98663738448a506673c9b9118bf42069ea7c994af94f97f58339002166bbe7d6

Analysis

max time kernel
142s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae0fb2938102d6b964322cd7899d3f07.html
Size

1KB
MD5

ae0fb2938102d6b964322cd7899d3f07
SHA1

9640f953bd9338ff0ec56a5247a2db20e6290779
SHA256

98663738448a506673c9b9118bf42069ea7c994af94f97f58339002166bbe7d6
SHA512

9929da97b610a54aea990ba28ec963801a469310eddaf2ca26899fe7037854101cffcd52881ca6eab1fc4596d3a7f055d34bd22a84723ad949e3e1fdafaf6a10

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401b2e6cef34da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b7020536450e490b2a4592cc6642d6b0c69e3c2f7e4c3dabd560cead8032cb3a000000000e8000000002000020000000a735a58a1597dddef9ad1725a822daa3db9be950066e19c1016d906e8e3e15c420000000637fd9b1fe8e0e17f3b1746f1c7cce5b232af91293816a16e6e319cc977d2fc240000000b8cf39750d9938b315eb0b990ed455d11d88b7dd4b76795071dece9e455770ea5b896eaa03e9d8aec6333f457e48532abe55e64e1ecce83f1515d40a035630ec	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000037643ddd5d2b5d1f52cc7c88da1ee281a214bb10c65f7c88fbc3c3d30f1db384000000000e800000000200002000000083b37c88d85e3ad9f949c3684727b59ac2931ba8c510f5cd901e648de12c1e9d9000000072c8239507a99eba382dccc36db2b40e36e4c56074ca7fd1504b98eba6ef12ebd947a45f8118503234595bca37d7f8c55ff69aca257da709cd8d965631a897a0b9594e6576e26e1a4c7b0e08d33a210a19b7716c57a92d4dc60ae203be330a00c3db7ae1af2d36ce4d64f3225b521e9d012c59e0a8666f9050edc91b07fb2380c1b4599559ebf3733fd4dd62d303b592400000004d925a0b699e56868b7e52802362a468be506ca60a71f2612c3f75f4a580d544715112e67a984a23b93f1d8ce178ef2139e4a8675760a2b01308d025d4d53d5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409422461"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8F88B51-A0E2-11EE-93FD-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2804	2520	iexplore.exe	28
PID 2520 wrote to memory of 2804	2520	iexplore.exe	28
PID 2520 wrote to memory of 2804	2520	iexplore.exe	28
PID 2520 wrote to memory of 2804	2520	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae0fb2938102d6b964322cd7899d3f07.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a031ae797a2ed57e0d3d0a13de98f106

SHA1
73b838b5793a935385e48152fc8805bb295ef58b

SHA256
30015dd47896f7a0f2f96595d521d90c8f972545887e36442d9a586a6d13817a

SHA512
0f5b96b726efb991b6c9d02ad28aed4a4730499623e4db214a51cad0d08903794a3e573728ac7e3793f91a92ef6977c3aab36a1096b8e9ff741ce4e80fde236f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a9ce89d58ca4e3ae13986f5447b7c05

SHA1
a3db06c5defcf8a428686ed23e755b6c1a467953

SHA256
e73a13f7d4d057ee1b55d6791f85cb0cc6e1eed76d737970c9a36bb30f10c1bf

SHA512
317268e90ce7f40a6e2c2a07476b945e526131be9590071647ee5713668cbebc9d6d85f3ad8f0aa8c74dc636c2d14e00e3695b3514f49ca8f9eb23ac3b41d9dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6387d2db206e8b42a6cc3374f847593f

SHA1
26ee5541a9c4b13923ab7d74b58c1577c67c850e

SHA256
5afbefee5439e72c28f31fa99fd514cbf1cdf8bfc2462ba3ba4d0dee41ce60e0

SHA512
8653b2cc29e29bba4b3d808a8eb767b2c77fd21645393c26e31029309e644196086eaa713259677ffb6a5732766d607ace2e972800447aa51c417f01f6dac8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33375da6968e3220530aa9279a6c67d3

SHA1
8843261badc48af945fd1808de182f8c2d9e8f63

SHA256
f8d3ad6177de9b293484b66de777ae8bb85863d1f1b73a38b3c18988738939b6

SHA512
4ee5768cefe1a02b1ed19c07401970dcc4950079378473c8f2b9b274a3787e604586ab7a3385548bd790c3cc142c9897334627fb1a3e219db58f0887348e9111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55f39585e721f4757560a99f2caea030

SHA1
2070b4718ba4ce8f82f9713621fc3b56133e71cf

SHA256
1cc65ddbddb914b43a34380e8fcab2ea7736c5ea0bf623fa388ec001a0ffd42e

SHA512
2a4632434615e2568f3035f6d994ed2db76491e0b14c13765eeb013bb0ac6d865f4698d45384e03179b3ac418272d52e7787f9979f9c153ef67f13fbb3bca2ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87ea5503b457843cb724c2a19da8c55a

SHA1
cb045b1349cdb0e278a45d29fde8d28d4788fc3e

SHA256
23285d33f7e2cb402b0174ecbcc7960844b218d5330e91b87d360783a74877bd

SHA512
db6c361078e235e40e8f3ef6659331b151ce645bead2bf1492ac8449a16bc5ba261f1f015001dd03643bb032d8ad31e1fee678da2569923bbd4d6497afc8ba58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6843833cb1bf5fad93d7ccd2bba8a654

SHA1
2a5efc44283429960dec9eb951380fba333169fb

SHA256
27a6af3a3b63430e22993bebe40cd5e454424537c24a1b30a6f65f637203847c

SHA512
b3fa73bcd49e976292052049dfe68f82aac2093a7eae14fded59fdeaea4569c0cb906e7ad8999e449b1d16c65687b24afe6f5d4488d3d04bbfe2403b68ed9cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4140d0f0c7271eb95acb5f5708aff099

SHA1
893cf54a9fd02f332e57f62b36f8470a3896d58e

SHA256
956ed5a122e79aac9770c3c5014b3e908b8be2ade6909762d0dacee54883cf1d

SHA512
8dffd0296f1f3ccde0c52b9b5e2decd81b2632c945a46cecac17de42575e2a99d31e6c47b28a53f6ff5814290b965013c63924e1be747577218d2d0afd46de34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e456bcd337b8ec8f1e2f0f7e54a43d2

SHA1
ee09e254fa5d98711a9071c6ca1848048e3f4a25

SHA256
4470a02bc897a7d030f7f2487b78e58a0b79e88874ee822edb7b9d8a9939ef6a

SHA512
4f6fd5c57d81a8e764bfb5f07259734951a4802e8b6e6d3a05f46e5dd8603974a2a57a080608eead03a29c61e1d04a52eafbf97a6f04eb6be087da872d1b511a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f558eaf5648c9e7609e1f1d0998c20dc

SHA1
ab5aa3a701ec109e9776f6c904fcee99d26a2ab6

SHA256
a0f5064d32269dc1c67789e8b48ad60942a4d57a8f0da258dfc74da298bc0021

SHA512
8f69ff8da2bba46842c677f1f771421bda30de8ba4241e31b3b71202ca4997b6e6ea5a88f81aa907562f285f64ecacdfec84068f1baafe642a3216948365051e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88d46b57e7f23a28e04db22789eee851

SHA1
985ce0dd128c82d56d49c8d40edd4282bf83cf30

SHA256
7c5bee9253920547ec8917d5e8399ad0d8e63d856401df37d861a2d8aad544d0

SHA512
15cedf927ac91a0946a1027a80bf330dc11229ba156199d56a9467be1c03a51392403446552dd68b278ef0d4da6202d08ba58a2c2e4c0acdc83d310eb3fdab87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb57333508e0800dc12ca46e605c6995

SHA1
95b0f4f054e66dd9b91951f2f9e44383f994c5f4

SHA256
149c9a8f93eb623e10babdd07373a7be301fd9062abd7308c9d5fb73275f4c7d

SHA512
0721485972964587c8d1f4947e16c83628e52c28d7a73809fcbd41d364d0513b8d818bd0564436bed6e77768013d3b0a166bde4c98c44aff10b59a73dd8ed0f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d73759fc35f6cd42af3ae56f69c0162

SHA1
c94d48ef60013d01987146d671cd35012574ecd4

SHA256
cc4bacdf12260fb3281ef0cea43c01c483e61545cc70dad8173248b001d3453c

SHA512
705222e953ea10bfd1c47f3f81b3fbbb0e901040f82208ab03278d0949d41a838a970cbd2969cedb34b2b347e5e73a6121d141c56b81dbb9869d14dc88107cdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
681da9f50db6ccb0b5ece31ea66fddef

SHA1
95983c5314cb0613d08791a1e8ecf19022dfda43

SHA256
d6152c1bb9fa91e5aa347c9c9b6d373bee374376413609f3a0dc15a53c50d5fa

SHA512
cb7710ecb6f9450bbd122c212d0754dc5ea794e23eb46ae8ce106b20c49927e1c29ae869bc9130ad7275b20887244f56a33934914a443667745715568a952d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dd0963e2ba162ada2537ab13adad30e

SHA1
434689286eab0b05fc079d59c65490b2bf8a5f5b

SHA256
c096a53898c5dd2ac74b8000b66849ce6853b79495c8a965f64bc2d281430a7c

SHA512
9ea3a1146ad57372e67c225b35903a54500d340f04ee4f353b87687f99748d6c07f968240b5a5bc8f810b136f5921c76b5b19bea635941e394ed0742dd0675b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dd088712fce502abccc7417fc90d89c

SHA1
154b9cbf6b76e20a007dbbb563498e6eb892117f

SHA256
2b82eb3b7dcadad61fe7ecc71d192e8acc0fcd387414b97f2fe991f67153960d

SHA512
0c9f044dd3fec0f8b9e29859ba0857014c795b65c3098fce06d4fc7d17389cbe00c08b053f9b221ef5cd591f564401984d8a14ad3e4049824d18db82e52eadf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB9B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit