7f8e6d5bd6257b4ad6d8444b2d862725bf52eb4b02d95b94f1a603ccc60d638e

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

864e77fc107521e2454028c647b6d184.html
Size

2KB
MD5

864e77fc107521e2454028c647b6d184
SHA1

e4f3279815b187c4ddd7d8096c9b227a22de19b0
SHA256

7f8e6d5bd6257b4ad6d8444b2d862725bf52eb4b02d95b94f1a603ccc60d638e
SHA512

b0adb625f1f0149a202c5d240b861b868ba0b0e2d9b203f1b041b525d232b816fcbe7434e1c46bb2d9389d355db26eada3afc352bd590d7c10e92e55f2caee73

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409503029"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4235F851-A19E-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800eda16ab35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000025177cdebd8ea74c9f88f1e0a25274079bd50f18f2480fdd8afb08ee501cec90000000000e8000000002000020000000c250bcff85f1abe8b4291cdd9ff9e2d1f9c21bd9074161c5f7caebcb2c87e6972000000035e623a0032e6352f215293a762280cae5e51fdb5e25099e1a0c441c980bc661400000000baffcdb59844b8300cdd4c72228d5e64721cdd27dee826f44c0549f53db090df0c6a89aad2e254ba195636692144a276fac36b31ef182d2dfe129ee2f5fc803	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000004b826647aed8999a3d343646668a80a6ce8b12d7aa55b091d7e86030fb53875a000000000e800000000200002000000030754487018b5874bfaf5623e749279e75e848fefe47904d0dd1e17b186391ec90000000ea88d482d95d981009a880d5c868c6863f1641d27046ea45cf49aedbb1f547938df555735bf3fa738b03bdc78c93bcfb50130eda331f9d1d01a2f6f0911bd13fb6b8b5c5a1e8a2455ebd84d82ec7dbeb97ab32bb19a13dbe0de419e0fbf2ac6bd17b8d9812919c3bef814b05b929b713fe1e774549e7ed57e1ea2e6d06a74ed82cdcacf13049ebb0d22810153af3513340000000dac9722c3495dbe8cc62ae6a0e5cadb15afe56382d80fe65391df667a3f04dae1c6ee444051dd67b0bd40b2bdc417e18bbec54c3b46d762296f5f9e409ade73b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2104	1972	iexplore.exe	16
PID 1972 wrote to memory of 2104	1972	iexplore.exe	16
PID 1972 wrote to memory of 2104	1972	iexplore.exe	16
PID 1972 wrote to memory of 2104	1972	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\864e77fc107521e2454028c647b6d184.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e1c38b84b3b375e860a4f40d47fcbfe

SHA1
7487bad116526194c2732f1f4eee0956edfdb37b

SHA256
83b52ddc4b43174fb24e9a2bc5dd8fa66a01c6e9b86b52337a5204db0d91da8e

SHA512
655127b4222217275af965c2bc1d614951741129a70981eb1329985c863ae1de98c14d8c20a26dad176de459bee8d6eb6b38278d8840df65b53f87c44a939927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c8c03f54e5c6c8ce440d815dce8828f

SHA1
f77f0cb622c88d07cd89495e7ce5908514977684

SHA256
3f62ab4a92ef7b148a695e65cfc37c0f29d7f0a816ec51dd227ff47b087fc72e

SHA512
b5f8e46d5ef83f6603eb978771cf2743143d4686560117c1bcfb179189da9e0c5b55a7ea26863c2c6beaa373053af886e566409e871cca5a6db0b0a091e1efe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cac89d8aba59aa5e083e727833d12f7

SHA1
ddd0d50f4ec894b68cbb5541b2d293c61ce18690

SHA256
7c7c5d297f8005932e986e2a00de46160532b144ea261bef7bd762f67b63948d

SHA512
fae9ea593d052d6c722d3d7a87a2cc4f07bdc85b9e593667166901d178bf9a4755fe94c4145b47bb7f360f569acc61fcc063d49ea8bded2dc7ee310f10e88b05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8a44add5e663193ab80126d077d357

SHA1
d7d3adaa1fa5c474ad9f2f3c514c7f3e275f93dc

SHA256
f557a85de0bf5d11476d3321fd27a7f64bd9449dcb9dd6cee6ac2c1f11046f22

SHA512
17eaa64f6c2baf4ea644dea7fbb8140d8fa00a15de5c08d98711accef4860d3fc04523d8cfc1bdb0165270a90b6f0aba5487dd0121c78893f818fd5abe41f6e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55425528485b12a0da3133d7ad843188

SHA1
21f233d7dbd266f757a060963189566b6a275992

SHA256
5d4e6bf65351a858ff819d795d234be06e64b95d7e5ec34de00781f5c2696fac

SHA512
facbda47ab78c15c203a7f1d6aa155de65fa00af5698af77160b11d027fe6b1d5adc56a488075575bea2736e310070aca49324d4851cf780925876c03cfe3cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c886f753d1b6a17b3fdafb7db11a5803

SHA1
11aeadfc22fa8f177d15d20e520da75334e280b9

SHA256
3128e4f9d6af99f2e59b8f864ef716fa9df1181177a15c70572a286a490e63fd

SHA512
9f11ee8ab2a5f932484d3b6922a655dbba0732d64ea504b78b8bea18b37519551c1ec04418f16e9289b37ef9ec7331f65d6840f3d65e4bbe70205cd79ad6bb75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19cf8a7927825e519c5a3bdee809b8ae

SHA1
d274436eefa20db1b3d6b3f4d4e0adf2c9a9bf3d

SHA256
be32f1a34abd90118cd4960e98d073491656e4ed7e3bb0831af490205dee43c9

SHA512
dd890ef83ed702ef5260722e52be6df513a3ab0782301e5a252018e63540034b3ee006468df4c1bea3ffc8a1d69424d606b5ad39b813e8269d2bb41a63149c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
371c717a30e723d479669e8b426d83a4

SHA1
4602860e5ad0442639550f463b2fa36283256a3d

SHA256
5a06e3dcda87eb9d31afc93ce22122df7905657d8b59091342df10677fab6e85

SHA512
b16520516eab207868d7c45ad3454f539a97461f6a021e47ed7743cfe6f8f363ebadce99924730d519ad30f3b1ad1dbce5c3fc10849cff070c2391921f1b591e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
466e252cd8d9076fd5e6cec5be146299

SHA1
8e94456074eb8bbb7a9e06ae7a557950c1d44fa9

SHA256
0718a9dd2a11eeebdb558721b7167efa3ed210238564d1935d413e45f71f3598

SHA512
72bac57dec4a4a604451a938afc2b07767ecd53140dead355ca10944864aad50b5a232343837886a12f2896793a7e97aed036ce3b58be6b7b1e126616979d775

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5785.tmp

Filesize
59KB

MD5
3d34ed374c7676c7d7926395eaf0fa94

SHA1
239ca758791279508a256327b8da0f8ef05810eb

SHA256
059c4a1a0f6bba08374bde33dcdcdd3815ae7f98db51df32862eee75d0806720

SHA512
6b51a2cefb84c3a3768159d136cad2ba3c7c3d3b87272d8f6771a5d1e080bd1e5be602c859f3c4a9f29f786c189ac4c9650549e3099d1680f08cdcaf15cc6c66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57A8.tmp

Filesize
97KB

MD5
574205f54163a66e45464216cba7ffb4

SHA1
e9d4c2950f01dd5892102a9b6b74cf2af493ffa1

SHA256
56853fd2c42ad12bf74ca6a2d9b5785139d81afb365e73d47f9179d92ada606d

SHA512
664db63969ade4bfb1d3d5e2be1765ec6da297d2eb16f684371799bd110e5c56b7fa89e86133804f31fd031670c36cc8dd0a609d139a1e8c97bc4d6e127a04dc

Download Submit