2c31a7c78785c930a6fab5617551dec0d219259bbdcda0f7b3f479137b6b1d3a

Analysis

max time kernel
159s
max time network
165s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71a200cfcd34aa79e32562faa098463e.html
Size

12KB
MD5

71a200cfcd34aa79e32562faa098463e
SHA1

8235ad849d0514e40fca371a34cb71f3cd1b10d8
SHA256

2c31a7c78785c930a6fab5617551dec0d219259bbdcda0f7b3f479137b6b1d3a
SHA512

6d24a46c8bcb59e1c1c5d86d9e6003b18d2ea6ddeb526e712e0c0e0f17cbc77c9d66b21d9a60f46f36e4b56e78bda781cee88e6455082597c58a9cba4d71c311
SSDEEP

384:SF0lTUld6rTyv6Rb+nQKrlibQmYMH/pMF1E:rggyvCAdhi8yfpe1E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303270338e35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000043a544911148843f9f96369f161dabde82f5b1dfc027295267a9c0571c0eea89000000000e8000000002000020000000e020296c996bed54dd72828d61e080cc6f9e0500eedc8ca36466a85a73b011dd900000009b0f237feb09dfb4558f40516d06625b520d0f5eae7ea07099025358eec53c18ff805689edc15673f530862dec5535c4556438d6c13d52e48dfa0c816c6592c3a14ba933ccc2dcfe4ee2557771e45303ec1e6ecf4b366768d200ab845996802a731f12a304f6f6f77a50a302f398ecbe22842648653dd63736312b41849da17416ec1f6472045420f055f9c30303a6cc40000000413bf210a3129ed2e1ff89560457cf2b6554a9a19ed9c1baad3469a97fb4835405a7c29e54e4f8bd6da41be1cb3edaf3d9ffb850e0d90912a9d5620c959af32c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409490624"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004b2b61b185f2e78a2d87d4017e3f7d22169d9da99a6155fffca883a2698367e3000000000e8000000002000020000000ed44122f05fc84b7777d6eb54342dcc5917a79beb9c39846eec9b58897c1d89b20000000af42d57648283274e2bd884258f52393b4e723a19b3e65156b82afb0ac4fd06f4000000008171b01c4769dd7cbe5908f67653dd8814de82f4d2d8f750c043d68965f847943a008b175c1a4a42187b15b994aa1caa0b3133e37e5584654a6e1e306967820	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E8BD6E1-A181-11EE-8723-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2880	2148	iexplore.exe	28
PID 2148 wrote to memory of 2880	2148	iexplore.exe	28
PID 2148 wrote to memory of 2880	2148	iexplore.exe	28
PID 2148 wrote to memory of 2880	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71a200cfcd34aa79e32562faa098463e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe7ee1b8a593a2c43712d54f05763206

SHA1
45dcd66e1ef01301fc7b8307b1dbaff7bee06c5a

SHA256
952e0be4791d70adc50a0ea3bcca8fbb8cbfb82648c914e5e57f6a59cecab9b6

SHA512
3acd4ce677ab57498585048fded5a1918badf057c6a132f4bb9ab55dce37de295c201971bd458f6d6ec8724d2abac9c89ce3c536f0658fbeb0aa13d52c550a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a316a8e43cf6a34a1ff0ee3695f4048

SHA1
ac9dc2093e08b459bc793a1340f71d89d933affe

SHA256
08e468ff80f2b880f8ef900a279ff011045324883869ea15132df6cd7f600aee

SHA512
19240256d75a44a6e92bd836033726922bf56d2a8ec2171822cb799b3fd8b1bf87d90cc96de03381fa8e80f67418e06db051bfab7110989e300df4698a80f9cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83a346efe968142cba32571ed513bc2a

SHA1
a67096f9b47138c3dc993232950aae0084612672

SHA256
aded735cf08ccaf6da1f3550dfd11871aba5031650692a25dc1456f9c1300a02

SHA512
076dd117e22d44b134ffcbb9404a1d0e9519354684294888dfcb07aac8b746c5b17e2840595c3d99392062a0e22c07e01077e201ef628f7d42bff0176fc54e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89441d065f9b8402996a8908fbab38f3

SHA1
964439a1bcfeaa13f7b891c1c1e7cf24fdf2782b

SHA256
efe70e1f2c156791c44b7bf2f36994b7542d73ee23adeea0d790772edea7538c

SHA512
0bbe57ef81778b57129dfc691df64c2402bc347e5057d8262db02e552af884210fe5a0c474b02e34e634feb557902e3a4d36f215640335d6b688c564782de60f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5dadf2786e412d6618c10356f7f56e4

SHA1
2135d4be799b44826ad6da71d206ff7df73df260

SHA256
af6f9e60a989b8895894404fa60552d0aed54cd0a25b06e67a76d29c99c82813

SHA512
1ad12b050acbb2f0c5846a3a3d84472168933efb0a8cd467b87dfa5e5729c6cb88149826d8c67926809b10f0a15d2947fae020cf770d9007d8edf87bb8b6a092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
502e36ab6f40a34609adc088457d04a7

SHA1
8d27f9b274675df6fbf3b0a5c93f2d2be80b3d65

SHA256
07a6e98957ec4805b3bdde702e3edfe7559cef678d868718459b39f4260724b1

SHA512
13a301605890800112f7cacf0035de704621ff421be05bd7327febe2a8210e2d4f8d839735ad8bac12b0867c4a632f49631d43e0f0668060040a9e6c011e97f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f85c2e6b980c39e81f1bc1b634e0310

SHA1
8d4d5f4a6916f86d6d7fa178f1788a09666169b9

SHA256
0880c7fc7b4d421e844223d164ce13eb9a02c0e9fff5e206d0b894675fd68592

SHA512
c75cf5a5aa8c0b7f6b88c49e52b563301b935441ffb6f88e4affc102ebaa6bbe4130d373745377b9b085d122408166e549ca732b35eff2f2aec299710c50bd77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f7557d3f97a7bea13c020495d207223

SHA1
11e3091f3054a2036853a5fdad65a889565e3b46

SHA256
231326c26bc2f66d091363f9b9003420c17f8d7a5da2ae9485d6ee65d08cce47

SHA512
1995bb271e290b02b35bbbe403604bdcecedf83195ce8b8c38ae56fb75932d361ad0ad809d8e803a4b2aaf0587ed17f8d020e933195a1c38cf73a727c9c03445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5483bac3556b4824998bbe857f13e118

SHA1
d5bf71ce590158d52b13834090dffa00cf1bb5b5

SHA256
3346581b7698a08a062df30ec6c76a0a8bd368e59160c89d6729ae6067b8029d

SHA512
f9f92ea954779063eb6e870ef3729f503e90e457940f177fc63141af61ef8a26842fdd0e9bc96ab434cd3ba34f0903f98e9b27fd0b4798f81cc24d6781ddd07a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff9a5f168f5a915ef56bbfb5c26ba9a5

SHA1
30defaa66c2c59aacd5db0d925cd77d0bcf75703

SHA256
df1784e9e670f975fc6b3dbafe0f633e133bf65ec3191bb09026118207d0f885

SHA512
55a6b5bc4c31a525991b423c61f9519320cbe12d4167da5f66942906695623cd14f60d106a368c1145830803f336d56db078f5e63c12704b5eb258c36a5a22c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97774c174936770aa8647bbeaf95bb04

SHA1
ac99d543657ba84112f37e20ad472069573df3d3

SHA256
3ee922e8c94d2f80295062a2e61847272fe3f26ca3ca84d0881b53fa2bb78068

SHA512
909c511ef88d7d0b1e51eb1c6508b935b6701eddef08b121d17e83edce8468a38ff47c13a1a6002a3c7f3e196524c63455bb6cb3b634e59c918d47b8a2ce44d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22f35a33cccae64aaba347453f502b0a

SHA1
a50b12ebbd0b16c60a8e9567950d24a06628d170

SHA256
40b34146f37ed64048e3db3bd915a041ea83d11822d48693b79d7c9b9409b067

SHA512
d2822b59d91f235d0cf854c81eb33612d615527ed7c9d6008d937d4edd714fe54f58038ff108a9e02492783c95f2326d3e4f57e4710c20664622d37fbe139dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99683d6700aaf84fe6a92fc9c0c2958b

SHA1
8efbc902c083d74576655dcd33abf3cfdfa92182

SHA256
a2a0c448529a6756f0e7a8ed697f6d9a892dcf73af6fbb8e7ba7c73e9ac39f33

SHA512
5114f78e4fd77c6101aca6d25d716a737d6c91f145c0e6c6fd336275672ed2358c12ff0fd7ebed7f9c77b39ef266ba68670465610cddd61e2c4798f962077acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3806f6c0e31f75a199a7aedf06d5d48

SHA1
5c9ae4d8862ccc475126f991d2df0db2a3814681

SHA256
4c755dec3be45558b9eeadd8a5431717d5936571be584d237c69d83762d80687

SHA512
6e30def01f10b6e0d10974ab27a2c0568827704cd8fed272ec0569d7cac9f745ecc5bbb94423a45adc9ae1ef191dfdf5463f7f46e59a2c2387425be6baf04b28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1f32bd67386ef25d5aba8de823c414a

SHA1
c33de75b48920770e1c02b4841814eed7aa5f785

SHA256
5c4225959b7ddf8bde0f175e02c325e71f98bcbcf79b7c18b173e53d09cb8ddf

SHA512
ecc6a4726d48eaa83e9ac47c4f513f61072a7d7d78de1e7d72e5839b1d27dad7b2ae05fc99379e36b09b16670c40a202fecf4eebd9fab661e4a35b8af4f74261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3d21eea533e12680ee744032891271d

SHA1
fbff1700b9e3aca878030e9e1ca992485de59df5

SHA256
e85f13e739742f20a345c5282420df41442ef9772a0e10782c19abae0c532b10

SHA512
36c1a4ccb05fda6836fe42bfb12398b502774a5d68b4f1f956ba32a75b35448029a41e3d0f606cf0584143738d44e30579966532d713cf3a6546dd8a400eca7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD56A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD5EB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit