4df3a142e8f4ae6c07d80cb754a507499afbd954a6c2a2f8be0fe108e51fe32d

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7429f2fd35c84d2a6e4c10902d44abdc.html
Size

25KB
MD5

7429f2fd35c84d2a6e4c10902d44abdc
SHA1

65295cef2a56dafc0e035084c3fdb8fedc84ae99
SHA256

4df3a142e8f4ae6c07d80cb754a507499afbd954a6c2a2f8be0fe108e51fe32d
SHA512

28027e72db9329a253954c8f736a2dd1226da38e021eb8d1dfd274ccad24e39484cce57258e40b82ae0a54cfb37d3af3daaf1bbde082aac1f4ea056617d7e965
SSDEEP

384:y4dg2H8opfGwL6EtcOUtxKTeBfKTpY38lMJNxALgWQQ/U4yhoy7jfIWrYc51IlSs:/g2HlpfudltITe0SMOqNG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006c4fd77b45561e1a034cb6d2b18b71bbf8e449c248ca4e9016069f67796a173b000000000e8000000002000020000000f9ebb4eb950a4c7925d883fb09a18319370f36f07fa31e63cd1fde17b47bde3220000000b4ee212ec28bdaf3a764956272e5acc213cd6d902908e05af09efef8296568f3400000001000232868914e2ea0ddb10148af11e0966a35a473fb31bdba81ec97534567d259951f89e36299d46bf5a079b9220167e8fd01b9fc0d0033e1790814f318c636	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409492642"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D0D6F91-A186-11EE-9BD1-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60721fe29235da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000008e1e3d79684d0cf1ba806c915490abd442cab95af266b1b5507546c37abbdcd5000000000e80000000020000200000009f340f49df4fcdda8b0d7f7eb2925c5c6f12b83f82d7669ba24b70cd0c37222390000000cbee566960411ab112c9ef939f267ac168d916a3dd8124cc9ea88e03894c85f901f154ac782421b93f6910db39a8114b88bfcd910019c2b4599b99930573c80403fc068a19d85d9a1bbcf828273dd906da7d31b9f5d731e78a6c5f1cbca275d1ed5dd09752262bab5750f637b4ae33dce518f9399254fe0a83958ee2a2cb955b1f61fa307e7f9e13594af1de061341f34000000065cfb63e2bd5e222bd5251cb64474c1dbad20aa35c70dd4acc2c214f12397a030db8469dcc80a4c27271d461a485d0c2be930a2fc8ac74eee4743bac9a2fca3e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
532	iexplore.exe
532	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2700	532	iexplore.exe	28
PID 532 wrote to memory of 2700	532	iexplore.exe	28
PID 532 wrote to memory of 2700	532	iexplore.exe	28
PID 532 wrote to memory of 2700	532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7429f2fd35c84d2a6e4c10902d44abdc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7bd80bcb83d52b7def74566f8c025a8

SHA1
01817cfabbedf637c35e0051391471f48a170336

SHA256
cd445dbe1b03e4117e7f86d456fbacf158a451d54b4e3f539d48ea9c37b6c06a

SHA512
42ea8cf9ce8d51016c6ea347dd113b2f3f9183f35cd9351a66834bb3ed963eea8d40be66dda0d06f732ffbba8b1b3e7d9c6f852bf58924ece16e909f4c9e2302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6dbc8ac85263c0e7a358ed08f469982

SHA1
78dc7ed4fdce5ceaa5f21647689e56d5288558c7

SHA256
a1378c4ec48c196ca5981084d03ab2c635cc519965d477b5c22819bfa8103f95

SHA512
d48adee40278c61bcd36949ec741b3b62c60492334299ab7f596a20603e367a73c7fe77b4f168c79b3587ca923fb480527f75470646444fbc79ae6fe7d78d14d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4afd990b5b5706906408fc9e8a2bc2bf

SHA1
3a1a37b7579c73bb0843df1d6d728fb9d4568202

SHA256
e37ffa142a9e4ef22d46d003d15672893da91fd6d55f6dca9f074e4c37dfd00a

SHA512
2bcda94be92fd6f251657f7e822116919542be62287782423234dacdda2631055bd8da6757d405fdff0d5cba3e473468c3c060d740f3c9c81885e9614f87da4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
930f6da795f8527e7a67d8c28592d30c

SHA1
f88d73860bf87a0cc8511cab86101355680858a3

SHA256
bb17783bda3335121c1598f04ee635f31e395834ec9384b60fb1b91e38e6b8b9

SHA512
02b08015818b9fb54690018abb896033110d5ccd7b7fd855dec7882e35e1e06aed5214701b06017d173a5b32d6cf7e3227bee816cd825d29394f25dd2feaaee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3b56bf26bc8068d9d2153e3e234c7e

SHA1
db3036242c86e7b03ce3c35f7afc7a8341fc47be

SHA256
00bd728f23448ae8a546f3486d939f042bff48d8457ea664b683c7ac4ed1baf4

SHA512
d82920cf9f36653c4545ce6e0cc8db01b593135731bf51d2c79fd9722697c8df1288ee355b6c5eba053286e6f34e213b5d5a926bfba123961325f8ca0047818c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f4fa65b7e41430d35c08d6734a1cdcf

SHA1
75e1526d13576545a28374a38c24eec8c9c0e6ee

SHA256
a6e5df28e6423f525d6bf7ae953ab128e3cfe1add726a4a8ef7d21d4607e646a

SHA512
0428c79a162f0cebec67fde43fb3cc7cd8daa0d3c959deada280fa4aeaa8e4d66fe6c20a301ae10027cabdc917f0224e6626600d827aed748f3088f338361bfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcd91cbbb6b919e72d11acc9e992b3e6

SHA1
b94f89b51230e075118838d321bc4e21dabad455

SHA256
0038fc31ff901cdaea176bb486a22e34c7d18f1a6f50c38a0eb036233df391bc

SHA512
6473acc5baea940f245f19cc99d7863febfe07ec43a34eeb7d9a64c2c82213db8a26b1b94be02bd20be899405328042b1f34eb0370d38925de86a2736976b972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f066ca7e4b95e8944121cb118e6f2db6

SHA1
2261ae01c7c269f580eff16568c8a5fe171a703d

SHA256
c575f02abbae4b33dbb08e2c40e54a803b516a7a1dda4221a99574803a4fe1b4

SHA512
90b31362c7bda93192758375cd457f2af799c28d725e91ea686db24e8820dcbf2680429a4b1803b4a2b0d126fbc8abf2a0c34ad7a9d1d18e3733df12b6dce2b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
215aec6fc1bf0bef025c528ab5c3e4df

SHA1
63998f8a2c9c0de7f9d134a6e8858def8ccfc162

SHA256
e97a6355b016c4e9a1e8975276b7a2786176288b761d0cf335f69b5f215c35c8

SHA512
087bba9fa3c6b806cc12073dd85fce047b146b4ce759da6a5ed2cbdcbbbdd2942322b203b655b56150498cffa8df782585c0e2b20c96550accfb6cd33eeb2162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0d46f8d92628539b00720153017020b

SHA1
549198edd438b8d5230a712f5fa7622992246824

SHA256
124fe40923bc7fd80c0b8e969769103d6fb5a45f63e6f93b28fae194e4222eee

SHA512
f4c18d42e42a3eef069b39f162e9eff0744f02a2c30eb7c794b26f135c3e766d1f211f5a36bba249191bcbdf346ea348bfa034bf9f488797b755c554a4c5a11a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0668f9f4f6dc99d08f628064eabe9a23

SHA1
f6e8bd0cc54055627a460f4abf8a6312291312c3

SHA256
b4471cf5161f98281e7dcab7bfe01020e7f10f09ff3f7d595a5879b051a5e8dc

SHA512
216ca7fa343a4e2b648d1db700e46a51079c734a0439d8ea0f7dda3a63ce9374fbc5427eb50a7c09c0aec0dca2133aedd12e82fe4c7314fcd06d22b774e5b8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab481B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar543E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit