2b0cf687de933b70d7ab257dc57fe27e2b4fe46fa76f44734b750cb32de0de5e

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c3e673535b0741a4b2459b3a1aa7481.html
Size

1KB
MD5

9c3e673535b0741a4b2459b3a1aa7481
SHA1

241d22738e58e5e906c787cf9335257e9e7afa81
SHA256

2b0cf687de933b70d7ab257dc57fe27e2b4fe46fa76f44734b750cb32de0de5e
SHA512

439b267fa4ec961b5e6fd3d920b76255c1cc9cbbdf4f275d62b09f7e93a11aed5120b424271f4c9b954cc229a91e830485a4ac54b07b159b0496778868399de8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000045ab4d85099894ec9e965db46a419629317c13dbc7d9f65b98841165ea87aaf4000000000e800000000200002000000018cb3a675f4c5b4f150ca303738ffef2fdf7e534c9a3b92a57128711cd6ec3b8200000001b4be975058cbcffc39b9c267edd81c531f249b841d0d8e3ce9bef486281d116400000003a2440381a7752559894ab0afa52491727aeba99df28140bf2d09f3cb7a7b70a6c3fac141834adf1fe20aa3bb3cc6cc25e3e52fdd1f293dabd5ea14cb7eb0c84	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F13D7B01-A1B9-11EE-A5DE-CE253106968E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409514916"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005d2d8dd44486e42d9fee4efa2a6734cf7523f86a877be8eb19e018e64978818b000000000e80000000020000200000008ff1de60a8e0b1251a6fefe91cd6fedfefc71c6303aa361fe19085ece6227886900000009f38b28eb4224425f57759a56369ab2a596ba65727c9b801666751b7103a7f6a0f562c81512deef92ab16f95719dd106b4b476a86df5c01d3b8980d44ab77efc0fd8529b77ad825928ce66b7a24b1b7cba373f70b3d007409427ac8f67e5b85d6ab69e94d165bd739c0606e78e433b10ff406bf9faded9f96589cba94f53dfd0b0eebf874284a3653bb614ded90f4a37400000004a4a4ca5364249eb09a1c09992ae28fa6419feb567768c28993777d8379abaf7248a70a098a2b3c8aaf9e5434766b5692133f3279468827aca42fa9cce71a9b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405b18b5c635da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2280	2032	iexplore.exe	28
PID 2032 wrote to memory of 2280	2032	iexplore.exe	28
PID 2032 wrote to memory of 2280	2032	iexplore.exe	28
PID 2032 wrote to memory of 2280	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c3e673535b0741a4b2459b3a1aa7481.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28cac460071f6bcc41089638b136a68c

SHA1
ada6cb2f65e8e10326e1c136638bd47d7b5b4a1f

SHA256
b2989ce4ef45493115674bc63f97a32bf9ddba396e1d819ac6ecca78148337e4

SHA512
a3324516bbbcfc7cae15d01814bd1f193a18237580c4ebd2f939b8d21596d025e8810b80c91d281fa510678ce1af4802800ca90ac554ce331444f9aa8979792a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48061146ee159eede73bfc77368f7de2

SHA1
13ee557ae1ad2ac3adc315111d24a6d1c20c7ea3

SHA256
ce2feb8833199514d1ea98ded0d019e1a9f78fd8c176592129680b675cb5f1bd

SHA512
ad94fa69fbd8adb2b7815620600766bdf99f7f4bfdb6b2553dfa62a175a5726fa13ba21643c8ccc54199acf3c8cbc44c657055ed50f1b1e074fec058b7ac9953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b96b44e56bc00d0d04ea2bc414210a20

SHA1
be7835cd5a3b8a02dd40fa3b826e196dda3d991a

SHA256
c484e91f8f0e018d731ed64c88aef72cc891cce9414b02e92fb849ccc5a6df81

SHA512
0dc1523e164e2d396626bb91b17e3be3f3b098bddcb5a29084a80169771ad212c2425c1f6f923d0040aca67aeafc697f41de01f9482b7c7e488f09936cee879b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69ae5aeb5897449174518972abfbd876

SHA1
591abb7448c9e5e157b49358e5f49ede57bcef6e

SHA256
ca7ae0b4028b7e68d98d3d45754c7d1b7f782f820544f15d174d9137a7ba92e4

SHA512
0a385b6c42c610127099df77ece957b5a16f88629699d73f162c8bf7b290b58fc275ac5086d8e74a032589cb305bfb82ec74d569450b92a1e7aad69ba26babfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53f6625c445e35f064e6fe1770a3fd71

SHA1
07c5487e17791a7064236bcd26ae4542cb2c40a5

SHA256
00aba7b4433213f53a4f863d2bf84d60d1d467d7c2d9db1efc49dc7b94c3bb98

SHA512
ab2253925225bd379af35ed49e19ed379bcb95a8496c59be432b737565c01e2126e2ac45365e6d06eb171fef00acf69cd5af00bb52aa3cd0dc99c8f50218b850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36fed4d974d0217e88d70e5794d08275

SHA1
4e20e0a793700fe1527f422ca0f8d28b4d814833

SHA256
0e0bb7747c94be7165a4eff80c499ce9c627f7fe51d9ce16b69cfefe03473860

SHA512
348864ed5a94ab22f33edcc6e59b06bef7d146eb498acf37717bfaf724329d12ab1ded18f54704c4d34b10608b63ada19bbd0112b61d70cb9a65355eb1aeda35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28a81096f8d8834178202e71c8b401de

SHA1
1e749fb3ec6e944fa6e49c43041b3704f22e9826

SHA256
6d53b2438e71be4c2372daf4d827ac6b8a40ee544fee840c6c3cfaee048d07ff

SHA512
8390a9b36ce7ae6d54131cac51b696cfc88ebcd8e26afbaf68acd11f934925999b94553ead0509e0582c97c7cf3b88e2f62d1d128a8183e7a042207bbc62eef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3183bc121922aee23eb72d5d402c41d

SHA1
b2888599e22eea4322ec50fff082ddaa4ae114f9

SHA256
e401bedf215842c4b78ba0dc9c6475f8701480aa0b41d968d716fb3e88fce60e

SHA512
3cfaee421154752c4c60d40216f198e7c8eac7fc81e9ab4df8becddd1a8d70987c4bb08a47e5f1a94c230a21301590a690eabeef68c05029120fef012d131f64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5d325ae8feac6038fdd5a77f07672ac

SHA1
088488881b91986db37d724ffa54ed16576928d1

SHA256
14a92f54d0abaab26dfc7350cb25d0673c03fa95c3d56d7f24c352823387d1c2

SHA512
bbde14254e96819c965c91763885cf489562d287f5c3b5c55d2b2b5d4e06c2beedd02da644fcf5973d3ea688f8a4a490166627eb7605b3482f99302ba1bc8de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80d3be99b4116e17988d069171938d47

SHA1
42fa034ed6d8df279e46c92fc960beb19e7170cf

SHA256
8809d7003b0f99e93b572467d08230318e167b8ffaebf3ebaf04da633c8daf13

SHA512
fc154c8d1abda2f6c048bda4772d4438f07364371b83ed74505bbb56fdd94f6810fcbf99d125b38a6dd04c2b0d15a75a9639786aa967da77d730cf9eea95c089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc0c5ab3cd47115506c53e9d3fe88c6f

SHA1
cf0c96fee0df8e0a04b35fdbea51a354481a5177

SHA256
3293378e730c00396a93138b028e500c113066f9852064b7b56d5b66e0a6ee8e

SHA512
24a1456e9c98ffeeaf3b5718e02b30c13255082093d032674ddea4cd10db71e8565b34cdd145d823fdecc15cf055930b5b25402a3539d4d9d3cc483e842b0126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7d4fad3657e426f810d2a169a65cc38

SHA1
3d0e0bb02d5aacf8e36c8f405b31a07b6146a976

SHA256
274131f21d930af37e2079a679ca62845ce1e81e2045723acee8ffb78aeb28f6

SHA512
ce8b9b09f244f7084059db0b925805b025272eeb76bade16bcdd7ad33922ae606c211af90cbccfa05ba4b1a7d9213749cbd4e8f780f747b8ef2e99dd1d95e806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14cf12923fb570f40223ed622e501f8c

SHA1
03a67de7974027a6bee299fae5da23b55dd870ad

SHA256
0a21197956e6be0cb2fdbf5f3ad78b5e0c7d6abcce320c90767dff2768b460f7

SHA512
afeadb822458c8ccb9cb2b27eecdc3567edb2adcef2f5bf5c1c17ecb08b3364be62235ee8bf9fc0f05d8e717f15dfbe63e92b0bf9349efa358eb0c1e800ee6b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de05624ff3299d079419e3df146b21c7

SHA1
c5088ba631c67d2e7475dd0aeccb8ed50c4deac2

SHA256
1b2f332e35dae20f203682dec25df822c206a166b430062e6d6477e4babc89d0

SHA512
bb634433c7c079eafa6dad87c4b4d9c68a3b3e303993d8c5570edb5f6acb31575ac6c0d9cdbc8e936c50fa8df1ac0875154cc14d9b4ba58f62b8595ff321dfe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0184b3b7800782d52abe6c9239e20762

SHA1
26831bd33d4968e8dc6d42023432d5b2c7ebc78d

SHA256
c90a03bf20af91929957774b6afd555dbd62003c053e4ca44777dd4ba82118aa

SHA512
bc8a609ec3384db2712a878e7b660c31fe59c7343dbe2651a1680c516940b287374c5898a2ae6982db71fb2e12054c33e6f2a24429e54e47655a9a9c90f5887e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b84387b4e8a49dfc3bd5fec9ddbcb6ab

SHA1
90474ac694298923818b333bfd7dd1f44e2e68de

SHA256
ebb268216b2792b5f509fb21e2faf83c43f10e1d4d237410863760986faf6d5b

SHA512
c502979d17661b25accbba45c270600fe9470b6a2c8936f471e04792b5909159ee4925187b1969a13a65b171051ce83b660528c8fc105b5deaad26b15b67eb54

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar106A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit