7d9db8e21b5763d31e47600669b6b5169c96c2b6d847c62ae51cefe71d6a2acd

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

852886002aea73d14509a3a826b74b9d.html
Size

14KB
MD5

852886002aea73d14509a3a826b74b9d
SHA1

c0ec2ce72cc393e316c9b0696a3cb68200c2c6ff
SHA256

7d9db8e21b5763d31e47600669b6b5169c96c2b6d847c62ae51cefe71d6a2acd
SHA512

173e41ca829a04c9d0ecbaa91a8076c858c92c9c45238b7580f2eeba904387485175dfdde0473c39752098b6f283e4d9bb9c334b45417d77cf0f99df90e0930f
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vFmlKt6DvE:aioWD/ZmXg8SZQSmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d324a6a835da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409501980"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D048B9F1-A19B-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000bb6ed3b557da390a1395c3c1a95998c074229ccbc0d55536eb84c5dd4aa90453000000000e80000000020000200000001982e546426ce2d24db0e8a29be654c7e60c0a9dd58b436470d30cfa2fef3b2d20000000c6fe8e2cce6b6b83a1c2ac64dff9f9fa154b540947fd9ae5a2028de441acb22e400000002bebd876835e8cdcf67e52a15d84afd2751d13897705cc3870155d775e183df3351fdb8dd18494f4a599ae5df5bb9da27ce68e9e7bfee635bc5166f6301596c4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000059ebf1407e475c1a7319de78df515ec03cc0081f37a7ff153e29d22ffa243aea000000000e80000000020000200000008012a5cb35cf1f0a708c1344d1e98e8fe195f2935ef591d02318b3dc7abf9d70900000003048068fbdc3999f86dc8191fcbdbfc82282d41a0c791281f98674b6e418becc9023b57fa83f06e822d8c7bd9db3e0f37063b3983fd4a65143ff618fd4a58e4e3611c4f81fcbc2f43d0b1d4f6fcc0c5f12dbbd9c58a50d40ba7b25155f0928cfaaf233ddc67594311704168becf54417266fd58b66aaa158e00553ed00512cce2af1c8225f1969dd9a0ae15bb1671e1f40000000c5f9a3fb5581a4a795db663cfb621baadbdc034c77f3eb08e2c860b8b3af0f336efbb5383769815df2aad29c978f43dfc3fe3e93a40c788cc6afda0914de386c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2912	2000	iexplore.exe	28
PID 2000 wrote to memory of 2912	2000	iexplore.exe	28
PID 2000 wrote to memory of 2912	2000	iexplore.exe	28
PID 2000 wrote to memory of 2912	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\852886002aea73d14509a3a826b74b9d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3acc974fd8f9c44537a848dbf1188b07

SHA1
ec27bd8293fb05e877ec9612d0efdebbb4ba169f

SHA256
c72c7139b8eee0386352ba5d05275e50b3febdf82901d0b2ec0ec30f3c0d2583

SHA512
a957d753e67fa77facc77a5fbc357c7bf8568e2ead99c8fd9a31cecfde8b2297e9508db5da5a393b4daf31a69e19a5d47e3ed9da56325e4f37910619221f53bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2db202f4d360c540f6cc111d7514708b

SHA1
8513b3b0285c7c554e26b595e3deb6d3ec2eb743

SHA256
637fd46ae9cf6e16ac068713adf5c165f86375abc0ee3b0d5a28e1ae10d22e38

SHA512
90e07c91ffd363306aa4af6289399e82aef1751ebc06a57fbd1f4f453cd992892e9f0577e76883e4b9b16e8df3c9ef899d69f264442dbeedee01b21a9ce65d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa790cf30ac96f1cc5a32cfa78158a9c

SHA1
9f4001fe6ccd6cd3dc966535aa70f8e56e984c1a

SHA256
72d85230459af0738a7ab6c25608a8a8ed5add7b6266decf07a64d92bbfac539

SHA512
aa3b506bbbc2621d6c7d461dd926ca89133d31e71b49a1c9a8704cf6dd5962be4fa9416d329ac51c74de16f956f054f5286b6e3df9425a3708dec2ee70304dae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8d22b3d18a9980aad9c4634a08a6596

SHA1
18d6bb5d88f368ba01f6a114abd712030ceafd64

SHA256
a5a2414262dfddeae0e900245ad3935e03f8934d47d1b9bf2c0ea692be97cf12

SHA512
6f881918fbc2645a9cbd76cd8411ade066d20c64c48450499acf0e3c69e0101886e02082a664005a42b58e2a1ea75fdc2b70b8086e9a4a7948609067248e7277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a2dfde65bf32ae6a5eca27a89855393

SHA1
f0c9ec928a446bbad082ae6809063726d6aeaf92

SHA256
6661a877cd647601606fad2598c2a9d0dcf153efc46aa0bde297d2cf5708b81d

SHA512
cf4a760b509cdf735688585113d8d1284d9bf36ff717ade83bbdcd232b3b852155355c3949b6ccc4502817aebef3bc81b328a705ff2ef805c91211f28d892f17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e4ec7cf135e52790c76a1d911455fbc

SHA1
6c2a84fd6d20d4121679f071649457516684af7e

SHA256
e1484d593c6321ac203d9a53ce59a37944a3519c8eb836fe42da1bacb7a8c28e

SHA512
b79c1272e036e54d231fa5ba5d770728bd4864a2ddfc71a3e91bafb35343b166925d56f4c5451499884f0f874a558f7c7585f33d3a3e585558cb3aab5ec82af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d4aa2b85ac7b90678d85bb5f1f6770

SHA1
9834a18a9535151a3172015fca5febcd9cf23e6b

SHA256
22357dea29c4566f1d9be3f479dea089a78dcdc3cd8da1a8a1e6154376700b69

SHA512
b30196c73c9f71b1a0504d4a8ccab3a215219c5d430d61f825ad5cb1c63b5e9451ea1a6eb80692bc0f452c62e82e25e67257f3b21ef1bfe22faddf52776fb30d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f05eb26d9a69d912f851968341bec4fe

SHA1
980012f62081b54f54f1a6014dbf76606f46bfc2

SHA256
cfa5840188a9f80fa606ed1939b03913ef8a4f79186761131781d004a24aa052

SHA512
a7dd50b8bf60e07485d642aa9a106257b48b52f4df98d570bd79759a8b811f6ad89b24c2aa892df30f3e3f82b09833705b27e45971c425997bb3b78e99f1d695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b4e672d5131683857d469d78fd284f5

SHA1
4d7995af5fdadb9258f0f160dba5257ecea965ff

SHA256
e4cce139794a68f764f4d81cdc5007b204b108dfd14785e8c66284d1130543a4

SHA512
78eb9977771f508752d078c970cb4d12f69f0d69754aada28ab7c6da56645d3203ffcd611cc1672a86a8742dd402c58f5243674013b4cab28fe03704064f582d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bce4d32c76c5190405edf999d875fa4d

SHA1
59dce39c33bf99afce8414321c702497c2c6016e

SHA256
5849e5813b7917f7ad3d4f296ebabb255e0c32030034c9055d7b713a55488f5d

SHA512
51e7fb5cd68aa8a81a8d15665e9de3c4520131b5736c76014d0ce342d7e921b7786d4f59826c6dd17a969b334f15e6a52b256caa5405b9a8e65c090abddb238d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e259c76fd7a5bbe2d5a9d46ad7af78fa

SHA1
cb79c5fcacaa04303f48bf2708ea5e8f576f9a3d

SHA256
518b09710ff9f69b448c8c4303eb71597a154eee97b54d0f12fbec861dc86ad3

SHA512
0777d960cde6cd6a18ae69972637b5308589b6d16f499c1284410983b5e06be4473c0d9bd4f325d56c4f663e89ac8426436ff0f5e178cee34d55a6baa44d935a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c11553d3092032d479ef9fad8edcad9

SHA1
8b52e2dcabff517b88f94cbb5a86acf2d351fc52

SHA256
12ab4dd4d82ef61b3e7aabc25b60bbaeebda39347d4cf5ec1a1952059eb4c027

SHA512
f320706deba3d5198dd7aae38b5087d1f16b12ab08615e7e2fade5484021c5e91ee7f35c9624b7b2e6082d1c36bd5a8bdc4bf798014a0d4ca83452a703d207f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03d30ba3e32d63cd8d1bf31701fb3938

SHA1
ca7edc53085087e3088c712eca9ec8e4edebe2d5

SHA256
4b67c5eca615205f9e6da2ddcdd7e85807b6f40db01f7040ed0f45ac2cd96303

SHA512
72dfd6999e3db50b077a365909e58c87ecb1fdfb40dd862952bf0f04f90e984d144e6422278e9f62b6167aad50e0bfef8db19dfc4cfe922a618b90af3512e9be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e201d9f1f91f8183653cf0dd35683490

SHA1
c9d3fb73b1ce9d0c47b06a7a4ef3cc5a7f9037fc

SHA256
f409ac6a19db373fe209d29b57c0197a90c783127ba4f55f0262c1cd692aa76f

SHA512
121862f8209b672be69dcb8b26cf26d176166baeeb5fdac75a1e5692232d3537582b11e9e8a4cf4725bd41af51f416b7cfa42e1cb7348c1550c704bb68402716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc6ebe8f15f0fe1638523f51f1c54c09

SHA1
63f6a8c9ce3435f69d09ace5a26f4974c99c9603

SHA256
ca1e8d024e57f0209a4ff37e7b55b556d9dd145212a61dbfdabb2273d2f67f7d

SHA512
c85c4e348580484c7e78376c07f67616b57f2dc6847727671bf8b78deaed16ebe7579e51125297df3b8426c4f1b597dad2166fa3f2fe00a17a25eb433d6813c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab895D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A3C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit