e1e66a639564480eccf1f41645a0886181d567078ef43d1a123639df58611ffd

Analysis

max time kernel
66s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f61af7d8d36e96461e06f4c9b9df47c4.html
Size

14KB
MD5

f61af7d8d36e96461e06f4c9b9df47c4
SHA1

99c055dc929186bb49df68c3a9a288223e637f0d
SHA256

e1e66a639564480eccf1f41645a0886181d567078ef43d1a123639df58611ffd
SHA512

d51895e9c089c98a5e9f511608c29fe22a17f5126a5c7c284b4919cd22d6e5baab0540b49d1b0a3992a2e53fd54e3f3a82f4b751cdfc902c3dd60dc165651450
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vXmlKt6DvE:aioWD/ZmXg8SZQAmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000eeb1d35c0a872f4711197d88e99f20a9a4e90e0697705bad09aea156b1ff0ef5000000000e8000000002000020000000c0c06154a01ea9fb349965a216401db61b9ee839a7339dae17a26ad7e46e032990000000f6f03f532172d75dbc83dab0b240b3e5e7c0f0f47976bc998395a539aedb6075d7a685607054e6414f9de5310f62afa1676a733cec9130a89e1d7f246f538766ede5dcec2a95fc017786a9ea6bf513d4eced24ce60a4ec0555bfbc782907c858eca3ed4f54027d8b6e39c2e682a91ace7fabf96a650395d1c94f11ead28fff15af242585fadb84be2392404c2ceab1d9400000004ced9c7d073fa1990d6ace260e7e617eaab3e3d34f71d06e0dc2822338d76ef42f4d5c5afc441559da0e70a2acd2d0d9d4bcb400d801c564a046ea800119908f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000d18d330cdeff4cc68f3da4eefe4d075d02cd6056b16fe726147926a61a7ab194000000000e8000000002000020000000a1045e5f23b80aa7edebf4a0b74c1e89b3e3b77c5c1b63434a04afeec7faaa1d200000001c190849ad523fd23465d994e2792121829f33facfeeae3642501e8eebf7000d4000000022f2fae4dc1655c03231de9a2c11a00ede09b597965498c7f1cf4be1cf1461b0d6d70a996904a7156861bb0194bea7ceda462751653907b64b075035fe4abb3b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0188e533c36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7EF93D11-A22F-11EE-A731-CA4C2FB69A12} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1744	2032	iexplore.exe	28
PID 2032 wrote to memory of 1744	2032	iexplore.exe	28
PID 2032 wrote to memory of 1744	2032	iexplore.exe	28
PID 2032 wrote to memory of 1744	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f61af7d8d36e96461e06f4c9b9df47c4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
146c1ee682ad9f0194206b94ee81ad7f

SHA1
9f5d76239702f81cbd10cdcf32c78b91e69659b7

SHA256
6a0718707be16a69160ba1ae50a925e6c11e2a4f211e1f643d2c755e36ff7995

SHA512
f951e513ab792b3a87a68514a982599021b0d1e0121b0c8cdaeb189097dd7a20a767f93b029c142b7a862d360e0c77481dcbd3c052ce50a59a2b6fdc53af66e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df088070ea3d7e57676fe7c02b993726

SHA1
c1359262b66cb3face481adb8b2a28fdb9e9297e

SHA256
537f56751319f12382077daafc61aff70334ed695e25e0f5666d0dc8640fcb8b

SHA512
172ac5b1c25739db171240d4a4916ba3d892edb027198f8cd060d2999fa9181bb830bf0fe71c49a478e520d72590be807944c98b28596c630ac30fc49529aa78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bdd1ac9146d6d9bb3bd78ae9b4d7ea0

SHA1
a947596a86e31aea9d18e142d82c0bf66e7b2426

SHA256
d466eb234cedd92984f34fa1393e8e1d30c658832ebbbb10235185d858fef1a1

SHA512
a85f2e63fbf739b4cbe884de2c2f48e296c51709893ee821e687453597e229624da1ca902fbacec5a39aded90018221d40c2f0aa6c754332a1ee86e477e547a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b01c47b323180795280d994057919c0

SHA1
1acc5477fd60520fc9e200ed736e4571e4789192

SHA256
aa3bcf416dcd0843ec2bf4a06b28d5d604cb797accbc307ab36528a3fb2ad78f

SHA512
0b81ee920583a648c6539ec2355321a234f8dcbbdb827627acb49db145fa4014328d309f3f6259cbb6d32be993ea3a55325392d4afa8ddaf28a7ba72802d694b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65ccdd835cd3440ed31c8f0b129aed08

SHA1
0b9a0f259f50ca2057fbb196f7dc43ace5055e0d

SHA256
e1e7a823dcbdc1d50d7ea07840e847ddc05663270c0fead0a326999a404699f4

SHA512
b5af9d0fca3689857e6c441311f8c1bc44c4ab0a10deb73917e56873cd1bfb15e457b9dfecaf7e54259f0dca861fd226d9d70167c3b10db19039829628083de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e8ab2d121b5cc6b563cc793ac4f3826

SHA1
0db7a0eb19cc59c78bfe2b41e9a8d473646d3a73

SHA256
24ac33c0e0c7dad0c67bc81ad49263705227a466a20eed9ed74f295683a43336

SHA512
a9d8cefe0f02315430260798ddd9f3439ee541bfb9a083882b5027a92267533c6feb03b42696cd98a6743df58074fadc508639b5e1d95847452f3bea24c32220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15bdad7d7a438ddf776a285e5c84c7b1

SHA1
8ea15d54ed41678556ee328b661876c34e0b8a3f

SHA256
5b8c8098be5a125dd7975099247efe102f317cad6e80254776fff43d5e850f58

SHA512
11c2efb787f16d00f940d0fbc7e678ee197ed31345ddde52bf2ca691c2b57a47d859563c9b4255d7b5b548e6668f6fa87223ccb1ad48a5b33906dc787b292d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a24f357e571db69ce92aab9762f673b

SHA1
11599147c785fd90cf7a828e5b1aa62b078c2aa8

SHA256
95cd70e4daa95431bed5e612b99708929ca650da15d9cb0b6919579af2eccb77

SHA512
65f77cfeb7b5353b34b062ec4893398d11a12264853ae421795b9248158f6e9d7c94050a2313cc4ab0453ed53a7506a2569445e7c7435474e5101721d766024b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5615c2eef287b804059f9e6bc0fe1dc

SHA1
4394b4ba537b5f56f2faf588fed03a9113eaa76c

SHA256
9b0ff536f94d42a33ae6905a923894d589db7b79f9d9057faec6860593bc0ae4

SHA512
21d1983cea6794c58031173083d8cd55ac3f1c795f100e2187cb3d9b7f0e165a8c3f034a608b1524ef2ce1afc0de671c037efc3033b13272d77181c001f55b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9794c217743e641b09fca7facf5656e0

SHA1
0f653102b19d197f3ecfff7ed7f08c36b05058a0

SHA256
7c5da2dc1207b945a65c45121214897cbf8a3d99cb629148683ff3407d4cb86c

SHA512
a576917f9c7aa1aa9453aba6fc88b1ec0d7b1449637cd769bc7b0d301e9a07f7a1d4d7715a2270ee577169476884ffc2d10c31f80af892fa70a2c67c63e91b9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e7bafda8e96670a038c26be0f0b305b

SHA1
8a28e8144228c95c3c47e29b690ded1b39726d71

SHA256
2f3067cbbd71efb8d83b5f17fdc1e7c88c3af2b723bd55105076878f1a5641f0

SHA512
c9ee5ad5b8a6bf2e1a2bb3c298e949adc4b6007f7ba9be403e4051a92238e2d604f21927a49a75d661949372b2d0680a00511d8c14ccd471cac349f8b7ae7f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1ee7b632deeacb0fe80070ca3ad8236b

SHA1
18c2990645b73f741492471cb934b1c21583254b

SHA256
1db5a198b093b37f3d1ce6c1a55e76a81514fa1435850757dff23e97b27024bc

SHA512
2c48bcd73e09596d0f28f8168dccef0a23ffd844d74095b3524fe5da881577c1f08a482998d88463ff6e453ed470d578e557a4f0b36c126d882facce5f680801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7f5e68a04a61d259b2b496362e67be21

SHA1
fd320c342ba19245597a95c95046a443527acac2

SHA256
08fc1876b90d439dcd1d141e1b4ae295ce4ed5d2475538cbc5f9b7630df1c858

SHA512
f0af91f5fe7e42f138bc1e2ef9784312db37a192224509034f834eeb4144e86c2280d72232ab943e8ed37a4d4bb0cc562731e4a0e56f39d38eb23c72320b27f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27BD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2929.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit