35914dd7ae8084f5dcb0e98b5d7fa9574b4c96a88f66ac3cf091c4fd233f1c3e

Analysis

max time kernel
117s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab6ee356825b76ee5a3c8c6662704735.html
Size

2KB
MD5

ab6ee356825b76ee5a3c8c6662704735
SHA1

a2dea634494bdf7f2d9ef6d21909faa6dce67b06
SHA256

35914dd7ae8084f5dcb0e98b5d7fa9574b4c96a88f66ac3cf091c4fd233f1c3e
SHA512

a7f4e81b6e1065844367a6a456774957b257afaa933918d850bb5155484c117368f8a22dffa7f62f56ff8efd1c8ed11bcbe6fb3bfced40c685da71d765b1ebf7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008b6940da3eb2fa5bea0c25524546f95fb20608bdba1f9ce46e935e170d683f6d000000000e800000000200002000000064f353d43cbc6bca336593d9fd8c305899583652a8bb440691f63e69ab3c10b4900000001617be7de95319ef29254bf940c869ca3f78f66a92352eb070c164a5d28da615ff7c6b7a40990af7aea0c9798e1fb1a3ecb451fb04f31176ab56e6d688df6974c78122930f0d1f15ae3f86283fd2f77ce41766d3f2094e6e2eaa2d6f0df6bc3df560ad5738225a1d7250fbb0595b28541155e02eb78db95ed1ff2c3bd0c585a6ade5fd33d433db03477b7f36c8774e9b400000004275da82b25442b186769e3c1957262f5eafda8db64758ebb3b70c8b8648a90542a161f9734a0c7af838291d5a92e4a7730f255c7bf1f05444ffe133bda6fc2f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{853157D1-A0E0-11EE-B0EB-D691EE3F3902} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000037296bb44c975689ae4ebaaeb17b2d54a6c4987b24a07569addfe3f18ab1f74b000000000e8000000002000020000000daf7fe5b216170127b46e51c12e4f048154a58e42f5a9b07519b65a47882c2a72000000052dcb3f6eb8c981343d821af5f323afa9588057ad70d9b4ca905bae12c807b4a400000007020c91d2751b254febb21287217647d050cccef6d0f9d6c1a9fb1b7d090f56b489797a78d4085ca6177440b5e1f3f92366ffad40a1e8245730741effafedde5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ddab59ed34da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409421552"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2552	iexplore.exe
2552	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3052	2552	iexplore.exe	28
PID 2552 wrote to memory of 3052	2552	iexplore.exe	28
PID 2552 wrote to memory of 3052	2552	iexplore.exe	28
PID 2552 wrote to memory of 3052	2552	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab6ee356825b76ee5a3c8c6662704735.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
36KB

MD5
89cde1b39f949cf08b7f0f15addfd86f

SHA1
c5c2be022c8f07c4e4d2143e8f9917a9477a5ff2

SHA256
1fa9304cb969252bd6a23bc7989f5ac4f18f854b6a5c910f5dcca08b0882bf47

SHA512
98fdc85f53a78e7267867e6f7d170e5188eff76fc42f90aa0aee458a2d19f08e12736108996e809fd773791785e0888b8520f43af685e4acce01644ef454c9ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bb3883fc79d04b526103a6cae5bc1a52

SHA1
b58a7b9252e405c9a385f2e666a94e1d24c7f33e

SHA256
429df1ab77bfdc7c51630a011586a73edc03cf7859fa3a26bfddd55aa9053532

SHA512
a56e6bec06bb611fbefe72f59f3adfd61ec3af69597ab7496a69ed5e64eec448165f395b517d2c1694ce9a9bdd1d1e75dea09bcf5a2fda23fc4a4c811f9a6868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63a708096f3c46bc8f749ef77add25d8

SHA1
5a65e61f5c935c21014a00e12a45aa808147a6d5

SHA256
2ad918d9aabf426fd0975ef506021340390b085bbb62fee8a724ccc8cd37f1c6

SHA512
52fd541ddfdcf58721878da2ae7d04215f6d84e7e94b25ca4f4030aac67baa4fff64b081e8c8ad8070eec7a4d75b2137a55fc0024d14812d30dd68c1e6d5ee28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45751d8a854d6dea7371b5e4ba633a23

SHA1
d3fc9d40cab97ea14a85b5d3ab12202d4a389fb3

SHA256
8d0c39770ceb7e0b20233a8a067518aa9a35a88b2943b622864251ba3e719779

SHA512
24f4f395cb5c988b3554be16c7bb3d86aef388c32a0bf1eb6386625ad0ab31048a1b60888910f2146cb59fcd44e602646ae555afa4834f8a28ba24f2e7a2b70f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a13cb3ecdf78477f67feff4c14f0712

SHA1
4eaf7e530baee8b1af091db2307d72d4e036a981

SHA256
300adfec45a0a2c30fda3af828ae78de745debbc7dbaf54583d3d8d002a348c8

SHA512
231311b13d045404b208f91c84539be01a2f14059eccc9b109da933970209550a4285bdc88c682645da6594aad4b1779a4f92289423af543967377d52e24b102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38d0c8ccd7f942a496c2c727fdf26fe1

SHA1
978ad89d30c1b38c5ec0ea31e1311d05d36eff92

SHA256
c91affbc405e1b07e961dbe562b955b7d401bb7b1225f24e7a5c078b5459c12a

SHA512
83b7e331cd324b78c2a867cbdf7a8a6547ec457360c41a99e52d7142afde4188cb35486a08bf25f641b94b7d15ed3decb29f263ac2b90827bb81ab9cb7d1332e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
739ead1a0807fc2bcd51643b23047c73

SHA1
b040aa67141bcc4c33c46647fc70babbf6f33f11

SHA256
75bc36adf1d44c26451ad474878b095fba9b6d6a66bf672d225b367f5e968a52

SHA512
0c49315d9cdd36e276d64ffe583fe394fa110934501647c72799cf7a1c05b60d821df7d37875cf18fce65c8de5a5b51fc75a046709dc7b6fcd9feebc4b15dac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7d988bdd8e6c6bf77c63cffcdf3e194

SHA1
87ae343ea36018e955d4999e16a203307d98a2d7

SHA256
a27636f7c454258f0c90eada4c3418b02df369e14c1b4812ef86a579ea0a7679

SHA512
1fdbebc96156bdee435b908dc3a0cff786dc6e8617ec4d7eebadedaf61198bf8b21154a04feb9f06ab5d41962eff4247b1b7916640d0f5bec662abc8167e097d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a46fff51293acd9730859f7fac8ff2a1

SHA1
b7a4fc0f28e0638832faf507b84131625de914d7

SHA256
220334a419a4d6f51fea701523b6b93da6d5172ffc096d9536b6d90be417aed7

SHA512
4dfc39817d16ff6a9517bd98ecb30cf809ddca84c08815d6cc503cbc73684afc185ee6f74324e81365fcd9ea707f44b22386068e91f45dcd332c3a04074f7bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b881a480973976c19338e8f52c5a2a5f

SHA1
b460f9791d609fc688384d608b40ed926aacc8b8

SHA256
004fc6edf65ba110ea295b120f90cf3ac1be2f1df136fe3d2c1efe0c1908ddee

SHA512
3acf79ebda76fa393951a01eb436c9eed667ad566e3574c080dc7416e5b5639faf2053e7e3a8a18302bb15898f5c56ce49f81e96dd2f7796496f75637392214b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd4cb9a73d487c2cd7a4818d4beeb079

SHA1
dbb57cf7923e2bb3aa5b9461716e80a5d9dfec04

SHA256
918643886ab503a491951bbccf47e0e59b3cdc7e61c01b417e397d020e4b7f3c

SHA512
e5189212c741c0ef650257b6495dad619d57fb1f604099c0d950a6ade64d57e68791f7d18aa5a2bdb2fc241999bac3cbbb521a3505da8fcc15bdd25cdf24e01c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df6c60e83159c16bdb3c517d768aab46

SHA1
b3b2da122b76a1bf0e2888ff3fd2ce2b578a2f03

SHA256
cb001adf2b026b73772cc8cf687cfef390d84c9a42ff63f4b3aaf228409eaaf2

SHA512
7c0195b629ebee2ec0e87526fa793723bb323781de0d6667312516a8d0258b9b0ee5c9757ba9adb494e16fa0a9735c2cdb0369567e1497e1d889b700298beed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
92c5a1a4681c76dd3f74b2a788bf44b9

SHA1
a46d441b283cf571f6df2bd88e1ad2b05f6aa7f8

SHA256
f7e727ebb649e4d5bf4d03cbbcc0178febaf83f68ff2bd402c65b464d4bf119c

SHA512
68cc10221fb2750be18f9a8df7b5d5a0c679b02ffde886d32d20db29a832db424037bf00bc75c5cfafd95c862d5ea0eaf24c2fd826884446a8cf814b74ba2c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3111da225effdb00e14a199e336e30fd

SHA1
29b039e9bd607eb22bd2da103feee335942db2e7

SHA256
7c6c8d79c5d740c27c0302db6ce4545cad46845288727183192468bf10b5cbc4

SHA512
dce3683f1c992ad2f2841a1e1ef7af92fb5a27e190ff310c897ac23616920e79d545e102fb28e7bf0fae82c778a4d0a74ab42c91a1136fa45d9fd2f8ab4f1ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
1KB

MD5
7125f45e2b64561340f80f2df51ebda9

SHA1
82f3193a53474a5d83b4ba627d61ec0197cfccfa

SHA256
31054f95f3353639a6564567278cb431718fbe3c9bbf1df6a015ce5b0626c31b

SHA512
becfa9c67a6b9dee5f30aaf8b4a8699b2ff4af652e86fa80e55136f7844863bcde12249f8531ac8aca085538d568ee96d15223c8d332ad2edd9dc8902c1a6a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar66A5.tmp

Filesize
9KB

MD5
127de9bb472ce2b52c44558f968a2845

SHA1
f8b6446d4e5c20badf771e3e7410c1027ab362ab

SHA256
88c377c984509d81d5a08bf1531982a822b239975ac14d99335623014d749bd3

SHA512
241d5d9d3ae1cc5781f848768296331052644509c181524d5ada10aab0e7f7e9913117597d305c52f3d84cfa12697a2183363b7d408dbd46418cca464697d4a0

Download Submit