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce829184827c4fe7afbc48d20eac340

SHA1
d9de710a55d05b1af5f471185626df9ad480a8d6

SHA256
712a115c2be8c5e2c95813b07980c600cf2b6feec4f10e80845f90c909f4e785

SHA512
f683eec760b5a4cdded0b063fff96498f383852a59823b894e21bf37af74cb936fdc81542188b19f79bc345e7bda1ffae41bd8ddec60621ae4d6ed9f0dfe3aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25cced56fea4313763756774035f05d0

SHA1
431b880cf1ef8a3bcc124c461b9b9c2112d1cdde

SHA256
25e9234ff041f1bbb55e9cee35080222859d680aa45c19cf7f7a39edd6f8f968

SHA512
febb17a7ca7de70b1ebae5c904cde40d74f4984093c1bc5508c3631ac3af827d2af894fc6a718a0b055f439a5fd9f6135cf2de4e1287bc9a20b7bb66524610a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20d774a1b900cb25961eb3cac22654fa

SHA1
803406b0a94423fdcbdca9c9c8cc10802f930591

SHA256
d262fcb01bb29dcc3c5668704e28f5780ce489b3ef0e17500b9217cbddbb8fb3

SHA512
579df7e749e4eb67af276230b7af12b1457d99643e3ea482fcf7ad47268c991ad7b9ecae903ce9dda9128c329d81ba8f3f37a143ca3b1e387488b46e8e9fe799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d88b24cfb074447952cf45b189703285

SHA1
392f26acd6a9c549150cccc116f277742d1012dc

SHA256
23219f5922dd8c3fcba5857c49b32c2acba3800ac5131935e9e7fb19a71601df

SHA512
0552d0fecea5c32b666fda57bc5fdef4c08a06228107e3a1588ceba66c8515254879f64b633ee8a77f70000614ba465e68a91d17b982bb1bc8e2fcead6b991b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b94722eb9f5b2545de29df57775135d

SHA1
ac684a1f5dfa46816714484996a412e6822555b9

SHA256
45d4f91b1e5ced853a42aabaaa51db545cdb928c13a7c7cb0626e8c71effb289

SHA512
3f6347de2ab190e5a866d7ddc7eb9cdba2bfc6a23f8ec63958d09ee7afeda64fd1d162e418b65ecd5b48acf4d5ea63d83ddfbd8202401feff451abdbee5567e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dc3d5e075821b778d980896d421738d

SHA1
70866d9face70a86ab32bbdccf0f40690113d32a

SHA256
e00ce109908c75948e0e63349e6f12d40324790d43c6247771231463c81972e7

SHA512
c64f269433c8c4e1e5a2bb2a29a6e1326f90171c30ad07cb55c991bf6cddc805d9d1375221b3b58bdff6d20a3f0455429a62d7c4f4471161d41cf5cac4de2860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e9080f0ef23ee7a711df5598935ee1e

SHA1
5114b0897faa964680bc871a42ac6c60e1b0095e

SHA256
c33085859643ec9245bd37068ffeb9e98f6e000d11b6c6936164e71d9cdc3b79

SHA512
597727064b068285574e4f68cb027a346dcf0ef5a9ef918f162d6a7c38ccae789bfee86ba92fa4b6b21d1c9cfd99d0fef87965e5b64d7a3afe05b58b3cedaae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf2581577fbe00f23b44d4c5e18adecc

SHA1
ad2925b0ab627d455f89b9edb20b9367700b168f

SHA256
e976414d97b39c85295c9bc8397ee7843304aa7a24fd55eb4bceabff03125cbf

SHA512
275fecd78008fc5ceb4d1641b251764a2c8ad7ab0815d71d1eafe388f0948f60a0a7f8a1292b91dd8e5c9bbe91d704490f572cb8ada4ff431061f7dd2d0959df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41c316f53fa483a69dd2a8d58b45dee6

SHA1
6a2fccab736d29735f0b47608e5f36332fe08575

SHA256
69e132a5bdb74e9f07ffa372d08edb3b4f7df47f5780aa0e9d5af1f0779e5c3e

SHA512
1b71c1a74722a671e16d135b5af11837ece5cb466dc07834f50d07c6b17a4d9fa2d4e6758cd05f3b3dc4e562a0f14531df626d082419bcd39247be451216be1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13bde763bdb138a5525bf070530c6f4b

SHA1
6e39e06392ff744744e973d81ffee1f1571e4af8

SHA256
ccabacaf5314198864b83559996d8ec57fe3211ae052ae09b169f247d520fde8

SHA512
976ea21498ecd1ca8c9f5e956c1ec3a3beb490af1eae7abc4976deafb97c4ff65c7006fbf584fb9abf17f466872a26fd8531686626fab859bd5a0b147d5071a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94032cb8e989b666278753c0400f54a8

SHA1
fead3fa19ddae23502605cc9f79fe2daed0ace2e

SHA256
32fd255aa700adb9d45f3024fb662ebabb12d3f9a0a5659bbcebff2508809e36

SHA512
b03cac3ffdee458816c6fae503fc08fadfa20b48785d4de190e40013e73add8ddf1786dd54c117ec347206fc3aae8ea87fb716a782ccd6479cf45a35b7e08609

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6150a11c101fe4f898ceeb4aeef662bd

SHA1
c3ce4f9a5582ebb038d2ef3815f55ae5e5f687da

SHA256
7b22bb5878875d0f2f15c3b9cc7737a5f594fa6acafc91a3e0ed09326135c541

SHA512
68d2c2187a19548d00ed956350850c8fda4549481d0a1c661d4ca2cd9f7699f8ae810ed21df1ed43afab171470c6cff4269c08fac5c8c9ea754c60f653c0647a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f8c503083ba2687372ab737d944286

SHA1
0d4ab896bbb7ba748ddb83203d6099f9b349c2ab

SHA256
ff5948914856390867c0168da02996e92e7bc85cba5cdf7414518fcbb068814f

SHA512
9354ed54ae4ac519854eb702022e40ddf43aeeb65f3e878254b2e8aa7117682a3e4ab1197c08b75d04d6bc793f7c5605ed7956d260932d4d8095d45a31494041

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab210A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar211D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit