45700dee965e3094f8bc3636479cd92bd11dccaa33e267cfdb7ec1bfe883b282

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f7fac11e13335aea5627bb44eac2158a.html
Size

568B
MD5

f7fac11e13335aea5627bb44eac2158a
SHA1

7f66262463ffd17948c1cc349a06002f87eba1f3
SHA256

45700dee965e3094f8bc3636479cd92bd11dccaa33e267cfdb7ec1bfe883b282
SHA512

7c852b99fa6ed272f1d9518f62b83d0c58d980fd0fdb4a88987213130dd6f6001551b8b8732ed6ce2ccf63a38ef8791a1c390a24db78caef7d07483bf6ad8958

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000cbc35183134a7a4aac61a9ba632be29b77c4e0192dffb864b1e79318f03ad91e000000000e8000000002000020000000d083d0d086d98b397e7f39025965e477721900f3be48c1e49f806fef42ef6c0090000000624a9d8948be35c11da37e735b4873a37592b1ba0851cf0cd99f87cee0fa707e51ddabeec618ead8cff4ec88b50bc96dc71ad13aad4f1d1361fc09699a65697fae8c76deb90b51874e20904474ce654246a639d1050ba6c6563140623494dd6573f1b5813c7c512d79377ee539ef73429c880bf244b468eb250c7c7918b17adca26963185d74f8af26fd4d274e599d57400000006f33e1590951722033f3c53464c8cedf87506914bd2d88d12941cd8f133478fd18cb8a6a85bdcdb5b78c39959675b6bb19263748d09510fa245ba7aefacd50fb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409447352"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000001582054f2032270b5c57e7f30fa5acf2d726db0f19c3b2dd30fa6a4bf35f312000000000e80000000020000200000003f4495404e448d590e974d9802cd6bef7368e4df22280c7df28d9dd9d1775e56200000000bb26eb1ebd114e2147a732e28fda795508ad8771826c1dead27668f2b31a069400000003510325bd9d935683137409d499bc2de5b5341f3914bfba1cd40aa8174a66e8f7f71206b7a08b8f9aa71cd2434abea4d28f74724fbdd728704d95722cabfbef5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5076207a2935da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1541331-A11C-11EE-B07A-464D43A133DD} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3044	1936	iexplore.exe	28
PID 1936 wrote to memory of 3044	1936	iexplore.exe	28
PID 1936 wrote to memory of 3044	1936	iexplore.exe	28
PID 1936 wrote to memory of 3044	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f7fac11e13335aea5627bb44eac2158a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
487678ccb88d141c0306a642665052f1

SHA1
d4936c6dd3d5d384bcacdb7e7970703ae9cc1a1a

SHA256
682413b15a20b1fce7b403b157e12dd5d4e4d842c67ea25c43222f0cba53e65e

SHA512
f5fb35cfa381ebd5bd219a3b3f9fdba0791a9e0be2437bf3c7b9fa1d2ce2ef63bb8cdf81ad2603e84416691ab58c224d218c13329088b13cd8dfa55f1b8235d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd0e01861bfd93f8856e768ba381604c

SHA1
37b81369cbc40a1928df5d9f25fc095206835db4

SHA256
3f52b8ba915a8ce407955686223871cafd8bc522da5ec66a94b3f0cd17976b0a

SHA512
8c47f7a44d763e53b282c85a27967f6162af7d65d9b2b19802d20623852fe48ba9485e4289404cffb5a1283f0afa5fc4ef47c0dfcc55930e27cdb929e5381c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffafb21447dc54b783a58146b3973ee9

SHA1
d94f65719bfa29ca346c6a0fc1049281b6b53215

SHA256
6ad8fc0b2e2f14a28509652b5f0e7e1346a183a5f0a9d2c47fd11673b0cec128

SHA512
c82537ea56c7e11377ebf2c474523362853d891ff1c90305dde9afec1fd09ea2f46934cdc640aa7ea35f13ece16aee1ff9477fcbfa8f32efd5c877c5308d8c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4852ab457b5d824552d261893a56aa3f

SHA1
6cac929443051fa9326dd96c6573860f36012b94

SHA256
267fda6839f52c6b60f5574e5923575b532197b06f7dd8385990a99fed5a165f

SHA512
ff2dcb7b9511cc54440a3108ee0d5f87953ba99d36e823a733f783e7e6df759fdae97df1f18bc357f85aa804cd6965706b4182982293a0451b15391e0f2a59f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
636f3a5e36b9e16f897e9139bcc2209f

SHA1
431903ee29e7ab5dcc7b484aa6a418263b264cfb

SHA256
5a63fc0c0e5e0d27c63d0af0de00e9e9995cdd4d65bf0da84c0ccff5c7f99b4e

SHA512
e6f2121bd410807ecf54a97a29c64472564f542691227b4ef41f59d7ac622867c533a4680dfbb46b4e45ae3c2f04db76301f48cf7771eea6d20f62a000c76f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1792d89cbe14a2eb1f7826644b88f4d1

SHA1
2713a8f9333558407664e904ee5888dce7261b55

SHA256
3556e6c93b5771e4406d3119c9bcc61a30dfc7e20bbcc0f2d5e1c303a75b844d

SHA512
e332e37c9f44cea338b11acc9c6a4b6996da6386ffb57d9a6e0baac7317972ea9dd2b3e5d7a8e4374b2cd5ffd6387d1b3175bdaa6fc348a8910cf6db7f041ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a8dea4c11130ccc104685bb421a6e1d

SHA1
b1bd07fc9babf0c903a64d2a9bed9061b1538a7b

SHA256
f01a0ba53988c996b39146da3d3fb68dddfad7878a9179285a6db1f04c855f5b

SHA512
0f45199ebaccd35718afa419d1411887a860ab98c964ca766838fe6d6e6a182729e1c63c211f16c4eb4f7c1725429b4bf852b4500692486b2a9804dcde196231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46006be0abc9979734aa7bd4d89423e2

SHA1
02a4ee1754a13c1c5da06e953086a6613f0ea06b

SHA256
29a5d806ab9e34c90406b6f9f7b97944fb9292073d02b29f63cbdfc82727bf60

SHA512
20bec5a29a9a22fa9996db988c1a441fdfecd100871fceb761b462c99e0f76e01ea745319cf2ec042d4cf444fe9c98378af91ae75267b35bf11f5f35c2196c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
273a8dbf2be7943ed8a4990a2180ff8b

SHA1
ed0de695f14305c8017779bfb3bf650ddb2e22d2

SHA256
60e2f95354d9a130ec95529feddd422fe87d6ab528a4bb2b2fb7af5b7f300f68

SHA512
b41ebaa2dc2260dc29ecf10db0b866a502a86b8d79165ce96df328863a056c9e1c3269158140b8ff24c91609c3d0f0ca4a04aad4d29cbf246a3b238841a48af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8e8f1d41bd76e41726a0132650b0f43

SHA1
0af1d1efba50ce4f6548dabfc38aad9aebae2afd

SHA256
a32a9f0ecffc6dc33f9c9e30667f909965ac79d2d73be6c6a4480c243120c726

SHA512
457e7b407cc6144111d8fb231af744bb5b4d43ea7edf14552cf3913b33cc4f3b2eb7745bafa2fab32291831dcd5fe275fac48bcd5069ac65e7f5b0090068c5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
789bb9ee3f640058396added42a32c12

SHA1
c8a39ccf798e26c5dead802336306faa87925c56

SHA256
78b2161f033a053de1bb4d29082647c697992a28db79f3f29af3b71d30868041

SHA512
efdb292deabb50475d5d2a4c79de00f31b291361c1cbf6c2b5abf9cd1e0a38d7223e51918ca8ba1ad857ab6f279e0d7e50bc921a5cfe18457acbec4be935436c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb403b94964a2fc7ef4d6a95714a1350

SHA1
047d4b193e911d934a93d96360f10d134c984375

SHA256
7ffd4f3fa285e943d414c76f741dbb2478e7f053db57824359b7191802fea4ff

SHA512
07d38fb1dfa4050ca260a26df0bf11016dc33d01a022ecfda37ea131ec78fc49479373f1e8668cf85d6f4f45a37494b5f04e99db2480e80af42a36f2ea090ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa52f231fd203f781e40abcb03c61b60

SHA1
1bd5df3acee79f123cb9c5360559fe1e21ead49d

SHA256
7c7877d8682da75e18024263b8eb2beffad9980a27d09f1c8cbe8aacdb4c7fc7

SHA512
719c47240a56637210ffab33a2d9fcd283a248f898558d21d5841b2540222aedd9ec72cd74e1d7b7563adb28aacdfc970a911ecc35528277a7ba3141e1e63dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8733f38c07f79399404ffb03fd91d71f

SHA1
def5adb21b898d19e9648d11de4d553e1a6804cd

SHA256
9225ba7172df7fa8dd795cddfb411922ba3ea0b90691c9b54f9ad5df4209c8a8

SHA512
b2d7beb8c4b03c9e6f1528691ca07d422f6433e8e04a927126005109d472756d922b44a893693c10b90415d6e9c7ddb5d1799d5b3e5e60fe1744ee6f64163b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
891e21dbcccda946e96623fa15872d62

SHA1
6bce1a93d791e06b9e11064e026b3759400001e8

SHA256
c845ed13cc00e3c83f7bf183787ce73bb27681a6c10dabea16d17d44e7b32cf1

SHA512
a288ed637d873fe20a2c94a9868b7439bed0942d7e6d50cad7c753ff733a347ecd51d50dba6b491e651ee1d080c93032a6415355f1f8f6b8730b67eacbab370e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29A2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A31.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit