659529c3e67d53ac447df3cfad1c8546d41967d809048c0c4a2ec0788b4e11d1

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f3915e6f6ec1d2e97e8d30e86669191.html
Size

570B
MD5

7f3915e6f6ec1d2e97e8d30e86669191
SHA1

268ce0a55d121a0d318f4d7d4c54156fa8ce212b
SHA256

659529c3e67d53ac447df3cfad1c8546d41967d809048c0c4a2ec0788b4e11d1
SHA512

99d2852cc5e6300166446d9d9c206e4e0f75887aaf0441e3f59a59fc16509b95829c5610518c1126919ec7c63ee105699d82bbaa6c8996b1a3ae6056f77b5fbc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000003b18c2a9fac42df84fcaaaa1d079591e7015a2ef867e4493d800c49066b21575000000000e8000000002000020000000bdace1df14c4dc2d4bc4ae0fb6c73c1beb7e6a462ec2105727e797712a1d8d9a900000001221dad091e67b6b99f973025e0069206039c310adbed4d5e1be0907d6e56f060cd53c552e2d5ae56364c29297da91139cc24762caf9ee83ff7500b814d1d127f59c2590dfa707c52e0823db53cc424cc4e3c82434efc297e627bea49ecf902a99d98290e6150277651e31c83ea5705ccb765a672e79f708f3163874847655511a14728f7f54fc796834474220c149e740000000751c52aa5160d711fed34639d11155f83c8c39dad2e567716753b015dcfe0e86ecfc798974541ed47e2c703a65286c23293a02e1b4e8cd473da6e86c3b6de13e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5468A281-A193-11EE-8D15-FA7CD17678B7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000009d0b55e915c7b4fccb0171e46d66d1f129c256513d1ba445c9d07f5f5ef51d29000000000e8000000002000020000000055a2df3e5c34d6e994c197687701793e60c42ee566ec088142f7549de541ae1200000007fd8f8d5d5859f4828550c62e8a0a23fd8753734a5fa87adba290a89acf8a3be4000000032ca9ef3aef6702d2bbfa5c54adb0770cf29f14ba1910d5b891de79a2518ec78e113cba50998a7f4b9629cba5675c7c88b73389d927515fbc00d55a46f75a594	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f5b52da035da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409498333"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2172	3024	iexplore.exe	16
PID 3024 wrote to memory of 2172	3024	iexplore.exe	16
PID 3024 wrote to memory of 2172	3024	iexplore.exe	16
PID 3024 wrote to memory of 2172	3024	iexplore.exe	16

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f3915e6f6ec1d2e97e8d30e86669191.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9e55b1765c180626ab6d47ab437573aa

SHA1
c102c723929ae4a26886aaf2215fa61b22e2efa5

SHA256
605b7d3e8dc66b27adf768b335d9c8e23cb5faddb9dadbdf79c4c87b4ce1384f

SHA512
c840b51584700ed19216d0e0b6be6f20c5823ece8dcc659decc83940c5cc3b44cd801ec619857d560f29e9addceb834257d191ab48d28ed9b645697bfd481faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2605d61eafbcaf2274289e8a7175552a

SHA1
95fbd1804a3467e9cdfd6f5b870dd21b9caed22f

SHA256
7c9732202a36c9640ef9d080a346215372ec2551d0c3b62f1dd519731267685f

SHA512
dabbfcb590cb7c6f6cb8340c442b3bca8ae8a241f46c23b49d60fedd117cbb1006c268ca43c72333d506388376bd3507b4056a3b246fb14ae86bce28e893a56f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5c8a9496c3680662f442b1d2d6c233e

SHA1
b5f53765f3a84da0a0938281824fffd399ce7bcb

SHA256
d986e5ce688ea0b263be98d66c1e0f957a8d0c515bb2cbcef455fd3717a46491

SHA512
643d717f234f6b082755a4f38126fafc66712e9e1f7af8020462475f0ab58a2e598e06e6e456e45e95e863ce26f46144452974d4fd6ffab31549fb37da1b203a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2fafedbbde184ac893005c8f61bf0cd

SHA1
61a41cac1fd9c4b9eb03e5d7264baaed2d6e0898

SHA256
986d021d40e975a6fca569cb5e5a75fd179f53b5b35452fff3dbae2a6f85e73d

SHA512
5643a096a26791b08c9d2edf2886830c994751449118eac73db4a157dab33787911d6abb4e603c44f06c9ced9dfa9e174439fd7f7dbc4a9d417137c109940814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eae9e2b682e6a28240a0499254f40cd9

SHA1
545250996a7150658ecaba42eafe0826eab5af0d

SHA256
11ca9480b583d6014c44374c30d42b460ce497b6e8409254245cab3345c0d969

SHA512
c41c2517f234beffd424d8753714305beacb44ae829c5a068bc3a094b76e3e101a9247f533ea0d7441359a6a63bebd6a8546626cddfcd817c1416c389abe0b53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c86686800c753d3e31ae096a462662af

SHA1
3dbcfc98887ffb4ec3ed66e3c5b359a26d406904

SHA256
739c5c9d8008c6266d2b1160f92b6924b75940d98c2388132ecf1f24446f078b

SHA512
fd38c49f8c135f47fe9a8eac1ea8e352f99db5c2e5658500a9510c06a9441ef42eb4a845d5ffaad448ea5bf3ef72943547d77ca175d1bb6b487471bc3dd00645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f05f82ea6136afa39094232b072b222

SHA1
18dc51c3fd6947d45498e29c56767650d575bf1a

SHA256
8e50d0e3b90a4aecfe53a39189328c5ac881ab9b1ce215623b926283e7aff081

SHA512
e7f0ad7db962ebd6b9a55b9b0877b97ec45834604f879c4461ab5ef1556cfea124bc373f2cdb101a395ff898192d90f5b0cf1c97e42dcf88f047aab967c77c6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7abbabe93f5c127a18cf336a2b6108b

SHA1
2404969e77a766217d02c8c73be89013f2204ae2

SHA256
bc3709bd972a351e4a1ccab725514b7c5e06fb1e393c119493b0782c8229ecc2

SHA512
6ccd1f577f2ad7e2a01afabda657b02a40fc356b970ce3a706938d1253a404566ff12e35e7465f02d486473b8418925a61846444345bae3bef30000002f896c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d2c3ac2586f29199aaef3037eb76ec8

SHA1
1367f919e9938fda958854b62f5cfe5461736235

SHA256
8b92ff28f131f69b7cdbd3ee89be946ba2f3247da12b262c87578c8620d2e588

SHA512
cae0f51ee85e99b842f8f449e3bf6783dc325b8fd1715a60d040b95cbdef3b66acbcfeb4b125e4c8038a8f59111ad7f9eb1367348006cb5717e1f935767b8e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc5dfea60afa170725c39203672dbaa3

SHA1
3d32f5f645d8cbd24acbc37855638612c1f8caa9

SHA256
0d3594b294c66b973dec29b69ab5ed07bdda5cc36f095270ca53fcc317cb5e4c

SHA512
75bcb023c1978aabb9c645e2f8903f8cc9e3497e73afa6f66376ce57d34598d1050d09f87d0f7c056e01c9c1fda65fa2ef4fa24f5c927165f7abceed2dbca689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b504e1c838ed2d62c8e0662bcc59f97c

SHA1
bdd2d15ff43b48177216546471709396fb75e674

SHA256
d87e236e0be9d6b0085607727b2c8fef061833947dd5846f2d83503016f059ab

SHA512
4588f5552ff0c667b6b44e95db9ba13d37765d25db60dd590b2a62160f0e4e867a895c20f4d8da7cccdf153f89dee637d39aafc9fd3f651aa5c97f024e9533e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
49d26f06d93f9bc27f91a39bee7e144b

SHA1
7384e5e997fbb72543d40c9f9ea47b1327baf9d6

SHA256
e294f31106b09a412891551a3adeeacad73bc9090d3d1838aebb41a82032e25d

SHA512
2ddc0efc9ed79de9ffc09be2b6558879a9aebe29fe3e9826dc359f1ab9498acfeaf0fa3ad5d9fd14405bdb980da00fa3e09b37b7bab0c5df17ec4dea5b2f9784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar343F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit