4f5484201309e2561c8ad29af2cb192ed28c1bf5d50adc3cbebfcb9a741fa44a

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdad1381944878a18bf44deff59a22e7.html
Size

1KB
MD5

fdad1381944878a18bf44deff59a22e7
SHA1

ab47a3882310574e8be79da41169ad974e3f4483
SHA256

4f5484201309e2561c8ad29af2cb192ed28c1bf5d50adc3cbebfcb9a741fa44a
SHA512

5552156942e0b833af594ccde0a7e4b7fd484f178bc13b3d9fa99d4fca9a6865c77d2d0e2237f4d61c7801b945a7c127a604226e043f3c5117c9ccb73a42f8ab

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409449158"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9077c39b2d35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000088d7560a517d3b2797cbebc798ece28233bdacb48ab8988b1cb7e21036d08977000000000e8000000002000020000000988f99dbc5af4ec343294e8f60dc9cea3151cc84bdd98ddd5b114823f829f31020000000dbf46630ca7c02db0d18cff9f6708db622559ec4258ebf209b30a31e3626cadf400000001dfb1d12fe3b676a8906b2c39f48739695ceaa78d726210c3f9f2e3f9330e1da91a15cf9fcf029ba6ad3ca49cd0cc3324267ad76a860c7d298c90dc839cd47c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D58293D1-A120-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004e9450c23e092febd25c889275cfbd798f90f8ead7d2b98045d29dceec9a8d4e000000000e800000000200002000000057e852dac5486d3c804f9738ac350e195c654f18e9f7b89027a3b8f99186721a90000000b4194ce487f387fb761752b6ba2cab7a1e0c93b5fa764a3e282ade709f47df7bc92934891e89927e4a630d63a6da0754a468d581e7526d031b4bee7871a32baefce5262cf16fe09a9aa3e691b5d3a7456ef1ecf9cfa453a421a279b4f4ce85d43832449f8e947235119f7334cf661badb427cfaeeed9349998ee680eeb304e91641d423eaab410724b2b0cb9c3b450e0400000003adfc088424c9e5ad8bb7fdf655f607340ad13ce3c86f9509d131a31e8711dc0d7ba9d58c9e8ea94e9636fe61dda9dea96cca2c0b06104a98b85be1f954d80f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2476	2096	iexplore.exe	28
PID 2096 wrote to memory of 2476	2096	iexplore.exe	28
PID 2096 wrote to memory of 2476	2096	iexplore.exe	28
PID 2096 wrote to memory of 2476	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fdad1381944878a18bf44deff59a22e7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30bfae5e64821d5684fd9e918927b890

SHA1
3313de267255a4d34a1a4ccab2749c89a4628828

SHA256
43d9b00334c84908d00f4cf2730b48d131f7ca8b320a4795553467e9e5d13ce9

SHA512
f5535d0e9a702a2c1e905c6e8bdedbd3ad00a6a8b1ca246b6e8df318a37f8ac1e9c13256882110dad9c142437d0b927870e68518bd674f7cb0bd362b38830d0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f278c263fb1766a1711c114a1652b7c2

SHA1
62933f9828d6d2fba7357cb530aaf53c52d72693

SHA256
0dbeabd78550ddd2df5b9ce0fcb81b2474596c9ccdb14fe9813a36b81e422d95

SHA512
c04818cfd4696cda388c9e7b35a19f7c023c181148c44496cb3bf1894bbf8334e8d58ba1b707a6585760e05619ad330425cc171bf0cb4b24aa02b6e8e3444126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f19c14ecade3700e3f0a7a4d06e02ae

SHA1
ec8eb7431a16665de7cd5f76b7a8ac12e8743c75

SHA256
3de8f36f4a7c806bf13a7b7f1e5432ef43af0adf173ec860f6f9690d8ab07faf

SHA512
c012a3443b97376bd038ac945530ec0181588aafed04596ae62ad10c763e6a495a3a8bfee7f0924fd11d69672519191ec7a2f9d7c8107c9aeedf6c1914410e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e0d4ce787249a7254e97f77317e7300

SHA1
8aa01f8e0bc07b2fda316f2708cfeb2346dc85dd

SHA256
36abf3023998f1fc115e0cf47982825f9d9a9d433d6f6c1528a155a84ef8bce0

SHA512
2463654363aafc909781d6e12d77c04d2255a1105f92a8605fba4af3addc690b0039f9a3280d8f7a15c2d77d5d97152dd0cba1456878ed4b9f3462d66b5edd62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de6ca93a41e54518ef11375c0eda06a0

SHA1
79a0afc4c2604ebf6f332e8302a5f2cbfe8a760d

SHA256
e56e24e4cdc1970ca345e71cbea86048efd2964e09925e5db902cb9c0ededccf

SHA512
2d553315d4bdc938b668c78773ea595b00d0a5e23fc237d50964ee519c0c6465a8152b8896b61fc10ce4e912841481793133f254d8b32a13b3ac90c9f456c67f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1da470e8961ecab7c5bfed4825d85a8f

SHA1
b95e2970868f6f8e9d04ff88ee53d3d379355fc7

SHA256
0105039784e888cc3bfe3a6669b8e769075db5bca9bb26ce3d0f7bccea42b556

SHA512
74bde3391c5117678b8401b52bcce7c308072513e30368745bb132a922f634ab348c53868fcd46a0f181340b1106bce2f69cfe152c35ce50fbe293b648f52ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fb405bb0d5f25e3e044c330d69e2b57

SHA1
f351ea590f520dc540ffab7fd78f72f8ff23ff6c

SHA256
729128aeda0b9609de953ac811f73c1d3e5f3985377cd0dcfda9d398ee434156

SHA512
dcb55e09c9f12a2f4b208f0002c9fbe1917129c4b006f02d0009c8b22225bbf4eb5f52a8e3b014e2210dc1294f59fe1dc09cfeec7bb60b72aef66a078e3df41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5243ceba13164c6ba61d900740f43a45

SHA1
ea24a2510aaba9d8bf134f14542969b1ed075e54

SHA256
eb9ff628a242e55c38fa332b84347dcb9dcf2726c0ffd172af6b752971e3d4bb

SHA512
9f6a7eb5db8e2b59a19eb2359772065f7aa7f5e3668530aa30a6bc1d38311ec4a663eb3a9c47ee6c657c94069f173597ddc46d8f02de37aa75cfe29af74881c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a305de563b26e70d2227b67b8627b1a

SHA1
1f1f6d7dbf1447b622954c0e16cfbb60f174ad23

SHA256
cc31186b9568b30826aafc97f53414a892a3ef8e812e6178b3d0a62fd8943371

SHA512
d0feb58fc3304cd311c922f4329bcc220e414649cc4e98a7535f5e43b381743eeed9a0f9e8e04764c59cc6fae675e78da996c777ed8e4205a02ae2c7b0324420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54854b6bec9e2696aaa7b1fa63583d97

SHA1
f2b80a6dce9efc9d5c539055208e6ecf6003b465

SHA256
91e98d17a1601e6f098a8afa4ffe8d0e365110259a226547a68c8a31453a9216

SHA512
92d7169c85bd9804b8aa7f3851abf27d5783405c1a478762e53071678283120f5911cb6889f68e02320a28fba3a7c0e55a747eb79490ac445be400138478a59f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb67793c4cc41413e19ec720ce138032

SHA1
3a0b8ac20fb6c70fe9fe7902fc97974554eff081

SHA256
028f969a3836f3e8cfed127f2e0e5539f4fd22212df84190b63244ae11d9ad52

SHA512
de5cc20383bf349f5d3a6a1969c3fecbeab41d9793f3efe586855af78dd8212feb3d91470d1823f86891eda879d47b9b907587e69afe4d90ccb424508bbc18ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa8492d99b366c37a5ba115e3e18f3e

SHA1
96d59b06017ea14721b3bc53e77bfed3c702fe73

SHA256
0371b956d9817992780922d6933757c19a25a126a86f46669bc1315fb77a7662

SHA512
c67cd7812571c1dd05cf82918e1dd0d244c22ba28ee6e6bce55207469d243b2bb1a6dc2990eaffa4a754485e52f1186cba892df654efd005d48da8637230a154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8059089380d79f03f7381e0716da94b

SHA1
951661f4c3d12aabccfba383e587a302f8563738

SHA256
96825a33f411c1065f0a8d45d2aa932fd98366d5500cb5aa695cc8bdf3b51f33

SHA512
e6ee3458cff0f71d6c546cb900b240ca357554aeabd3637f6bdbd6c5d54d28e45f49b92690a5459f9302ebe7089a9648c9aec9efc636c7378f5ef6378fa5e3fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
226f9ffc42278ac0d4fdb3fc33cac360

SHA1
9cfbd11255f45f22e219ee6e20dc4040ce0051bd

SHA256
05f26e233b2187b6027eed1d4bbc2c96bd4dfffcd54b3b5b1c339f6445f83890

SHA512
41a4791d69221997570b04978fa4b8c67a3e50e6fc7b8d1fa4f0bf663d3b9c93b6abd1da6c273f625d7ac0f8a7b627df4c82b3100aa540516cb92dbf3ffdf123

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab62F9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BA4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit