c14a611fbbe82645a2c538fdbd77e307baa7c43c3bbc7d6b9826fcf925b4d3b8

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68708612cc62170375f5b9fa5733fc24.html
Size

1KB
MD5

68708612cc62170375f5b9fa5733fc24
SHA1

2b5d70f0ebb026fbe2ec302b3f925ce8627bf50a
SHA256

c14a611fbbe82645a2c538fdbd77e307baa7c43c3bbc7d6b9826fcf925b4d3b8
SHA512

006a5530baa4e2edf5c80424ad7f0c79bddb5811006165874ee8c19dd836a38b1a35a8436159565ac3ade71c8eb3c1f0193e601d72b607cd4b56736d49628511

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A29F2B21-A172-11EE-91F8-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000092d0796c3775272c2f49d519d09a011ce0e3a973c29a13a55d84dd997b0e94c0000000000e80000000020000200000006432b33efce6ecf0ac9871a12a95409f8a73632159854fac9a92f1c15e304fe220000000a27e4996fac31375ca7f1623d47a536e6171159a9535561bf86478dec162ad8040000000b8238a669717c269cfa783e6471bd68a0d83fc1d5961c4c7f66484502ea4eaa5b2d162f0b91ac82ce77fd51483f3452c9b319c215fd9a4b67251190d1005ab48	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e67a667f35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409484291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e07d9cd34578ba0b3ecb24c92436267d98f85c2d10202a043a601e66119efac6000000000e80000000020000200000007874b9e92b73a79498746fbb2cf616518b1e2d1ba815ad7550b2cd22265fccae900000006278aaf72c8d810f56f60a32c1eef6839c55131119edb6239f1a2b8c77fd86193d8a6802d865d292ee21684061f6d0b33f4c4f937294f28dfe62c6140521b1eb56071cf3b21b757feb425711510ce53bd79c3a1bb6f02c45b651ec924d25a5d3d8a32e316735d9485dd582740bbe5093997f2cae418a9c9131768638bd1000ee492334a2d8f83ab4f0f248efb9b52fb840000000a06f0c5c761aff580cca7e9dd3a91af0c3edff99ff8f25f41c90ad638a8571fe3335be033d147e3b19c1a81a9fa1c99045001b4121b8f97a6fef234d4741c847	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2456	iexplore.exe
2456	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2536	2456	iexplore.exe	28
PID 2456 wrote to memory of 2536	2456	iexplore.exe	28
PID 2456 wrote to memory of 2536	2456	iexplore.exe	28
PID 2456 wrote to memory of 2536	2456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68708612cc62170375f5b9fa5733fc24.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
159dc9b05f27c4f4b98494fad0f0b691

SHA1
54c7fbc2a2907413096b6208c26cab2fbab53cbd

SHA256
5e09df137ebdb1b3252da4b35745b1d08dfae6c2a6898d9c3b75d83b810a575b

SHA512
1d77e8f5d23bd24162bf73afc6859c2909f4a2356ae4092662d45881ad8666949754742dfa4d0146703540e8a8a66ce57899bbdc44904d0dca51b35aa2756776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e9ecbe47f73be7ac4040bcd4ba15a75

SHA1
b5211d05af7e527af8293937d02bb6574ec459f2

SHA256
04284774d5805a55fa86dc4ec39aec20990ffb6aef625c9e9224ee7901bccff5

SHA512
64b238d50a505da49191a6261e9dd44d351edb97a27ec909a1baac8d8309637a8d67b321120302c84e48040c9b5f7a78281ca55d29c31eb45e0d335576aa3b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a644fe1643b251d6cd4b2a70e6d70aa

SHA1
9e4d38fb035873fe0bf684b7c1f77ba1f2de0027

SHA256
812bb0052ea03f19c562bc2f2372b00b463fc778b5e3d5a7e768529dc5ab533d

SHA512
a3159ea41bb3832dd01bba95a2f87a89ecb89e8e8956fd88ce106bef67d5d6a2e20056eb6f48032a28d143f7f60c18b84a4630a488a94701ef4007f882589848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0b200849eac28f17ee6ea14830f560b

SHA1
03825592d0e89459c0a59aaf07f7594182e19b1d

SHA256
41e9d67ae8ef66e007e34e21b7e46cb57ac4cf699b96d62aa89f620a25200e27

SHA512
30701f63771bad31e6ec8578adca063cbcfae8b5ce1192398daaaf659d4bc7011f1718b74d82af6abdf8b28af9b3a0a6f377cf4119bb6be3cbe4ffc9b45d2d69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4d0b36400b09c4f99c6f7d411b61d04

SHA1
10ed8972f996412c45d7f57546e48cfa1418c025

SHA256
f46b8f3db29e70a35fcc91c2b79079630effd8fd6508331d679180aa4c889f80

SHA512
39a4d84d6aa05e3fa24dd7237761cc7f007ee6fefa2574442927f905c36856ad4b2b654f3d4fddaba241f3cd33811869cc879624e67a2d23f3f6e8a64ef60749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a5929bbfa42e5fa00d2e072b9fe99a2

SHA1
a7be2089ec93aa7212b4e2ec937bd07ff8233a6a

SHA256
d9d5a89e319f1ace6580eee98c8cf202b1bbc6da98d1514261bcf53cc727f0f6

SHA512
3f8cbe7646d5e97802e8251408df4b3365912b4382142d306ce4001819c8ba52bce6367be5fc76916873a54983b3697b46b4b63fd91b511ceebe25ad92836e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97b7d8b90abda95fd08f22e984becb19

SHA1
1e95b2908324eb3002998e66c90d46fc8cb9ab72

SHA256
ca07ff112b00005284d33e6da758b94d27f5d213e7a5e97b16c23c1d57e2bc96

SHA512
03c455d9fe3fc9f474190084777788a9ca038fd8337bc89463b3bd43e1744632d3f6eaf8cbae7a7473ad472603d36a3f85a3a3ec3156c4ba4278623ca6690baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcffbadce40e3be156a79e73b4094fd2

SHA1
0fe82e18520c73f8139801c650b1375ba5d65c9e

SHA256
b30d59e3932149c1356649c70a1e9f3de9b3cf1f96aaecb0789789519ad373c1

SHA512
6063fda72f295231ff2fb23dfcf4558e15b8817d669d41339fa628745f0998f38152f28e132390a2c2f7bc62db826bd7b949c5bc67d3c61a0d695607e60c3b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edd28045c4bf898f99504970ffbfa981

SHA1
4a98b2968916a647283ff56ea4357ab49bb40cba

SHA256
3eee22ec1d5ce1ef02feac89ac19090fe59dc035516cd904ff47c5691b635456

SHA512
d1adb9109a8a4828907ce5f60c32d0b863f558ffeca05780547f8646d392a4ebeb72c04d5b6c9a915fbe50df0a303f705efbb1fef975aa12fb0532e8a18dfe00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1dcb3bcc529f6cd027985439d73984c

SHA1
8d978736ea94eda072a9956c533be0204c12391e

SHA256
38024cee3d93c109a7ed6faea1a8e2af3f55d281923f2105c081d277bdc49cfe

SHA512
74f1f17c877a0e02fc3a7dad150e5302476d07d43e8bbde51b287063b1493c169ca259ebd4285db9d6150ab0ebe07b29460499fc181bf83edf9f900e1d5d5429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cace9e207b9512fecba8aff0120fb3e

SHA1
76fc58060d472aa472412000cfd00dc9c8fb36e4

SHA256
982229a350936b885763d323dc5b383b9c13cf142f2444d522cdcf0fb78de67f

SHA512
05408eb734b8a117179d5ccddee97a5f90dc8779a248bab47241b26b5ad86f26ff1d4e51725f2f0f13d2e72cdbb6e51761db0ea0ae7d6292bf12476fb7e5142a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb3c4a65256469cb339f6f5d40e9862b

SHA1
85110793f890bf9cba741d31c1545fc1e4b96c80

SHA256
6fc379c81e427327334965e9fa534bb1e185b6db8f1e0da9cd5481b64719d997

SHA512
18b40562c74a0a1ee59452babbe0114aa8fa6226596a08982b57f470e42d2aa9b749eef588dc8cfbc971e8d6b6b6917104801444a80fd4735b4f3d81ed7cca5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f891bee82e330b196c6533376639b273

SHA1
c3cd72e2198654f88b547ac464efe02a80ea15dd

SHA256
af07233a7f1e3b5db67b587b10e2caa3b466fbf5835df0da11050be2a08ff712

SHA512
a948e45e0f26dd979c969628c7361d9d799d6946091db2d75708fdd71d452134446a947ce8c4e8bb6c7a645451929904321eb62954daa6bc2214097d055ae037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5d02cee3fb2d58439cafa94e8680080

SHA1
ef46807aa9fc7f9935d09be04b11d347484130ed

SHA256
3391c17a13d6d17516d0a9502a2f448fcea1f5d1289fea5fff4fe76afa913613

SHA512
9eaa377dab8a19d4c1772d7004f386acb9ed4fd6569d5394f12d83d10ba80f8a16f7e5bde0fe703500dba91acffaf924963aa0f28edc9b5a60c0748e38ef5fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6161575e68f17d8e3c7dd06802a789b4

SHA1
6fbe53f2196603ceeb7e4fb128134e0b8a2f5889

SHA256
8081742994c4c0dc0cb6b01669133d634d2c2eea0ef67b860effe6ea366e79e9

SHA512
6c1507d0a2e8c1e919ba6e0640258d8e90f2cb6ff3340231e90abe9d56c1e25de7cfcc98bf82db0302130dd698da8f49787c220b66bfa3c70d9fd23513041695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a0d8a74060f1d05e759ca5e7021e064

SHA1
e7135bfa40bebcd7569225c5df9580bb372fbc01

SHA256
8293bbfbc24f2936e265a555c5b3631ebe37320df83e417a3e9c2ce861810f24

SHA512
64d2248b9e71ac0c58f8dc9697bad7999a931c49e4f2aa9f885f6cfd0f7e744ce4e6940d21223ccb97bfdfd13f180be6fa2307991d6963642ac5002d8114eb2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42CA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar435C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit