cb80be50123abe983b849f5005dc72946ac918ea12b5e8ac5cbcc5bba21fca63

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6313986511e61ddb8a5c7e760d55a755.html
Size

14KB
MD5

6313986511e61ddb8a5c7e760d55a755
SHA1

98ae71c40c4388a626c0ea99d8e67590e349532d
SHA256

cb80be50123abe983b849f5005dc72946ac918ea12b5e8ac5cbcc5bba21fca63
SHA512

975bb99145300b50e37bc7dd30865f6224146752f8420b06bd2913537154dd60bd1d4e6badfac613b63d906fcff5228ce96b1e4f1a76d0d719d0a4f978dc1f81
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1v1mlKt6DvE:aioWD/ZmXg8SZQAmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000003072b03d45c494f381f807b177a55af55539d8e71b9c83ba47223ed1907cf4df000000000e800000000200002000000030d282edcc2cf7d12a34b5992d51ee83cdf40f96ccab2ddbe2ae6bb6a786ebd390000000ecd0bb55e4a698810d114ce8f6ad5fef62c25479e5a6c735d3db03a640c7da5df0825f62ede69c005b71b8954eb31c831858f7a9143b553b3477b9a33585bc251b99d8a7a6328a7b8d6268f6a64e8b92fe49d2bac45426bb8f89e9a24ab0960de38e855fb5827fe6f935aadc220b110cbc5a919c7f906a04cb49b9214d28136acd3a1aeb415338768b0c583d93873994400000009f0233a18d460ac0d4835fbf303799651612bc5fd6114108ccf0c8434cda9ad8c2d11060bfb1c4c87a0486d81f235ce3ef2d98b34e9932f4c07d5b9bbe488990	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{041A1981-A16B-11EE-BF73-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50136cd97735da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000fb5dca53d6885004715066ad9bdcc804b947622c18e08f95690ff605c04d8148000000000e80000000020000200000006bbb57552be54d91fca0e76fe868765a555f03574638237cc8892c8e75ee1b0b2000000005737bf9ef9c8136cbdaa06c98b8f813135ed79185eab5cd2e87d9580dc5ac0440000000e801de0da902db4a5a1c410d669cb63939de9cab442893149a0653302806f7da754bb69e1737a5f91a14b2d539933d022cdcbe8e49b7d3d1eb356f107ae57e2e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409481023"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1920	iexplore.exe
1920	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2872	1920	iexplore.exe	28
PID 1920 wrote to memory of 2872	1920	iexplore.exe	28
PID 1920 wrote to memory of 2872	1920	iexplore.exe	28
PID 1920 wrote to memory of 2872	1920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6313986511e61ddb8a5c7e760d55a755.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
395e9b2f55630ac585da3f11435418ca

SHA1
30c42a867905c73ae87274a3f40817596f226fc0

SHA256
6ac2a5924d988d020d2c5e47002f9db32dceabff0f7e56fc075477382e74695e

SHA512
833539ded3ad0c61ca9aed35a92e0c58ee718b0f067d37c43f0cd001f19cedcede9df64c1c553f5e3993c76a30ba0b58adf0645acbd5a5f1588e208106ae5c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5ac594cdcbd0a9550dd6d6ff3721632

SHA1
c35562d10600f670fca8a830c5de6cb4aaf5d684

SHA256
95a7fd2a7d2a7f824a772136a03d94ac495c29802d1bcfa6c57c6237defe29f9

SHA512
288acb26831cf86138955d136d95305809ccbb5c9e0a85ade2aaa580741b38bf95553a119b13a9a2dfb77200331c8306d3dfa0813627846fc8461f3e402d3eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
980515372dcc63e5f282c842987093c5

SHA1
9d419669140911de07af65423163ef371b9b8d5e

SHA256
054dbdd6e88bd36f291ae82fedc7c4b227c2d50cc0ce168fbcc823101fa98e3c

SHA512
7c76a78e40e2c3b8190ee6cec283400faff186987b1350ae44b8c8b116a1c888cfc46b52e174272fc430cbcdc33f1fbb092c6ca7024a41ccd9d33a7ea48d9631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
928c13d683168f41d22dd88b87277453

SHA1
0ceb67d737cf1d7c4b83da9d1e4555f800a273c8

SHA256
2267873cff5b550ce20c5a7e84b446978034ccbf1894a9ca39115c2ca80cb571

SHA512
64f7645107b67efdefc31304c25680c18f5f6dae0d9862dd14bb49dc2e45809a15895c1ea43f2f47ee1ebfdfd741bddc2ad016d39662f3d1654c9466c7149ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3c0842e54f4ec88cb3242d9fc86125b

SHA1
4237ce7e36c0aedc86fb18839ffcf508a0b8cd78

SHA256
4adaceaf7b60d73e86ed4371f4bcf71db6abc35e42c5639627482294388ec16e

SHA512
39f068023d7df9f43b49c31f49cfc5b149c13c7ead15d4a06553b954eb61b0ef21ca20f2c71a9f26ac8a8f972aac4b943135a730747b98630770cc3112d0883a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16e8a7223a8a71d0d83b0b9f6e58e5df

SHA1
84fe877c38a0a747ee0dde69e1c5571940e08e91

SHA256
e45fa2ea04789c5670f1b66af5054f77e8d2a2742f8a489b6047a8e44b3e5a1a

SHA512
129057a47c698837994199d0bf5f912b994165a114378107b037ff05e2395f00e5f3ce5a87c66e3d46cb19a50efa6c1d5d823852c0f2e1292abb6654d7a851b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9286e15dd66f5fd31a15fe513c5add58

SHA1
57b86fcc0b759ca2ff8c0560fee76c6d386cbbb6

SHA256
cce2c905c7f9dcd594c14ab043c964391220ee42bbbb3617ec7d3609ffecd31a

SHA512
ba7ed07dd5858ab4748aa18d499645f9c0300995ea7315ac47c50b034d85ecdda1ba08630106e3b17bbad98161cf5cd0c77d15a6efa1552b5139c78e9e612a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ed083dcbd4d9b69f4cae33fdbc53104

SHA1
f0fdff4cd6420dc866da2bd0b298f68ee80473cf

SHA256
1155504b9ff35305277f213ef4b49448859c4476fd33a086734aa48abe99e34d

SHA512
6f6727a8ccf53ecc685c5830f4a85e4755f563e73cc74c8f1aba73954fe81cc604238523dc0af03323b3e81b0b40c1146d49b4bd8bd084cacf0658c28cb6018f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f0b5525251c5499a673aefcb87d0503

SHA1
3876dd5769147d919e7f79afeb18ae6407dbf92b

SHA256
5794b88f2284822e02269306f46da703ac04146520bd86ea174fb7579ea4979d

SHA512
1b66519bdfb2185bd90bf2ee4e10ebadd8c50b772bd19c03a9b65e3a2458bc578b86a6388ddcae81195e3769e56b03dfbb40ccf6e0d47d5ae38796a0af3be997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad20896dd61f92e3578846462d6f298

SHA1
53b1f2c36dcc37cb80295e7fcc3ac5e82f412db5

SHA256
b9dbb9765b0e9bdcf522bbb88ef07da6949ae209ac46238f6eb7ac31a5e1da03

SHA512
51528a973de0de19f83df38004a417ef7dec5ccf83c7f0c63d7d252a3933dc0df0dc06a70785eaa48aff008ba4ee4d14fafdfabf49ce3f7e10de15335d46feee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1468bdbcf1add39aeb87166a6e999836

SHA1
68e4fdd1ca0e1a6d718e111f68cb5f15b3030f06

SHA256
c05dc6dbde5a168905928db8a91a320ba438c9cbb81242beb63be4a82926a3b3

SHA512
01016da3ff4a01f8a4db2aa129e9e68ce779151a849cd7a8062c2316d381d0444c576a555c82237a9e7e69c811e85b777e506c00ee2ea61bf5ffddf2bb1ca56a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d733858bdc39324474fb6f2fcf0bc2af

SHA1
3408a48683b6f21cbb0768ebb72112bd28b31345

SHA256
a23443f0df8233220a7f5e7b91b3a237e6f5e96d10934fb8b9944fed5b6f60e2

SHA512
c2ecd18ad6d5b0a1ae9cf9bfbacb962f9204d9c228cf4ea78acc904c84d7cd9f97b0b891269527925c5645dbaa7e2b94055e4f87eae2bb32a81d876d3bc633bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba6d2d65b5957b460e2ebcb603f6e59a

SHA1
dedf78790b1823bdfb3ce6907926b173be83566b

SHA256
cb5bfe7fcb4209e3ffb8226f51a986649b5c360632b4c7233402d50c46dacc74

SHA512
101778c0fdcc6c8dd9f57bcfb6e45d4ffb040f99bb0205cfc1ad65eb6d274edb5b8c1172974de9f28de40e7d75a29e8f8ec91ec305950eda82730d4dd6efee36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88cfc4c563b84a98c3371f9738312dbf

SHA1
dbed129f0e807f415def60048d61a3c1811dbb25

SHA256
c6a115fc224dfa0f8162ee60143fbcd63c7fd8ca88e89076b76be58b1375db60

SHA512
bc4b9db181c08a596ff05a1e456445ba91e72c774763272083b7f2453d4b812817ff1ccce43f0f53324157d0243fbf8958af45bec791945e419b4dc5f95f376d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5525.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5538.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit