7e785376eaa4aed04b11e82c9d2fac5cd83786445b69c9b81848bca0a5af2459

Analysis

max time kernel
137s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79be09976769c8e32e9450e4d89953e5.html
Size

183KB
MD5

79be09976769c8e32e9450e4d89953e5
SHA1

da3e68382f3eee77b1e3bfa82c22bc152658f9df
SHA256

7e785376eaa4aed04b11e82c9d2fac5cd83786445b69c9b81848bca0a5af2459
SHA512

13169a1549d9be0ea86e2ffda4fd8dff345eeed0a96b34cec2e547ec56e99b0cca132e7dd4634e4646853b989acdceaec60e287a792473211e2bdfbe1c2db1a0
SSDEEP

3072:SU5ZSpyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SeEMsMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56BD20C1-A18D-11EE-A5E0-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000063db163498651c1e75066e6ce407c7fae01236a1faeaf58e9a4ef50aacabd00d000000000e8000000002000020000000974e8b13d3906f517223e2f62eef4b116f6bd0477f2ec825237d3ea5181c820690000000c6cc8ec14447e2a5df01b17c86abb5221fdd3bed38c1e9762ea21ce4fb0d58da5b04a7a17739cab3ebf8e9f033430490d6a6f24d658ed9bc0e256c61a34e5a21ee2c93e48a93d464266e3d223aa9d1f07046b9de9574fdfe90c66532d9d5fce9292ab4a94f56367e613f131053807154f90c4b5addc304e7630061ca9a1cd5265ed25565b91eaf57f299d65f0644c1384000000046fbb9479ca07334da78ffcce8e32e89d5d2d186df5e3202c7aff3ef50ed802575eced6fe95d58b7bb9f5c253a27de634c3efc37c9fbac76e1230885d9c268ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409495762"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70995b2b9a35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000046ec40222fbd5abc1d16a604ef52e291f8ea4c98956d2d465f7715cea858be58000000000e8000000002000020000000f2e5be6310be19c578f7f86e613b5eedb17d444d7b2d52d3ca7fb77824aea00d20000000fadf365f67fa264a7ec0e7974e06e8f56029fa6d8e0e8d3abd272141f11b3276400000005359fedebeb2137301b56e853762c24a184ed75917e02fc7a0ea60b4a7906a56e7add9745bcf4cc9058682c3c766cba1de92769903ea170fa04b31ce60a0dbfd	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2384	2404	iexplore.exe	28
PID 2404 wrote to memory of 2384	2404	iexplore.exe	28
PID 2404 wrote to memory of 2384	2404	iexplore.exe	28
PID 2404 wrote to memory of 2384	2404	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79be09976769c8e32e9450e4d89953e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9bd17acda998d12454b8369c819cb5f

SHA1
9b2ca0ad24fa46eaa3e3db18a8307305523377b9

SHA256
0f2f6095d3517cd490c0ba9449f088a157085cdf45db43209bdb686a629430ec

SHA512
6fec338ffc62d8e03b6b559d8495c058ec9340a167676f252fd824f4d1e88dc2797bd8011ec273b4529a07e47fbbcc970f7de6af52b5684adb02a88a746f9e8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
001f78aa6befba4e00fec756ff63256f

SHA1
3ed358720fecbe5c45cac8e56f91f5bcf90f49ea

SHA256
713325c62f6b4a14bce70e7fbd78ade781a72fea581a8d98c846bd724deb494f

SHA512
ef420a8c2c23707b53545a834cfc1fa8729d0c00375d951fbc89131f9df0467f5a62822851bae4bdd9e2ce6eae415c0745245ae195ca77fd402b268cd6ad55cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d26cf69a0148d1b30abd7131788f1ff

SHA1
f835485160a0eb43dd1d6899369c389450dfb889

SHA256
d53ef705b781bf4b1070226c5a55fc186102198b16305346c29454e8209604ec

SHA512
4ef2f9b57c91215eefa09e2b865731800474c3fdb215d66682e2c7546df3de37dcd0990d4117745cc8f08f503c830adc495190f1002d2f84a73d58facde779e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bf53ef35a606fd626b2cf6a341709a4

SHA1
0349e35ab6d1648b4e02b86935949ecb613c40e9

SHA256
27b4ac18542625cae33a3971104e78cdbb81c130b95e42835c5164ede97b4c81

SHA512
4348c9501c6c1697b0720834f271a6d13f7d6098e00784f712d466a53c0bd7156f346622cc0013ba7929d84b0c3609507fec758840ccc6f421eafad90507e7f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd30d2a7ce5203f3062de5c7846a6fc7

SHA1
d8a92be201bbaf31558f7b91c6a6003986a07766

SHA256
7403bc8030acc7253b8467349e7f5518538950633883d09c4b29a7f700d107e6

SHA512
3278e07a55cb63b387b671b14dc867d6f0a931174b5537ba3d3222d067de94a66dff1adac22723ce608f0cd5360ca93911ef667eb03460305b7de6ff65c565f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5035be2c6fb778a214d028052c142be

SHA1
cf672dc65aff34ed2d6b7eee96739dfd5a5b6758

SHA256
a1389cc09842df3a12e1d65553ae2dabaf358f8122a0a50ad384f1bec991d5c0

SHA512
4e620359c6935267842406c836b720d13d4fffd02d492fad8bfd422bdb9ce386736bb86d98a87f08cd0b7a088bed981aef76e6586066359d7b7c6be23fcdfb29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
090b6aedf88b5c9cd3a47744cefae28a

SHA1
345ccb77bab019464eba0fbb214caff7d9e0dc82

SHA256
ecfb3d1875b3421bd7624b2ffbed3e6b0465fe74feeb22a2f24107b7e2f7cc0a

SHA512
036c15785ab2eda8034a6baa2483d1eaafa04c933dad02b3d95923d2ffecd701760b1b840b525197b935a4d1bdf169868675d1e93afb91f36b028935dc71c2e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dbe2d8763ffec94f29ea51c99fb59a8

SHA1
f017ca20a08ce430b894ba5b5324befb3684689d

SHA256
eb3c38a2084e9097c93cdc5ff67fa82b9a501f6fd0a3e486b52875a73dcb210f

SHA512
2857689e1f8bd25fe0bddb66d613b3be07a3d6a08fe45197840269c5c987753794cacf7af284bba8418b8342668e67e72f1a72ea060c2b96860792c11ba1fa02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25890251b746abc0ec94d3ff558332a7

SHA1
c409ed95d1c33a8944d63edf583515f254877fcd

SHA256
86806a5c3f782f039555cfff7096e780cad4a7bbdcbba6bac9035f1813b6710b

SHA512
1d9ad973caf6cb7b76a0175a41177a2d4f9ec4218a7151adc617f5f6360e86411dc8effb1b650d037bdfc10071837b838b6869e5e0eb1b7cfa59fdbc325f42d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22365886e2346800edb1fcbd7d3e38e5

SHA1
8dfa56c07fcdd03cf61e6f1dde9932bb564bd3f4

SHA256
78796cb5a881b9abf5b432a2ef2fbc31528b842b76e1cb60d550017cb6c44e40

SHA512
3567ccf513da9b15bac7f30f15d5a0c6390660181ff8e35618a15692640ddbcfefae1ee8d6cd994a0f99a90e893207426ef0448b6779f093f219d03acf74aa25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64c63e2550d974a8c0f6591aada06179

SHA1
c2f6192354a4586052ff41b8aab19e7a4fc073ad

SHA256
6994fc114288c8d1e8cc42b43f2b6c6dbd9bdf3dea1d3f3ce31d65c7e88860cf

SHA512
dbec4cca0ba4795038b67dab8e41957f11bc5763207bc7eb1f3c19a88d8c75fe7bf3f225f2700e6dd696da129af5157e81987fe4ef377552641a0f8e711eeee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f23a374e7ddede3a147a83a52b4764f

SHA1
c16e53ef7e50168cb50649dfa1d3fbbff1a47639

SHA256
0e985a92346811d748d31f121f0392a8946d1ad8dd4800a9990f0b8f676b5ef6

SHA512
96a99295ea264147358d864d9da47806391a0d6c770a520432a004aa38c4688ea5aa782784b8a9095ef7595df9a9dfe8e472bbdaf11e6f61e74bb143eb216ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8803b55efe530298b6e83a4d65a326a0

SHA1
a991d69622bf956e1483638c7e061292a2124701

SHA256
400ee067443f5ec9d51398a63349803a678686ad6a8d227b82796204a6dee7ae

SHA512
ffdd3ac223e1b8a168d70f84ea2d822b95c460ccac9485f8e9792cf4807de11d76c5b53f463fd2ff21c9bea8274f3ef0ae41acac65228983ef84dfce198d6a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e9854f5b2d0b64960f40b920265c54b

SHA1
dfb04729a9dd926542761a05e5c0e3b7ef83792a

SHA256
6e7c896bd030eb7beb20c47eb450865081e9a390973447a6098822bc9a753ee0

SHA512
536f4f0cf43e42e589f9a1a6caea040efc90aa6ff94edcf345a40f7f9be191f06c0c55ffdf8b17ec47b7e1d31bb9acbc9c9219c4efb762487003cc2b93d0a030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ad4f3dc792251d6802befbc9cf699d0

SHA1
72bd0d519cf01b7e35201625a37974deccd6568e

SHA256
f4d0c9d9cecbe28ec172ebd72d0bed2daa2a4f482b73c0d73bce20b44cca6192

SHA512
1ecf6a5999f34297c793b8450b8a491984f0a089977e4b0a6b4bc8d83c7e60439a1d83224a7199d28e9a9f05031db19460ee60c93335595771ec9c142baad3e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4a97198e8225a470ee69d372dff196a

SHA1
1365b72aa30dae72a490e980dc18621d68e0f174

SHA256
bf3cb8fc8ccd119762880016fda3b45e74c41a6d37aaeb5ff5b1f72a8ffd8676

SHA512
a48ee1feb323776588220f7d44878afeff792dbecfbef0a2bb0898455b5eaa4b7dcc58b1c919a7bf5d2aa58b50a75d93e12612cd106e2a1c2dc98bbc6ec6a87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3286.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3337.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit