38d493e31f1c8730a744095e4bab379da925b0e798d7608e220f6111f5dd610d

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4929e2577eb3bdf4353059073bbac8a.html
Size

601B
MD5

c4929e2577eb3bdf4353059073bbac8a
SHA1

440ff868d5c6234877f140c02a15b9c843bbfd1b
SHA256

38d493e31f1c8730a744095e4bab379da925b0e798d7608e220f6111f5dd610d
SHA512

71bac2141db761abfa3f541ed970168fc12afc09de8edae20372cfab3bded4cb7d10ec5aaf1d63f127637e43b01c60cb6a2f9d8bc05756fc25d5399a1fc6fecd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a909ec90585140d6c4872be2fb59c644b9a4b75f123b03ebda6b5f138d696d62000000000e8000000002000020000000225b9c4cfd549d2d9b21464b3ecb1384c389b7fdec0ed85beec0dac52973af199000000095ea186de2dc45025412ade21d8f91a28823a7ae54f36906a9b7a2db4724214a7f80d7d07ab7b70a9aa8f93809f62e2f3db764545fa51e777c28d2c41cff3e6bc43bda3ffa4ee73fc33b321d8160d6d6e4333713e034c8ea8488f11f591f8242de912bd159052e146000ba787af3e409e342501b81ba6c17c2d97e49d673af5c0fdfbe259e189d320d1d25a2615c82864000000027296ecb0e47c8b0ad10b178340327a9948d200081ea03f335b83afb612cb07351a4907b8e0d48e4df2726e9efc89bde69aaba4a007ec17fef246fbc14b0ea21	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72B733C1-A1F0-11EE-8183-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305f0a39fd35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004ec30d91b0e5c501ec9379840b701a5d411ba2c76779648d7a3125e503979f5d000000000e80000000020000200000001302b51b03b333f36fad9c848f92817585d33298bb548b1731ba128ddcd4263d20000000cb554863e3648a8396f6033218c3014aeca92b5f551665c4d30f39fcae21a4574000000002bfa699174746eecfcaf774251df87f5a489b1c631c89558cd2cafa3456a7aa5b740e40a66f20d298d8866147e13b6eb85b5a6a8122abeb0cb002883001af68	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409538329"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
848	IEXPLORE.EXE
848	IEXPLORE.EXE
848	IEXPLORE.EXE
848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 848	2184	iexplore.exe	28
PID 2184 wrote to memory of 848	2184	iexplore.exe	28
PID 2184 wrote to memory of 848	2184	iexplore.exe	28
PID 2184 wrote to memory of 848	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4929e2577eb3bdf4353059073bbac8a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e35a977c475cffada9f86ca136572b

SHA1
d65e15cb3cf68e1eb14e770697a0e8ef65ff0851

SHA256
b9265e4c1b1bb3d9d0e992eb5cd1a9c280c26f0f205ea083f4d673c81c0b243b

SHA512
af127460d09d2c36b6e8f1c62887f6d87e25ef1e80daa7c2079d397c96bf49789aea3ffac886985903bb90f7113b49aa6f287b2be8924e21833011f40753e103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3895c58e6c07d155ad68f88526e5977f

SHA1
cfd7289072ee8cd62d9a148e21e6ac3cd3eca49a

SHA256
bbb70d8c471fd1517ea1c9c75cc64059882ee52ef998f6f3f6c53caa32ca0144

SHA512
fa259af4eb700578c9ccecd55eedfb5df2febdb4d833bda1416f5ea773df760fac5f8c2ff45ab8b0f8d752d22d59f0db19df26521e72ce08917ca1ee37024a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f173f765e85b5d1144673469b065256

SHA1
bedd11dc6b208f0bb8f095a7d98f6875f5ea5125

SHA256
83240aa6e94a0dbf55ef246e24fbaa5eedef407467b1e253809ae657db2004e5

SHA512
1a41991da0f78dbc6ec428cff52671e9cef5f7ddae8e9909f821867cd31e22418f3d620c3686bb1f296e0beb8ebf9e41892844a6a42d2105469100f1ecac2ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b26e51e6bea3bbdf1691bfc8104a3565

SHA1
e5c8de635e684d9b40b3bc0fe2ec00c826aedf37

SHA256
3a3c7becc30736538b4227158f878b1052bd9953b6424e69d1b12bc1fc3cb8fc

SHA512
13ba287bd96e06cb6666b4c4cc15a0c5a0021c82a49e3e53722e918f62934b0f11210e9e5994b926ca0f5f5df62f50fa07d92f862ebd0e8fe4e06a031265ec02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2042cb6601365c7b09c6227e55234fb3

SHA1
42c552c73a4a0f952838c898c04dea2d0b808f70

SHA256
e0cdc0ea335f6c33f5e40bbba3f9c5b87b553b95800b38814e6e9c9e5581e122

SHA512
c72b2fc9a55212f8d428fc754c28f6709e19ffc36dfe2d87f47429407729dcc3182de932401be2bf3a2e249a0cd1244ac6f1d2328b1e36f20dbfaa93650bd13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
015d198ac5809881d75e71c84d325646

SHA1
694b3eb1618eb2bc6b0040b2e6d64e9295d6de48

SHA256
3591b4015bc49d87ac6509bf464b892b95703fb5740c735cff0520fd15196038

SHA512
f5b4724735d85575d6465dc20bdc5dee7f44bbfda6398a0afc3205cd09fa89fe0bb0f2ac6c409ac10f1520e0b32eb4289a1e9c766463d0338ba748ed7ed6652f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c845a7c8af55ec2a75741969b49bc9a2

SHA1
ec6466b5b19669d46ab68d588ab493c2f1ffdb61

SHA256
0ea04034fda06569c2ce9d5e837d2cf1a84d29dac79f38c07feda62daa63b071

SHA512
e293bfaebd56f7ede1098fa2c9818f805626b8e8e6802ec1874cbf2a6171bc8d74cf386f29cce77de24ca0ceb40f63310e3cb8d6c34e03aefae6764ac4b9d557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
865a4d050073b696c0a9170cbdabb7ca

SHA1
18fdec0ec59e87969e68e55896a1834605668652

SHA256
99554b939c86449a712fdb63bfde5bb481be1540e045eb7b6d35b6dad3608e8a

SHA512
982be7674756128a04854d1a174293244b5c9be91c2a84e16055e5018eb6d8dcc5162bcf1c49f62094e630f0dc07d5f3b2e2444e7d4162f4e5e3ffa9dea549a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc7975b74cf38ef16548bf390c22b7eb

SHA1
aeff8e40a1112f3cd0753e5bebf2bd10d6a7e61d

SHA256
d6130232b1987b2da1ce6ee6781b79fcfd5920633b737caf0ea042f53de3df35

SHA512
0f12ab1a2779aa074771af4c32c3344f5c0fa74a2de807b2e492a9776f5656888200b613a8fceb2ffa51f08c83aec851108bb2c0355ca2f46a23f469c92e3e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee1189fe399a31f696c47a858a009af

SHA1
fddb44d2cbfd61f9595bad70d3148b4017adca3e

SHA256
b4da26b27e461582d705655868274e20ad1d3cfa1556fc22fbf7b1cec613a589

SHA512
171694b7358b1520061cfbb2037655dc0e1b8335747b3d1660af42ec79b9a2cbe23f03c53bdf74a064fd7ed49f626baefe57e656029d24cbd17b4e347e20f086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
398621fb4a12a9b24806e12bdfe15a22

SHA1
3ac8c911df9ee87330efdfbb9406ada5abf5945f

SHA256
423fbde090e4acd6a7f693d484e82d3b2ee5199e8d43de77cd0f7632296f91ea

SHA512
122254e503b47c03abb72b414bf86b11a3f0cf40cbcfa1736d082f3d57fba04e9023fbc8c7ccfb7fe6cb585016e8a593e91f5a20bd7ab2aea9f3f2fc960c38d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc27b7ea698314385dd317878e6aacd

SHA1
f4dbb2c137e31e9f600985cd7437571647ecda11

SHA256
7cfb6f7c2875b6cf0e8f43d6576c373acd88f0d03abe7026b4f170a2cf732d16

SHA512
d7caf0063f024543a63031ca1960ebb40999928906b2578587c9568ec972de304102bc255c516458696d343ed000199b55458505b23ce677cffef20e0ac29c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5a9273bd7f6a776b90fe3818f3d5651

SHA1
e12a424c32c9d3f0349d8402e46c6a40d9f7040b

SHA256
c988407f9aac2ef58c5f8c58bd4de042af286e5c31d9fee3c65cc03b6bff9b37

SHA512
ef0f227c51efa559e4273073b26235ef0ccd09d4200670e97bb53c19c4076ba59005e84077ca3c33056e15547dacfa1f98e498a87dfeb0a6e1869010dfcf8ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aa210f0f0fa1bb12bb880351397aef4

SHA1
c3dde42304f81e3ffefb80c5f59884293d072004

SHA256
8a0fa235406de45cbb116edcc6fc9531a80aa174f5ff5e689283117b125599bf

SHA512
c79c5399b98f8f21c489945823c5f56ab465a9edb9e7b028b3a0f05b86b7466c44af72bda8922bb50f629a85954c4bd6a2105b32efbf850a8d714e64f24a6bd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f181943b52dc63f20132dc2d9ef542a1

SHA1
2f932b199ab1fd5311fd4c391e810bb85082de50

SHA256
51ad6efa768b727c6c9b2f2b7acfdb410d3392ca09f3c8bbbbeec8ebb87b3d22

SHA512
c8cda1d2eba0e4ad53402aa7559cf4bdffff4028f03f824e24a8a3d33988d20337fcb066bf37dc4e5f9690a3c8d13298ec65bd4c566390e5cc4265a19caee42e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C2D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C5F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit