f540593f45fbc3822a632598c12d42416fd4a81f3c491b3235e47381cd495bfa

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f371fd89c68c3266dd338efa3fdeb182.html
Size

2KB
MD5

f371fd89c68c3266dd338efa3fdeb182
SHA1

2fda6fe6de6dc5aad26a93fb2634a1d6717f49b0
SHA256

f540593f45fbc3822a632598c12d42416fd4a81f3c491b3235e47381cd495bfa
SHA512

8973c2542c4c5a740b24c2fb0450f777dc6f43c66fd6158a552129bfd1a2cd18dcd5620e78723686871d5dd8b67303c8e7ad88df497c38ef90cd83e48d2023b3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309f14903836da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f16ac3a44aee3ff4a782333a5da9f057b85cd1545106d2f4c11e667b8ffbbf69000000000e80000000020000200000000621e2f07857df555204dd76c9d32ead685f02b6386867f38cdafb3ed123603c90000000eb1a46a59d6664099cca6cef8049b98c61340f4c531e65d599892d0d7a66933a223b908bbe8b91d90279218f199a4a43deac8a07b6b2caa4f3c283f1ec8299fdb11d5e4e3e0a15aae1cea0faadd355f6fd5fa42b95bc39cb8a0652577fd80be5e0a8d353511672efa5b99b280a44c71ae334026f82f5873c59485c4d98f3b044e5ef0b4baa529b7efa7abc1fab896191400000003eba68a8e4cd9a8574400718ba78986789c00be154049551eea75dd396e8cc1916f45357ce5cf102e6ad29effaab480256cb518e61924fde267799117c9a9c94	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409563789"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB16B101-A22B-11EE-84F1-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000040a5eaf5430d0a423c46a01599680abd646edbe5e9f7a32defd31a86139f4d24000000000e80000000020000200000007cf7c01fafac6c1cb1c4ea078d8c65740d45e7a5b559f798a2dd290aa2f13b2d2000000006965e796409187d2decd6a3fbd14798edef5ba33aaf2ce60a9d2335e29f6ae7400000008cc6c3378c64c66b24f5be8b1fd358a9a49805688e6d799cf8533780f397bfa577a05fbacbefdcd79df7ab55bcb90c13e618a217bb49b8f0c4bb07de9bda4364	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2904	3028	iexplore.exe	28
PID 3028 wrote to memory of 2904	3028	iexplore.exe	28
PID 3028 wrote to memory of 2904	3028	iexplore.exe	28
PID 3028 wrote to memory of 2904	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f371fd89c68c3266dd338efa3fdeb182.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b1a7ae37bf1fd1531acda399316f73b

SHA1
29966be28a70d176f208af5477d8db1e8ce411bc

SHA256
21a250b476c6f02c219e071379049bc5ba4f82aafe7e84e6389c52471042bb13

SHA512
e7a1d43b9e4a1fe3e2a1b3dd79bff80f33efca857478c58a67aae48812dd8b1f1efedeb5713bb0262af5c94c82f85aff84a6b2787a2aacd089a9dd38bdb498c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a433c4d223e68c6c5c85a289d5f15f2

SHA1
083f058f2ee6ecabd71a3efe34555a035c382c60

SHA256
221dc494be83f2990a98d8b8bdf61f4b3706aeeba44589459c034277fb2c4e61

SHA512
4a6d1abf06d29862f4430dc2ece9208a12f204e3af87c3a80fce53be82dc6a24cba19d32684f35aeceed0be4cf60377fde0771161d7e15e5c0e43bedd2416481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04d65b0d6e9450e17b1be30cee3b90ff

SHA1
6b17b8c9fe15c9cef9dc14e3aacab983918c2a25

SHA256
80eb0cf8ba9bef013c42e97aedda43a4fe636c07092bcbb89abe86d367d44674

SHA512
a583d54e73f68c8d99db94dc0823b5f421067c3a5b9ff747362da379707391ae879c7299c5c83c87b27c0fe170c5df9230eb400f634aff23ad9af08954640866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74acce7eb00920d225dd35672eaa55b9

SHA1
367cd20041891278c8aa5e63692e5b21af9b9253

SHA256
6fc2309e2fa2cd8eb53db6f1068609ce96f6ab2ffe18ef35cb43afd24dccfbb3

SHA512
9dab8d931dfe7a5e150d9de8549b7ed9705b551f738fcd913d0c67cb66750432f58b977b66f138290b5248a37a7a67d0c63c945ee8e67707d36252dcc78ea653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2beb648ea6d3945da732a9817149b21d

SHA1
f3e38c2e27e2fe4d1d0e18caec9f0dcbf9f39954

SHA256
791a4c0fb75f4d013ef1ef7cb9f7fd9106e11d51c251c5c8a9980de4d385532b

SHA512
66156c83e30020a9204fad517b393bae80723b1b065eaace9535d7f8f0a0b4968c6905125c8583b0145f9bee3745bd3de97a96217ad86bc55adce60b3123b6c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb6d5108fd3e143a949ccabfed66df45

SHA1
85148015a9a144e836a0734fa0a5ea1aefba6db4

SHA256
ecb375a4fba1b44be2e92b6b3f258ebc506e8a522a1762031f0525a6066e0524

SHA512
86e644314d5e12665afee21a9cc1a726d3d474600dd3f76f09c1f3e2afb24c71fd5f7b2ef1604ad3596faf230c3a3bd73d4270f155b4f0c761d1bd4b4f62d482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0c232c94fdfbaf0ad0221ae35bfe2b7

SHA1
ed195c52f50e56411cf222799c7cb08db79fd7c5

SHA256
1c705562a1ec7bfe5b4a01ebc54e5fd30cca2aebfa5492b7a2d05390a0daf272

SHA512
f2bbeaa4b5c16da31d22863cb65d082f30fd401d26fdff5dc5a908d37ba02457512793ac0b843968cfa76d8c58fc340b9adbece95885360a6bd030db3f638ebe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
459280958f38427c6d75dfdde9e4d954

SHA1
bcf478b132c023ba55f636e32cadfc0be51c758c

SHA256
eb994d741f9ac32922cd9b8fbd9f2bcb0d72d60f37108fc1235183d36ebcfcd4

SHA512
eddcc830fdf5d1e122fa344dd5fc7f15365efc21754d8409c12f4d30a75ab61052665c8b71df03e82c0a80ead44ee5ddaa0019db08340787d7c0eb72e9e071da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dad44be508f770a595bc50856461d12

SHA1
2ba0b8be8445032362fc37293fdb0b91a5aea611

SHA256
46dc7e72fe27d9445abb005ded3c2cc661a587fc48005f07bf06449352dca292

SHA512
408b1b9013d2d0f156bf22e193ec2e0342d5d4625ae860227af94066628f6966ab73dbac34d207493e6f6a1a6be77003796f2439955fa42f70e9283fbee3f912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f41e9fa16fe4dce85eb0dc4e272af146

SHA1
1e7d8ece20073d33abe4c51f0c9c4c845d927d82

SHA256
5529ef9d69e749436dce68bd223c57d774a8454c587f28e39502e26790f213e6

SHA512
6741b035efc2cadb8a77d6a40972c9fd64c1f1d7f3971fbbd77e7bfd83d7baa7b0a2ee8383dda73f446c6e1664448a937199a5ee0a352062e401a01a40d9570e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0c5ebbb4c4dc94f14e7aaed390dc9d8

SHA1
fb5760d958ca1a6ff8cfec8210ab717477e521ee

SHA256
290c6da2ae01bafdc1abedd18ee486c6ca818f1be61f2506f2c7598d24e3bb40

SHA512
dcf64aab16806fe121db3f1d196b1c0e74b595bb9ad03d551c4a86ebd94b8386e2e772721cb1134c1b7b0bd33dbaa2b35a1deb9a9653e129eb865ca6080e0db8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
118bcfbfeb0c037ca9ce1e5962b70947

SHA1
d6934c6b9d0a3b134102caac58c7eb861507d66a

SHA256
de9c97fce39b0b6dd835c7b231c1f9e6f38dcc6ade5fad49f1abc5c99058055e

SHA512
cfcab75f85824cf2d75cfb3ef2595d2b4219b845f970a6bb871f3a0a7d72bb1228cf22f664636c79008728951d744583189715045357f9239d69eff0a22628b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be60e3445048634097455b96491fe950

SHA1
731babd59b03458eaabbcf30e1d57e5d37dd8d12

SHA256
3cc7eb2ade9851ee01f1674601c0707c7838c90533cb033d01f51e41ac61c28e

SHA512
bff9b8b125b683551caeca33222aeb1a538ba8beb75d1215e662efd42b8c10b340296dd69614b626c0043004342da1f05f9c8529dd3f6c9b57bc96358261f70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
861d5f8c468b3a2ac34000e746a96c79

SHA1
6a7954db324a7ac357722e997807bc122a0d26c0

SHA256
7154c50a8139b96f3368918d592e91e7cf2e073ea5f97f4cb2b2e30b9c1f982d

SHA512
8f2933c3fe878a8b02d9e10d4366ac9b35a0dde49726a6d4ac13cb39f59a4a396c4dbda3e76b516d0e89b21c4976047cb653185ee80690d79e1e73fb225851c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5959.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A08.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit