f804e393dee71fa56df8742480417331bf2d676bfae8258cb9abad1352d428af

Analysis

max time kernel
117s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f681ea64192d5325bbe5aee08f2963fa.html
Size

6KB
MD5

f681ea64192d5325bbe5aee08f2963fa
SHA1

3647724d9217a01039e9a9ad1e41760233d6019e
SHA256

f804e393dee71fa56df8742480417331bf2d676bfae8258cb9abad1352d428af
SHA512

58d830faacc4adbc56a2ec838b9fe00cce8481a7480b0d05839a15002e9115023a9553821cac627146d3711cab00906d26a69cec5be13ac5b393f89611e0e250
SSDEEP

96:eagNJRfFEByBmntetzpGEpaEphpApQKpcptCp+scyTnyqxTx1sZ+bRi:etVmtetMhus7TnyqxTx1sZei

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409446901"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CE970D1-A11B-11EE-994C-464D43A133DD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0eea3642835da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000945af09005d56c2b598379f1bdd9ca4c1a4ef9e624d62c4a7cf1be46637d52f0000000000e8000000002000020000000d29f1121acbd39938a0b9d84636e63746394f92553cb0e7748b403afe240d36e20000000534f8acab8adc74d004d717b7eddb7baa24c270b84a3c36e3b483299c092df1e400000000a102554f5739605068894a6a3e0f3dfb6df622131c54b9f2ee11b42a40d975c01757d82252065dfe8b4aef63f250bcf403b47d3494231c557cc0f576085ea25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000019cae6da37b88632532d8dd1f492be12cd5ea659942fb63eb24ef8f5ec6c71b8000000000e800000000200002000000048e7c3badde592c104d6465a098eaf1645556a68d67005192c71163d7be29a9a90000000c589c5d7a0645f05d3df9f271f167b1f925ac397fac636f075769716c9a06c2969be2ec2bff2288f0f4eee5e10f8e02a1c6d4829c3c354bc6c76d46134214687501f195996b4b091bf4e21edf9c09db6a434fff25b78868d8fdca510a252c27a4b56b8b3b759b280930d6bd06a39c2d5b6538619ee99a22de42c57b5e098c3a0684a57a20279dc452d275b94028a0c54400000005db62e67791234835d29f243f4c156198c44368d6229bfa0a90893a042a355d5a3e096e9c0549e9472bf9715a347fae8f34abb9005ac72d3727b1069e03e3011	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1352	iexplore.exe
1352	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2436	1352	iexplore.exe	17
PID 1352 wrote to memory of 2436	1352	iexplore.exe	17
PID 1352 wrote to memory of 2436	1352	iexplore.exe	17
PID 1352 wrote to memory of 2436	1352	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f681ea64192d5325bbe5aee08f2963fa.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be3670af3f9b63cd6af2830feb8f3e06

SHA1
407b70f0ca9b219be4b71aec1af1c7f79218fb4f

SHA256
2a47efe7783178781d4dff42259d6ff186628f014a90fe678a2dd8568249841e

SHA512
b7a173e07f7819586266b1d92524e494021e0d99971a006f8db5c4d5c409677594dc763aad069714c8bd1a2402968e03c838d3f7d52576e20e4440bc00c0c1c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
425fb93bda006c00f801d23c798ff396

SHA1
67b93f186bd9ba0155b97cfedf5346c8db1641b3

SHA256
6c0e3e0c5f5a599e558ba3fc7e0dcbe38935894e958922a96b0ed808e7737fbd

SHA512
544e45c127bd65e4388b812188e28296de067f4a84f74daed6e93c867a9e1f158c270a9a7a1ffe2fbcfda597b2ba76e92c0e28afcc002cbdf78885079c76bdc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bb10fc2fca31932269fe8655a41ed68

SHA1
9d94fa594f1f544f31e8db692a93f88c9ccab483

SHA256
a501b67037a0fdad3468144b1232d9cb28e9fb4a06e07655d765323faaf8a7ee

SHA512
5f1d6b1c81801b0ec504ee73f0de6e8259add99e894ef318df692c49bd1f6f660ed1e1f9e586e604fa35c893436956d7f25abd1a0bd041352c598fc2452d975d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4b2b79430eed0f1fd758420c3451714

SHA1
0c1b4ca3ed18296df71511d71837c71d40f37f63

SHA256
66f7849830ab537415fec16cf520d2a530f2755cc797d36d50599480ac82d113

SHA512
179c9bddb6142a7133bf63a3a441a954b9660a12d027d9e8309bf50acf95b695b038873e49ae00ecb8a61c84e81bd32702c4a82aecdeaa203ff5006d7cef32d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46d71be0bd578d466a98c0db0175f4a4

SHA1
16834932c2bd981aa1a97402becb60639b3a2144

SHA256
17b062999ebb37d7a1e34640591d792f91dd772dc5ce86602477234ccc148801

SHA512
14a932919e50d8a26bdfce4c165d1f050bb264bba79c999cbacad31ca4c5a4d8c277f632090a1b7ff1cbc0fc21b241b2671f34a41ea5e1e131efe1135c70876d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71fd26a644375dee43fa63414f67f9d8

SHA1
5bb1a8c212ade39d8bbd3850a77ab0af59380a00

SHA256
e598e686c5564edc200059989e99487006db9bd9b8b9422935b04d276c5d59ad

SHA512
871efa56d784fe6921328406efbe8f06312751c42f1b25452f74c3a5e86bb16af19aec5d353bae9cf9accf85fc7f2759876dd070d31ec5bf39f22c1749faf15e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d43ea02c5108fbd45913a5d497c5070

SHA1
89bc9e6957e5d8a692a6d5861397cd38898af3c8

SHA256
5ef2af3becd8975c8712a13b3d2a3474adde14288d3174ec9aa43bcb4cc8dfe6

SHA512
5ff9667e77de3a1493b4910074c3bbfcbbc6b9d6ed0432a2f658d6414d38070c1f20633f8011679e8a7fefedfd1939f7e43c71bd33203d5c4af8af23481d2912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a99a6026121a1ec12a2a9666de021155

SHA1
ba6b5571d9afcc3bdc7319b68cb87e62acb46484

SHA256
bc25f5bc998b63e5dfd47310858cdba38b74c614544f3441687b8bdd0ee956f6

SHA512
0a5fa7d68c2bd49b3cba9161c2dd51e533c43797caa1de958d4d514188420f9b7bf9a0a1161578787a6e299decfb5ac92511ed63e7a5f71d13f778831ce6df15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cd28d8bb0088646faa576b0a3d2de74

SHA1
5913a3453420a280597f72696ebb99e36667af04

SHA256
95ff326da73d2900f5bdef44c94f703d88a9e69683c7ba0a9731eefc82fed04e

SHA512
f2e2ae9605aa135157c79eb76801da19c9bf92a50cadd953aff2b13d946603c4d25fd2ee408abe0eb792a539e416345629b028b64c71b0fd3dddc5c76c712895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2b63acd93567da7baa8c0abea67deb9

SHA1
7a743f58f34504e9296471e672197f7d710df29a

SHA256
073cbb0589af97df9c2fb1072546f7af0a45c52a1342bf003204f87cd248b181

SHA512
06a0fb6f942e821e0b7237898e039527c85084116b80b26e58ba0b5ff1b0efd9f8a399bb8391bce2649371bf9617976d2f5ee2d2c1bf592f126e2bb70e88384f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8479565b1192de088f736206875f74cd

SHA1
40a386576fcbd6103aaacd1a01d368caaeda3fcb

SHA256
2e48ecd0252117d9ce368a993dd4ac2ddd266610aacc79406b65e4e36f41e5f8

SHA512
04d73ae86fff0702aa098e5634038a91c5f822190f92d249619b4fbb0fea1c3ed35dbca0afc968cf34f677b987cb0e7bfc875e70af7cc63693cd8a1da91d95fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aadd34b431483a4696a22d302cdbaf4

SHA1
91cb26fb4b9233354b06ddf7a8c6ce91dcf856d5

SHA256
55776c4e376917b382754cf5a8d37f7d0c86b712eaec2895eb735cd721917827

SHA512
6cc1c553263823116516e37fb147250a6cbe418ea89d932a0a9c7b0d312824ba644e177c0197f53587e30d3006033a92e4a1e5f26333829f6e2fd5d776cee926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e80b6b7bbe025fd89a04c80f5182d39d

SHA1
107d7d8b0b4fbc91b385ae2a067e740681344b34

SHA256
3747277aa2b81b4aecc12756549846898dfa019c54437a91eb49c36ca4e0770f

SHA512
7d9db57c32004a4ea555a0f0ad020386bba2438561fe2e3fb0aa568b6cf543fc0993cf74b6735dab169ec0b1756ad6f550c732af1582385ef4a71fa06aefc7df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7AED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B0F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit