e445aae890f87fb082fe24005af2aef965986746b09cf794dbf969808768a2c0

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b7874aa11753c442ad4b07ca105e537.html
Size

601B
MD5

8b7874aa11753c442ad4b07ca105e537
SHA1

845b2b80d5afed7b2767e29b162f3b6cb3d0c066
SHA256

e445aae890f87fb082fe24005af2aef965986746b09cf794dbf969808768a2c0
SHA512

2063d6f5a0ff88cc6becc2d5283426547a3228d7858fffdbb08b5f139f04d53f6d6ec848f70eeef9230d615f34d35097f5235207cf4127657ccc4be11afb4600

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03743ded034da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e9931b60efec5d7befa68dd5048ca0c3fc6c1cf96ea5d956d5695afd6ad0f191000000000e8000000002000020000000a0c961e3682a590595c0426c4473e148bf10ebb1cad936b4de37139b58a7cfb690000000f5cad6cdbc4b942851361c53dc324dd8d98aacb25b4aa7a4ddf42507292023f0dc243db2b3c01f75fdf1878bddb733525543a67107ce444153515ef6b4c01969ab8d32271a0a9fd123f757924ee5897afc5d82c674f52a33b8b8a9bd6028989711640fec65d9b0cd12a205ac941e559f19f0ab69dadfb9441c1b9d0733104e85a20e7a93799a4fd1704496a79ce15854400000009ee6d881937e4d40fd9d09005e8aa3101bd3daa8f685af9bf93bb476ef4d160846115fd0e4bf83e486b113a36fba23718c630dfc0e1dd37a601cf81e2cf5995e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ebb042de1991982a00b66bcb860f4fe8dfa414569e538425fc22105025eb542e000000000e80000000020000200000005d5967108a867dca87dbe2512febc75614cb068c3d6bb3c0c6889d211f0e18a3200000001d0510dbbd7c998d7b507a3cd475b3b095ee64019b0fae8643e849783268290d40000000bdeb8906e28726732be966c9772cca5cf4a10bcc58ac3a480c456fd863648461b83f6443a31a3144a33320fc6335b09c7f7d665643f579389625633dc3a48567	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409409330"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A9C38C1-A0C4-11EE-B279-56B3956C75C7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
660	iexplore.exe
660	iexplore.exe
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 1820	660	iexplore.exe	28
PID 660 wrote to memory of 1820	660	iexplore.exe	28
PID 660 wrote to memory of 1820	660	iexplore.exe	28
PID 660 wrote to memory of 1820	660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b7874aa11753c442ad4b07ca105e537.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd534b86db082acb3adecf68b8ab29d8

SHA1
a434294bddf54527b011df89a4e8b5d6b0d243e5

SHA256
2f244fd8534a25046c5b7e009003d062073d4cd4f3e26262d47ce59b766d4acd

SHA512
7cd6db869343542ce5b97b307806c8625167629c69fc577b34c5739a3b8cfe43f47c50a6efb1ddc5d778593c5cc0c1f94f9792ed332d2a94d539008d53b24601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
836eaf90e1e0d3bc71c52bbb55c219aa

SHA1
5310bb5b137fbc65e212515364989d9a304e223b

SHA256
4d7e622c801bc7e1e053cc9424f16dea0ece3f5af88f9d9e6be628d1805994ef

SHA512
cf5a5fe57cbf810c64deede5ff6aca8abf6e7d75e51672f30f68ee26b26946f39ea3ced6457e766de97d5cb053e34dc5fcc3661db660b1dcbaaa0773832c48b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9f672971c235a700b45650a23de1b8

SHA1
24713f97773c9cc4dde81fba24e467e2f723cb80

SHA256
3cfab8fe9994d3df21b9e030e52f23fd635e2cd75e012ef3ef228ba61947180e

SHA512
fcf8b3691984142c5c9d21b1a1a810a215ca321e4dd6c70404c7487193dcc6410e6ec9629e88cc4a42e0fcdc17ec7729ad525550a72dfbe03750a6d90f4ca0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5895c7c2d71ee11287e4b0dc595df42

SHA1
8df6c79c60f4f6c6dcd71db6e734e5458f5747eb

SHA256
83800e07ec9ec9c0a022b6097c464bb5f5c9c2a84e15f9a4d8feca8b41f22aaf

SHA512
be6aa8fdfca69ea3224c4cc6f9fd254554bd7dcce3932dbe51e9d64faffe81bf98e0686b301bd158e5b7501ebad053bf3771297ff8bf1cd6655bad2af4d70292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bb19c3e4abcfa883c4bbfe2413d3d11

SHA1
b7aded305929013a04c1d87beb1e507f738c42c9

SHA256
b3652d60bf13e1ba698d4685085495d2452dd23cd8f45f15eb2ca5bf8920196a

SHA512
8b23cf521c028a96553e1f3b4ded61ab96ae123787d1746b8ba31a7aaef7dba1b207cda89463849fa261edb517ae5518f73a90b662c23f68b30d07121f6dcb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da7056e2fcc49e6cc8f8ad4f80a576f0

SHA1
d8e0f9feb5e6df6ba0d599a7c1778c24939ec654

SHA256
2b84f6632162bc198970bebe6c5c535e5db4966d85131f26ab851c3ca29dcbe3

SHA512
3417c0f3a2cc4dd61a046dea550e9f66c88ee373054b6bf75696640c52e52964c8821b858f9e26bf346c47eaed35b9d81430ff908576a2994e1069b0d41ec55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2cecc8dd745a9f08cd79823f38b2ab9

SHA1
328b0a5073a938c5a677c0cb1eeb0588532f1d85

SHA256
393067be9d00dbf9a4fdaf2e7f7b0832afe9b0cd3ccfec7e5cf8566d7257aed5

SHA512
62ec0619d8bf74d1ecbbe4ddf20e1645dd108c2f5ab857107575526e26caab07ab7d669f580a0a7a5fb0cdc4e4805199993fc3999f952f7b7e2e1dc52b72d6b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c00ba5df9df36baa4fca1cb515112e

SHA1
78a901f309b94cd36b8d1da8ee106999310bfadb

SHA256
0836afda8a628a73c7c009a3ef3ec706b48b8f81d1962333fc1b9a031827a752

SHA512
d535e1d180408f76d3af79b74a35efee331e6f150f84e7b281051cca53d81293a0c270bebb293b98864b1b2f8d4d8852bae4edbfa4b02c419f1d69efe6006cb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c739de8dc00d302e98a989f393fa65e

SHA1
9b1f6a01abc9c6fa5b2d09987e6f4a9804a16e57

SHA256
3ca84d59d8a405fa20ce679f21514014866aef36c95d931bb815cd96dc1f52c5

SHA512
2edeb907ba8a57bb5193880962d0457e266b31fad3b8c2e37daf97d70889a9cb925194499a986f3ed69a0fb73fd8b741c0ff00e0d5fd01a16288a39180049a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c146b03828f4fe48b7063667cf32afc0

SHA1
baad2d6c38f2edbfa9bb4bb308641072eac0b5d3

SHA256
686b5710d23ca14e924c3cd2d5ee528e9903029d4f20e98bcc174c90f6c55b33

SHA512
e1ca2b9bbd92db912f5c44e6db9e9db59c9c1418a43e46e4d2bbe82571e937730145993615ae9a63dc5fb4e9b6ac343ffaa8b11e04e99ea3c1a391b12da55f94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40b5acc165bb2ae99b4028557aa6c34d

SHA1
58f0aee34df17306e68b564b04c78cdacbd5b263

SHA256
9be1455b71f2a13dc9f5a2a7f0f250e9b643afcdb09aa4b29795196965f1b8f3

SHA512
8a9a19ea10702276b14e99e4acade7f8cdbcb1891da0daebab79bb67501cf31f1c1eb11a9aefe05b0ab524fb6bf8341f0c277766b4c2b67e25fed38e2356d2eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ca9319ce14e432be35c6b74a8805574

SHA1
005cec0251ccde26076f0715563d328f7357a3d3

SHA256
ebd350978aa27e34ac0e12c71c2b334835b5f408230ee2feb87218975feafc9c

SHA512
61bde79db13818bbe71812cbaaf46ae3eea69323c33f2ad9a521a5d3329da9413a2083de68aeac7f647b9afeb7ff174a1de452d351fd0f794481ed499b58bad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b210d96a0183aa0c0ec6dce3617d53d

SHA1
c644e5b445efe1c1def947dd326a7e2deea48615

SHA256
3399b17beeb94866039ab6ab50debbbc6a13fb9bb495553992bdbc79628dfe5d

SHA512
18f0eaa1dfec7b771fdb901b3dc60910ea7a5dd8eb8c7173fc4344368f7e3371673c4ea3ed04ec7e67fb6f1a50ee4fa6712c05bead2fa03df888642b85ad9fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1527ef91af5ec088caff68c7d92ca4be

SHA1
eac51281c400c84869414ba5f77fd231b6aa4666

SHA256
4e57ff1bca0330b1c802dccbf8cf600c64068140b4229de7b5e2f4d46b93d2ef

SHA512
b8105cbea06d9c6eaa9fd9e295e59d6fa6df62072bf0c6bce67104a3c4f85e107b4ee1115d47245d3ab126bdc86f5f8771d46a78effe98b615b71d1d477377d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24b0f131ea14cb1a4e8456b1148d2a9a

SHA1
e3442a5ae62d0ac895ace78a30a7cd83cdb2dea2

SHA256
996724c6645ac4e486a2915c3d950da66c37ef8fd0c18297a6dbb04668ae18f9

SHA512
16a1b5061f3c8ceeb83a4d0c16c7b1cbcbee6d0aa63fb6e24aeff80d5bf2851699f1e0aed3be55ffc3028cfb1d6a997cce485b2bf1e82d915343dd0c9cf3dcea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78acdf35b068bb63e375887f5dc53909

SHA1
4c62eeeb0ecd007dd372493996de6bb44d8b8a94

SHA256
4574dcd266810484514e670a8f96e8c46837db7a324d0c648164705f6ca6a569

SHA512
155f5cf2f9c15f85d1ad98286460f6346d687fa42a745ab0b2a0d7feacfaa50d2e35fb6d595a4171bd69194668ad67a63deeb097219067bff4a644b39cb3ff0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a7f4d22858c716faab3d2ffab7210cb

SHA1
3b3176b80316e3c94a5d7d940be34ad12f999231

SHA256
f423eba38b42a2c97562bae4491ef0fb90525e5f103d68f82c8aae8644ad3fe4

SHA512
aa8dec8cb3628e1a3b85850545fb3e8c439d409219c796b0e783382c43eb3534ccfc71dadabf798accc98917c2b57ac9a03335f7201f27a5953be56f0f1a86ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab479B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar482E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit