505af039ecbbbcafaaea8b53a5e9be2e8eee0c001ba81b36db46de092d803df9

Analysis

max time kernel
121s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da74626785cef4aeede75cd5807ed0e9.html
Size

1KB
MD5

da74626785cef4aeede75cd5807ed0e9
SHA1

1586da85c26f9afe844782fa1dc1b5125d8747ae
SHA256

505af039ecbbbcafaaea8b53a5e9be2e8eee0c001ba81b36db46de092d803df9
SHA512

40e0301a88c1eedc71d0ffd5de04fd3aa1964d3b76cbf7797344f8edc3d56455dfc99fa595a94978b6432d8529b12924730362032145ae9e24b537f259f2ace5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2AEE9AA1-A106-11EE-A623-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000475b538ffa71cccc2231f56002f116a6212dabe641eb93ecd2cc13da7e671730000000000e80000000020000200000001a234086fd5d88024fe7ed5d75b6f8f41581d7f1a8c2372fcf0749b05c37e93f20000000d21e0895bb8b62087a12e796ae3e6aeba91c4f16495af5b4dc87a9416672b3a7400000003b891355edf26ac3dbf0773c653d8ff3f7934cc71c18c2e30ad77c0aa0c011fd35a27e70c96d95159d19b6f88df4fc2d64f3331dbe35177a0dfc3861c20fc1be	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409437715"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208673ef1235da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e856c0ff0b3e8599442b3761da5f6c8671bb8d571ee313868940201e137f5a50000000000e8000000002000020000000913e512d81dcfb9669e587554afa7ca5f84eadddeabe74a2cc2d526cf70bde1d90000000bfff85488f87f12386ccfa13bf8596494607d15b7f0fa5af97ed4af9b5b9c4b1a03647301e5e408b497f7666af5119a105bd5604ce22960a2735187202ae94c84279648ccb2b46dfc8e059408196d12a7901ab5b9fff05b155ad7891884121f7e592206c0cd082eb29194641c818824f9d9187172525ab58969f0213de0f0173ef53e5eb9387cba093890e1ec44df6cc4000000030d87b6b755d6f5294a7f8a8c4c61b096d2d9df8994ea3e4e8821ad2f37a7ca1e3daba494bbb50bf62a2f3535add61cd45637868a68724eeb51527389a011c8d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2060	1368	iexplore.exe	28
PID 1368 wrote to memory of 2060	1368	iexplore.exe	28
PID 1368 wrote to memory of 2060	1368	iexplore.exe	28
PID 1368 wrote to memory of 2060	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da74626785cef4aeede75cd5807ed0e9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91b9ac782a0c4b0e4317ecf9731e7b91

SHA1
77ab42feb463dc075c034c74239e5667db83af84

SHA256
73ed731da265ebda75bf15f750876072e95cc2b649cd74090f6cff300aefb54f

SHA512
7a2c696a19b3d3f5b13e0c3a4b638517a323f392fe6a74249532a1cc73f5f2e71a1ebcdeb14d71ce6f8be68303390f8daa94e09b4885453a5f0575de1c83e8fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
995cbe3d948ab964d517f3519f3d1743

SHA1
7d1c280a316334d0f1b88f28cdb745c5711a7692

SHA256
491c510c474368bc84b46dc807c1cd7b663c43a56b41c7f818d897ad207ed43b

SHA512
9cdaf4762a37539922d64d22c9f2581a7c5b136f28d9158db6c679bb2a87d55c5015132ee17a85933a4e5a4576b092a877f8b9ea3352e958361e3513429bdb85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1b126e57a4d97a3fc88ef861e2a346

SHA1
fdc169416fe2326d5b6a1db06afb974c39fb9848

SHA256
9bfcef14e16bea3edb667bf2a8debf406224098147aaa300048808960ce56099

SHA512
bcf6246c2eaca54a33dedfe13549c9172aac4251ce7c6b002578698bf1298ff47650f252039d2032599329435c3e967b930cbe0336bd8fd09c25fb7bd72a2d76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2962797236635091e1ee7d9a964959a9

SHA1
0738d489aa4b68e84d319b31c47713ba324ff532

SHA256
112494c1399c1a61c8feadf4c6378e6d1b0ff7c16d5627723eaa2619b92b74f5

SHA512
bd3d01e8755c7525ba07815ace630a467ba17aaa5a7c44d520f91d45235a7bf17ed435e4db1dff564cbc711aa9dac4584e820819eb542ec1c4850ccaab85a7df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c15187cf1787e54b25b412ae55fd7933

SHA1
e9a8f4932fbcf4b0f86fa481fb5dcd92d44d1414

SHA256
d08fa47f08d0f3d1618440c28d779324fd3984efeec0dc66779ef3cc7fec924b

SHA512
54777ab97dc288d3d03aa2355b1f2385374ee5503a82430545746aaffc6dcefad3dfaf836fe51eebacd7901b70c6ba837d7084eff3d4680c389e0642592c1acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2142b219686193af70b9a592a89f902

SHA1
ff880d2d24ccc8724a47a8ce8cf815cff002a417

SHA256
64842a421eb6886f5d3d08c17958ff3ccb0eb3cf2601a1394ac75eee226c9969

SHA512
c2453eabc9d4e4477bec6ff51eb13e977c8a47b501a3c2cf81f6b690bdf545838762d63fa073e7cbd0a9e5e4ba9f4a1a1df3bb813fc5a320b9b2552c02293f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b305189920d68ac0f9549551a00f4353

SHA1
f9740a972cf9d5ac8f502cdfa85f55a09d164785

SHA256
828ae571dfdadadd3274ff2411f4a88e909918681570d3a8359a3b81c7777f94

SHA512
f6804020933fde41c13ece5931929c93eec3826a9467808f5010dea4d7771374ee541d70fec72d68a651a4be478b730aa8d0acd0ba63ba25d8181b3b9cc2f5de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fe2030d5e320497d949edd330498294

SHA1
ecc81fcb94790034416d66499a6c8ae17d82832d

SHA256
65cc14829a4bd726f4203013e81d96c1f22e533d95ae7afef78bf5bed49f2b8f

SHA512
e7c8346718d86c74a81d8a4067ce1f58af07e1b2bf329442198d9ed46c6f2d6b01a37b490c8b225c62ba775e1bf21ff22e8d0eec608d3161cb6dae230a148891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91f5feb5923bc22c20db01b5f538f3e1

SHA1
776c98763e2a5e58ea2673090b3393d388740b28

SHA256
cb9e6390a0330c36ad36d14d042a78f1461173c8ba272c20f0fd5a64f6bebfbb

SHA512
da7ca5abdd0c70d87ac65c5281d2368b49486de1e58ba295f9a63f79405991d53548d3cfb73577c2a4357a71f216690244e01ffe45ac2ff517226c18eb7f8340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90ce7df3353ecb5aa2a9c2c02c6f04a4

SHA1
d56c0419e0bde5d5400309a7d8efaa11be6fbe61

SHA256
836a5757e72a66345d034f93d1569db67737d8450bbe9c883a12cd241416301a

SHA512
a7ebad8774fc2f87a58fecf48157a76ae4d6a3ee0d9dc7ca2dffe8273945bffcd10eca92d2d814dd0b4584e8d9bb669f1262d39b889e515fe9d708b8be29b387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832d8f9ce6182fdfa7c5a2942abd0990

SHA1
e5dd57da5fc3382aebe72ac95d24e70dd5f55db8

SHA256
807c118cc6e692db079bff37e014e52be51ebbc485a855340ac63e679658b3db

SHA512
a9c4e30f5ab659ccebce69dfdfab3765a1b9adcbde486755f8aa52565a7aac1225f3cead116243900d1f2aae66829e120546b50212f2851604bbdae4b142b4e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51cc48ef5f44a92231e1671ac672fb2f

SHA1
b4af20026874b5b9705b0c3889ffc251eee13353

SHA256
bfc52710e860e3774c95a9feee328dc00dfc040c9d3a174c568c38287783ee3b

SHA512
5352b7df969cd900ccd6c709ae219585ffdee9bfa9e318eb24f19190928bb8a85b29e520d40313762d75e57389d32036c3d61639de933071df1d7ae4bac125ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32845842ca8e5bfbb386371822d8361c

SHA1
f5a2a08dabf23f0359c6d9d04bcb308b7a36a755

SHA256
de3c87f1a0ecb62ceb65ad00fc3ac4600b22deeba13520adb90e640d9c76d55e

SHA512
a652b6bd62e5a09f11714f1bb0c34d96ef593bfca02ca2a66dfc3fe403161f927f7653d1b398c38f6e2250ca717957593dd2e66cbc176d55bfd1d93ffc9db132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a072924cdb436cf8d0d65edb8fc9989b

SHA1
b5e391d199939ec4872140f81630c9ece455519f

SHA256
80cdc588d4fe8c0f1522c1349f66a75ef6516841b6fb38ba95e11f9a38ec5b87

SHA512
85fc110b0d75501640bd8f45b229a40cf7287cafe4afaed2cf73cea48911ebc672c9b04db897894e2b7e762cfbd417ccb84e339671118b12dcf5e150973cce71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae202a42c7fa8d601766bb4fbc744f8

SHA1
794a6a843954c980c5be11ab7220f04dd2aa84e4

SHA256
358ae2883122c096515477481965810323ee47a7698d84367f05b593f372555e

SHA512
94771063e57b34e9a760c876e8672db4dbe379bff73982c1c40e718711192d3937f08584ffec202fd40af02a246d010ee9fe9dd273e32690f82557f228773e1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2aa50a71785a05885bda64c7443c524

SHA1
5c2f95ce9bfa0833d1d32dc13fa848405660189c

SHA256
eb38eb8140a0df41cff6c3bf92819fbd19d7bcd3e49b7fbf274e175a46f6b7d0

SHA512
7de21f1bab6ff2e2c6db618d6b6bfe830778a88f3bd42b0a0848afbac41b44e51470f7b27966a19a82b8eb3e308e97e4886e827a19a3eeafaaea87e55dee2b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff80fe7c46460b558c7083a30ed78dc1

SHA1
e82fbee7e699ca2548ae65771f7784bc6370ecf8

SHA256
f49f2598f2f79d8ab42bc1fa44586a19848914b52143b88b99aaa73bb8ffeb53

SHA512
a6b36bdd085df49b302f106969e0851706e8fa0e2e59272bdab1e45c8d5bee82a6c435b30a729bb07b6ab994c83974129d1409470d2319b0ef45718db656a6d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D9C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5DBF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit