6466c4cfbf2cd8684365d89f6d9684d80120d9d928f2c74b52569aead97bbd3e

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 08:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b9fe08874fe034896d77795c635b1e9.html
Size

1KB
MD5

7b9fe08874fe034896d77795c635b1e9
SHA1

9bf4db8fab191e336fc8c537f50fca4f562b90b3
SHA256

6466c4cfbf2cd8684365d89f6d9684d80120d9d928f2c74b52569aead97bbd3e
SHA512

0e4a5cd40e6f56db7bb06f1cffed4999f77f39dd1545e0e4d10c3ab024c9aa241b440d4d5479ea5fa56877238db2dad3377ae1b29da8277c0d23622d622048bf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b6868c3d2d3bcc44e38577f16b3c0b10aae547b279dd3824ae1119887dccfd6f000000000e80000000020000200000000963214743addd721f43ea0a5ae8180ecb5d204f3289b2014fae6d7bb8c40ae12000000088d4ceed0107d7f2c408b27a33622ea382d69b645f5069be7bbe32bc5326bbc640000000dcf645652c202db49cd6483cabc98b6a568d4765bde372e402ce55afabf93540783a32db2ec3a89fb5f608e6ea643b5577d068b5be4576c0bd274c4953f1eecb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ac42e5a6bad010e0fbd12377c72ac60fc0ef3b845d165eb9e640789f727e9ea4000000000e80000000020000200000002bf68c240eb42f726f712e792017f7e6e97f73c8da2006c16ea2111db36c029e90000000f27675c2bd85b097115712055dc907ea2b4698d33ba791850048bf35bea53c42cbaaf6d5e86edae1b7301a48c2de2be1f428b1f64d8c496d2715acdc26eaa0c7d14ed48f29509e02b0e34794fd5ce47b0d0516a5ff893593fd5f2d18db456e2fc09d09b318708ce53a9fbc662af1430df53e54f3cee2b3be325f7108bcca11f84847eea066d3180250c506571ad8123b400000004689f347a7dbd1927122ba36606a9d8e695bd6e1b205ff2379a40e6e3d625265212bf8f1aae345d74034f5cc816297cc40b25db2a64273aade164472585952f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c790079c35da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409496588"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41FF7501-A18F-11EE-BF8F-CE253106968E} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2700	2112	iexplore.exe	28
PID 2112 wrote to memory of 2700	2112	iexplore.exe	28
PID 2112 wrote to memory of 2700	2112	iexplore.exe	28
PID 2112 wrote to memory of 2700	2112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b9fe08874fe034896d77795c635b1e9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af677417b9e81172f3e1549aa4251716

SHA1
e96f3bd0a052501d9011eea369730bd5419ad869

SHA256
7f7b81ec2a1e6999ffb3629e2d417121ebe96297a0be76ab4914b35c81025c7b

SHA512
df81ca62c3c84f8b03f9cb14d9a4611b293aad559e1138ae322f98e517115ea0e45726f4ed3c037f71b5f8bfd88bb29298823400f6256f01e28bafb648d3141e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81fbe286e2491da9ddc6f7df1937ac1f

SHA1
52dd88e4dc0f8669f5f66fcf2f206efc7327c0d8

SHA256
8d14af806b2b5064dd8a868af078e6ef3bacca165f86ffa1e762f827b532788b

SHA512
1a8ee2ea833beb47351e84f3e2ac26e1bce186cf305cafb47ed96fc0065e5b82a097f8b07923bd4b46367c805b6a5f3cc6b12ce7e1e14afa95dbcb88fe6d4e6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbfd34440a1b8231e4a5b360612c5354

SHA1
79d8037c43a78614086c4047629614404d152392

SHA256
e3f33527f393089b4e8d5203f60a397c6a5020cc63cd3bede0241eae26245442

SHA512
f9e934a3435ffc2fe432865e4435eb513c072e61f9abe09c89a619dc1de0d768191d02d974e4c2e9e1f16840ac58d824e0e3e4581e131d8b4b769e5f507cc183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93c3705cb3bc3f40c52d1c2d07270477

SHA1
0648fd43b7f01fa2884a8994351717dbad578398

SHA256
5e55bb69f2596f0158c05199e8fdaa23002a22f622985a6c17702ac17593e843

SHA512
52ec975808916171bb8cf02a1eeeb3b41da85e712800c059d4653e64aaf8c6ba39a8ab9aa30691ac01f99ea8cadf7a2541ad1efd70a39372a819f1ec9ee8ac24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
327b553ed998dff3bc0c6349889e6e3e

SHA1
1239aa70a38fc7f1a54d7bd18b76ce18d4d88c4e

SHA256
b0da9d4bb67cce7b2458319b7e3aeb79439cb72ddd29c47c7a22041d6cfd264d

SHA512
22b06d7be6ec874e3474f486842866214740fe259c7ffb8112b325812bfcd1296bd00ebb2f5e4874078a98e228b9e47f076322b7f82d4857536cdf9f17c0d65a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06a57747febaee9251f60e1776559dec

SHA1
2082b9bde0a3fdc75b13c7466447185e900c385d

SHA256
b4866183c891f20149eaf1ed8b2979a7a933217204a192f45a8309f94057bae5

SHA512
6fc30f5ccea39a7e184d8eabe0d93d3e67c7dec44a3a0fbac177534f4e33d1ae4f2e4f8c0e5df64033f5dd88a655699dfb45bace10ab2b5106f98eeb4b2fdb16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b41560d9de03fe62b9acc3bab3646df

SHA1
ce3236a41c04d25fd600c233300bfd3c8e25a25c

SHA256
6e5bf095af4e90c1bda30ba981596820126da5d8ab832de984460a500f19da00

SHA512
4e4a6b249f67977781ec36d28d26f184ebeabebcb043ae35386aed99a144aa81762327b7ed828b9ebc3e544707dbc14b108d941fab232bfdb2236ca985005b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
621491a7f36ea915ec8d501d99fbc9c2

SHA1
00aec353685429e931da22554266b617a783f2d6

SHA256
d4b2d395710c1dfa311f2b7dbf4b2742cb6e664d8a07ce886741707cb5aec783

SHA512
c04ffbd5b0a1e55f723aebde8c5ba59d488b946fef1c39c978dcd151ed319007799927e6bb67c5c9310ed3dcb173f8ad7a385abc6dedad01f991c0bb68d4a589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d932113f5e7d2bceca35623a7ee6420d

SHA1
7a801f81e9bfd0e2e7edd211f6ea7df753fe70a4

SHA256
c1a94e7411aee16aa9fbe88702040046b302c62fbaa7ecbc070ef09266ebf3cd

SHA512
813df2c6f1336b16305b71a54c7f5160e045937d637732db62bb817654f00db7e3c0191714e20c02c2d11d36d994f72bba6b9b1216641fdb958393c997263155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e9ab33377c33ad23aaa0b2aa591519d

SHA1
8920076dead8a8d964afed2803d4440b9f212ded

SHA256
2b9bb2fbc750a3cbfb3992cbcdaf0dc7d72dd400cb824181a92c712400181728

SHA512
258ec0e0f5a806c318fad6b9edc41fb4a0a40d876517b291cef6f45489368b57d0272e3076250f3393763136789a8d02e698388f44ee358fd0f6738ee9238567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd528821f9c599df6f1a2fc37237d346

SHA1
9c7a16a7f78d2316aa4febe66ab9178e4c29d778

SHA256
6d066841058864e2b9bd6f5bc28075c5b9e76bbeacfac3f6de32c30fd7ca0e58

SHA512
66eccff84879b38c2dc55c611dd5a0efeec011dea08ce44abe5aa05582991d722bae7e769f533cb3a4aadc0f050d88c461dfabf849c506db2f39d9f9c71b0032

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab759E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7AA1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit