7547b49a2c19ad192c555f536380443471fa56fe7d4694da0956a6f31379d99a

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2236dc764ec184e0c4623e89fd29c0b.html
Size

59KB
MD5

f2236dc764ec184e0c4623e89fd29c0b
SHA1

c0f8357114f58bcba0d303adff5ec4bd88b0fa6a
SHA256

7547b49a2c19ad192c555f536380443471fa56fe7d4694da0956a6f31379d99a
SHA512

e4fb8b436aa66fe23ab868ae176904d88775f9beb0515b1562065ab7d8be95e2a5d1004af921b42cb8bf0dcf77ab0a5b7c464036c964f7cba00dda1b57f97d4e
SSDEEP

1536:sIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZgbp:vgbPy3bSL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000dec485ae01b97a8ced1b2c763038270cddbb6bd8861683f5568ec9e3203783d4000000000e8000000002000020000000a34972221d3b0c10688c03a82340aa89224831aa443683e8d2601c61700a636290000000d61c3a0a540eb964acc199b98ecbedc4d32c6b4e43b981bf671fa167c2fc526c111fb434dcb5d33c6a7d647b330244160fe3267bb1647baca6f56e9202862430093f1db1ec82e6eaf63753cd0e013c5518b49f7fc3d18a87c60a3ee6ac74b0fd2d8fe2d5ffde6325feab2c38657461f6cce4c2c55465a6b43c18f2090bec1fbf96530c9c53654f68c727c8cf17acfd5b400000007211e90efcac9f52f4613fe482c8933884717e40a9901121a97cc0716ace8260d4467f811a572f77c6c8908df1fd53bdd83d4c62b074d79ec805545e644e8e8e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b7084d2535da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7082BF81-A118-11EE-ACBB-46FAA8558A22} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000071ce1414f6476ac08c8f250ae4a66c7f9e31e8b6a558126df64fec6b3f3f5b36000000000e8000000002000020000000e1dd27696dc2742876f9d27fa7b670fc113d87fa7e598464e21c269f0422a0e120000000942565c24fe29c9f5d0b278c9631327f3dea5e61064e732da1b873efefc4a6f140000000f7b498f7741cfc7753865c17def03ef1a4c3ed99f8d5252c7c0b0a550cdd9b6858030704979456824000b1883b132d82e61860a4f5dafb477b14d6c77870d875	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409445561"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2312	2528	iexplore.exe	28
PID 2528 wrote to memory of 2312	2528	iexplore.exe	28
PID 2528 wrote to memory of 2312	2528	iexplore.exe	28
PID 2528 wrote to memory of 2312	2528	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f2236dc764ec184e0c4623e89fd29c0b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c99b0a4be73b83da6d4508b6422516d

SHA1
f995e1bfb724d575a73808352cb4832e1e4d8bac

SHA256
0ecb8ed06ba75163886be13842c45c1ac834363948404c378d68a9c32201c73f

SHA512
8fa4310cae4398572dd479dd6ccb8c8f17bc574be3ba7d6117f7f5eba0f768f6b73d8aa4e4eac5a328541fb08b13ca64edf4bc12cbfbd6c3926f23be1fcff38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca6c51ef710315f8e7c044632a36442c

SHA1
4bd3e3f4121f07794dae16f8cf65b8c0fafe4cd1

SHA256
b7af82bf4e69cba10693091e5c1ed9fd63f659824b735d79ca651908190ce387

SHA512
4046a56bf4ed99569c5d0938200abbd67969db6a41bc2b91fe9ead6be4aa60ff378e89631c48cb242f43668a7f44d491dd3071a6e5e384e43aa57f16c6dafc82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cefcbcd36111e3d02aefe2c395dc4e06

SHA1
17ebe29f92ab2aab979278cd2489169c9ac0c7bd

SHA256
21f0397d57024f4928c8f987bcd818d004902619c896dfe49a00b605be729186

SHA512
b8dcb04a78612bf02ebb91c3b4b406afc3b80e56f555fab1c503045ce6a038f3409e1c8f7bda2b18ec1a9fe7df9e3e259437aeb3436624607d8e86674f96122f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
534ac4fae960ebe538dfeb0310e1b4b2

SHA1
fedf37c68bdc69229bde4d7ddec06b168cdbe0bc

SHA256
14578a1ddc6675381cb52185f33c56020e0025aca8d33fb495a27865792a1c28

SHA512
212a8d414ed353cccf40fb868b0e70eeba484c63484c83cb03f0dcfcd0b58202353631bc41fcfa4c3fb202c06e4faf98a112903af117f3c035cfae33294e87f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9676bf8fa503ff4cec9254de859f0369

SHA1
ab8824dd7acf510280709cde46e321149d7c2c13

SHA256
28e9fab534cab83e983c7a28d049784f1612b08204d4ba4f716413855f5820c8

SHA512
8fccba0201445252cb23ebcb1cac934e773fad7d216d81a066b52ea195f80cf918b5c0e153a175ca01514e00665e4b1daf164fd139d3976d83157d000f78c4f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe034b693ffb22614b8fb0ffec3b34f3

SHA1
4bef01ea1dd192f78e7c51c79954d6796e78b0a1

SHA256
c5e11015c51a128d5c09b0e780f846c96e990bb3b263b9b0478cf9754f378f95

SHA512
da381c0b2968004622ddc74341411839d9fbaddc8e7b722fb1aa247db4228ab1c660dbf048a819bdc04f4a4d8e4a2fd5654db7e9df62d117a98bb273999c6db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec73ebca93bd05b72f37ae43d9d6a53f

SHA1
16ff0b66e8da3676f451449312e4148689e15b96

SHA256
a644e39e6c53f91e908fe72f4ad2523add57ab33b602fc820ace1f7dd8bb6bb6

SHA512
c64b996b137be14ef596e72a57938a80c19a6777fa08060e29ed80dd6bc8d6476773ec848bd89a10e96b638358f7cc448f2414684787ef5cfe0e7a6d95ce4a3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc66dd1b9adfb383624210378c342289

SHA1
d160a24b4e8495817e0452a98d8c4187d701d2ce

SHA256
c696768d24fd72b7f34796afa087f5811e65031f60aae9186621c409ac6cdd90

SHA512
1010e5b485d3e3ba384feb6e82b5ed914906e897764a33df3c47a94b5a00b55082bd0ae213df729e3cf68650f3a62816caa090fa6ba5daf9925202cb1774a2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
112b90c9dc8132f58706ce42298594b4

SHA1
ed8214447b71129f4f1f6e515a1010aa265ff3ce

SHA256
c2c11c329bb74b848e5a8af4343986af31b17c5d78b344dd30493b2344a07e92

SHA512
4342744af985added21a65f48c1a9bf2b050b22dd99f280f447444a8df3254565563d99bd15af7a8ef04c8b2d56a0968cf784a669ef8508ce5427ca868dc670c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1503d8aa4af31c92dcc39cb80560ba

SHA1
653df9adedeac5d5e058e11a78dde1ea3c15a45a

SHA256
5800459eab2282fff917c26cd1370aaf7015fdca363f5454dde2f05d84d26d16

SHA512
e35f614e8104cb01cde2c142497d4ae3fa0e53ad08f7b76811ef6bf43be969d82ea285ca8e9649cee0cc2b792817c91423970b4ec46beffcc331cb9798b2e059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40badbaa09bd707e90b26f421637b1d9

SHA1
7430a30803313cf3aee95992e1171e0b0ae0f9b2

SHA256
f38f8c5e9b7ad7300fcf58bf2b801173accacacde58ddd3fd6a80f619428d7d4

SHA512
9732bba81f26cf03da86caf79c63dc587bc5cfaaa232e135a75eb371318429a979eeeb0f4e9b54b5de19c51cba2ea740e8c764af1be6e430774967e14a58b8f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e881282a2ec43bc6c87b72ecdd264dd

SHA1
02c52ac4e95c38e4a41286c3afa12cb104dc5923

SHA256
b526763114dcf7aa2405efb780a032a066f824c8f47affe1d412ec55d197c94c

SHA512
366a1086885bb09843a72be82703ae325c200e633b6d3458a16448cf5dcb5f6c57e716cec27b79b8931efe52b4fdbfa70b22d81514daa3c89eabbfbf35aa00de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f21a080ede6016b9ed210b59241ffe7

SHA1
c958207ecaa69db341ef4501687cd2618d7483ea

SHA256
472cf131a7e82fd03ddaa35961b8d2cc08d21cc206ccd2a17ed048853d85cafa

SHA512
b8806816a883d2736ce583cff184d15fdbfd4d2c14f64fa6a701c601a25ee6884410a8be3f1b67c0eb4146136cd578bd8bc97c3af6cd569095f2cd89762484ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab981D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar986E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit