5af7ae727d8b2c4e4cd797c997083cb021813b6ab6aef7afde7e50b5f956ed12

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

681ce08c4cca48055d2d366cbcca9db0.html
Size

601B
MD5

681ce08c4cca48055d2d366cbcca9db0
SHA1

f6126793f4e3f35d2458adc6e8bacc435834d4df
SHA256

5af7ae727d8b2c4e4cd797c997083cb021813b6ab6aef7afde7e50b5f956ed12
SHA512

c4f2252f1e3e14d37cf08384c02680e1b426583d987349609109a2b1c5f0da745ae3a48f46e4af31fb562855d035f1cc75a8b4b288438e022313475ea1000080

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70aae2fe7e35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A61DDA1-A172-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004357630ded1b4801781c20bd2b86ecf2d7fcfae88edc0a6e85ba9b9f8694f23b000000000e80000000020000200000006e22b9964309eddf0973d4f4f4c95b14bd9800b397c9c8aa7e1d873d3295a9c0200000009fceeedd02107eef7fdd4e1bea7221bcb9194ace54aef29724bbf051ed37f51240000000c9795d015d3ed046b1ef5cb604bbdbb4502fdc3b68d348489d915159352939304c603775c0108d14e965d65f0eef639120c79a56e33559f44f29a77588d972d9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001757d32346d3fd0442856918dd1958d562fa26fad94f4158c499f3aee61b9c59000000000e8000000002000020000000a4463d1452b91f0d875f88cead7220a9db66e3bd14c815cca3251927993ca3b990000000b24e343de34d1157e2483cf18c36386a19de0b866919609c9f4c7a34e5ac9fbeeb780886844ff95d8d10ebc61e912232d8936fc92a0e395ea3dea42b798c8785a5c792898861255bc00df920fb1b5d55f9de124dba8f58ab98530ef18be0c098f7f4c4d11c01fcb16d6bcfe7839d921a8c54f7e519fe117efbf728cc31d7e93743c1e2321086ee9ec2f92ddc62fb4dee4000000058f9fad45fd0ea82a617405c3b5867ac40f3873c90ef1a73bd743f425240b4d0d8452e10efffc3ffeb6f9d7893d51b7f60cd44739282a7c4230629423bf0197f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409484120"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1988	2660	iexplore.exe	28
PID 2660 wrote to memory of 1988	2660	iexplore.exe	28
PID 2660 wrote to memory of 1988	2660	iexplore.exe	28
PID 2660 wrote to memory of 1988	2660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\681ce08c4cca48055d2d366cbcca9db0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e205c846ed326d3eb02b328d0c41b1c8

SHA1
509e518a21afb493998310270f3421e706a79950

SHA256
f1553ee6ae6ea2c9075de904ea986f008993eed525f2e9977c09e17bb4691aa6

SHA512
b32f198603c6db4dd834b0b69e9b6dff954e154a086d9bdb53c36d5665be3bca8df8cbe3178fe21149217f0c896967b9274f89316e23b7040368d4ef08658bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e56ed3d71164358af7821746666e9a84

SHA1
5d5b50d3e5a848ff6bf7533a018afbaaa8f92d63

SHA256
963e7452976c15d0fa656d8f9be3a18067761818890ff6f666cf0b5f78460011

SHA512
6e856bb3d45c7a1584daa4ccf226c4d33ea7f0bff4dcf00b5c06f838afc6f12c23442162f25ebbde650734e476cf07046271cb88c53687ce265d41cae13e38db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c8b72f0ac58cfe7ae5c598f2eda0b7a

SHA1
e22d1d84310b72028c3f82f3f221a90f0ccc0847

SHA256
9e57f0ec147b9c54b98aa001d4d519afa1a7ce2fa1f35780ba3d416f6867332c

SHA512
03723f1e9a2c50da049df0d210583008235f5e55af0cad08101d8e1552158ee67bf8c7e052cc1b613c0f191ff14e0c28326d917f0b43f3c21e8935b01345d30a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75054f1f1a0b4fb628ea2dbec64090bb

SHA1
97927f825d53b707f8103da3ae64b00e6be847f3

SHA256
4417ea28244034b97995c727f0cb2c1ba14b3421d78353876e936dfb93f16739

SHA512
687b34bb64d9ab8483dd3107633c2ed6722409b2fcd84aeefe3cbc3c8fdc8cd543849c358277c20070256c204b463fac043c928aa679b64d35c96c106b767249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed5cedb5614be1bb7eb00f09a7283767

SHA1
93959015e4ae0dcb94f9cc8213abf195d2f79aae

SHA256
aed77e7cbcb9b28aff7a8538720e1d45b773095a88da3e1c4a823086a393bd8a

SHA512
81db132a9b1205312380ea75aae6cc0fd960f0f902881e6f4234207316bee3830dec9a30a2b001f01592e75b21c96dd2906d381812e39981e437c984ccc342d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5ae3f0004d1aac5993c64f5c7c26d7

SHA1
5c231054f8a1156d732af41ac7d62be267024747

SHA256
554362d1977cfe1d9c2a887f18587011177b79241013a76f8f910fca2fbbd73b

SHA512
9160487bd9cb4b7d8480f431b220237f36789db250bddf681839e3a532c0468c4f3573b1da29235661dc113268231274106d145630ad7bf2eb7190fd3e6989bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd4b22d8a97a8c2dc12d8145cf91b2eb

SHA1
bfe98df81b71e964677880c79efe2e655361cddd

SHA256
3b9fc7e5793d08855f35cb5296949aaddaaec0a20cb93cb7195f6f38b73882a8

SHA512
9bf00fb78ec6cd5b0ad30e6436ff457985c6746f9041752f5f29a7b9b65139a8c935eb0cdfc62a5ab0fcc33eefedc9b01009b943d30558407472eb084c91dd5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bb8b0ab742d0f02ac9da89fa2ebfc1b

SHA1
4397dc70f8d3e28050786849ed355bf8a98ecbf2

SHA256
7be2ad0518372d25453a7bd5ec3260bc9c27357f70da50cfd9064f17fd034318

SHA512
2ce3332ad383990989fd51f59451305557da58488e3eef63661645992a6e6cba787554226711afde37f00616a78f416518405f8bb6de091d0bbfa6adbe7f3b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66143e56d7a391dbfb50f05710c03215

SHA1
d4fe4931e7f32337b268ed4464f1be6d70528fba

SHA256
526dde00e71a274873f7e8f5e99fa9d08e5a1ff787be3155109aa61532af3119

SHA512
24b7e25a013d4906bd9a77791daf61feb0b002d164b54ff21212bdd918a2ffd803e01e9930d36e3e1a3979924aed72010d00b30470c07771e3320dd2bfb9fbd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43e109ebdc67cfbe0d686b9b038fa8a6

SHA1
129c37a093ee0764590aed4b3b260421fefd2775

SHA256
bebe19b00591503910bcb8ce61adb103712e8ae2b4d5d61376c44bdda5f1c20c

SHA512
212e74846cf7f1e34bdbad0a55d6e732694b5d653246ad38cb19651b46752a8ba692b7d6ca7d227c182e2636a7a5cce3e8be4d849124d13c80f2e8735d323ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c754e4b0b59c53f323f20685e5f0ef23

SHA1
a6ebc013578c1204881ab328729d0ded24aaf52f

SHA256
415f4f3cfd07346afef32b0fa3dfec7976a244dbf9f09bdcb89538e90b796b35

SHA512
95a021489c0192d48e202edc339cac35c4679d89f64679c474db345d5cdc7013913256c9f2301747bc5292788c0f4d66217564900157473a9744b90763e9dc74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2a7f2a190b0996a26daf4aea753733

SHA1
0d5ce886173f47090431ca0292468029b1afddda

SHA256
3c495421c9c73429029945d8ad16ebc38b20391e746046db24e92f24fc063d37

SHA512
2073b26d119fb799d54c2e00db2c13230771d66042766f9425320b6e24ec75fa9ac2fe438fe93de481bb774b1c1a1f963a27658e09d2d073db0d17c138809693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ca0fb3c48af546a0222a6ac4686420a

SHA1
3968c44cc75f89179b9e65ed4073c7b7392e3fea

SHA256
93fb1f2ba52c509e127590559a0d43c838889cbf14dbc4548acf558bcf6fbfc2

SHA512
1e23ba2e9ad212bd3512c5f8e44e369a752cf9efacbb642b5ef5c5d072f31a2bcdb4057d2c9c72418a001b3f0dea9f6eca6562d0ddd0cce470e8e2908e60da75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8854.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8886.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit