dd35e8932843e9df34019ffe8af9c5f2b9c57f9e8cfee2696e8cbc2e7e7527fe

Analysis

max time kernel
142s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aa448cae6ef707d6f4f3ead62c230bb.html
Size

70KB
MD5

1aa448cae6ef707d6f4f3ead62c230bb
SHA1

ff5b1689fee05ca57001c26a9206d92569e7793b
SHA256

dd35e8932843e9df34019ffe8af9c5f2b9c57f9e8cfee2696e8cbc2e7e7527fe
SHA512

40430efaa847bb08b9176982fb552c4611d426ec37766a55f83174aca04fbd3daacf1d4940a95e0f4eea77060a9f87c82683bae17b1100064d7c05357186878c
SSDEEP

768:Sx0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/VH:S9Ik/ctnwOHjRucT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ced70b7cb78658b9d613cf8a65aa8c3423f555ddc293e13eaf5adecc7192e786000000000e80000000020000200000009925b91da7a89ce5e396198a6f72ca9b58434b5a95d0518901b65aa86c5c8007900000009ed982bad0c15d0dba6f2674dea517d8e0ad4683d15dffcbe59e9460e6df8f553bc3697f8838b5dc08a3ac9f2116be89db37192bcf592d2cd609fad5be900f1694209414d6b306f63460849a7278f05f914709852a8fa5561555ce5dedeecf5a6984397b61290baa6afe63a775634fcd80685c6dfd8d70f18da4d40d3ee5925858fdb97ca36d4dd7acbeebc32b8142c2400000001412a5611e9e7f99921810b0ff5e96c04453a64a44c56cbf4a0ae3c976f0b5bacd9e205a61bd485d4d078da8510d9b68f97915c3a4677a99eafb298ef297d5ba	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03402391-A3B1-11EE-9B8E-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03fecf8bd37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409730995"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001cdb3dc2950f97953da05ebbbf857c4eeb36fc36f68bcd18050bea3eeedb3262000000000e8000000002000020000000a9bbaafe2fccb06470db8297ca597493f04e787bac0054e01eb236eb59ea257320000000cbb960fd34faa0d8ae5e633296799d64f053407ad7c5cd7a281009b0ef22fdb540000000279bf978c9905d3a45653d87bb76e25fafdaf161160f8e35838b4cc244d63c32d3a443b5ff021cf360ea55e349df6b2f7b8fe88b80761cb4c8904400ceccd5c6	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2696	2116	iexplore.exe	28
PID 2116 wrote to memory of 2696	2116	iexplore.exe	28
PID 2116 wrote to memory of 2696	2116	iexplore.exe	28
PID 2116 wrote to memory of 2696	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1aa448cae6ef707d6f4f3ead62c230bb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b627db34f48f09b75d4c49b53a50f6a2

SHA1
e37773398cc2df7a7be6c2187067b95be1277414

SHA256
87d6fa8b7acb55f20308548663e288c2c5d816f243c128f562f6dea5928bbc4c

SHA512
787b4330d427716dc79898a602d055da9b23a5e88f932b0a400fcac4178378f17f9698cbc3c98a7722dad1be0734207c2354712d46634a50da045575105cf443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2c002a995f449ac788f36635c47201a

SHA1
69077049a0cf745f790bfaf3fd3bb0a518548a4b

SHA256
281f4ac3fdfcb468184d16f2f431140663c6fc0e4adb9a2a382e71f4056b8d0b

SHA512
758529b35b11614a39f0205f894f754169dd3889a1c74962be44213bd7b6cb23bbe8ceefe99b1a6018ea2d29e40cee0b47b2f22cfdcfdcb1342703b0acaf5eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b59d0b848fc9c8ad27c68bf26c34b1

SHA1
a69fd687faebad5fbeb61d3834f020e838ea19a4

SHA256
55e36eec7caf8bef99570e3e2a36f802cf63e4323bc58fc17863cafb933fa844

SHA512
1be411f62e38b6dddc015fd7e4fd3a90c759de2365ce295d1c1450deff9b0606a009e82a901fdd798a1fac7be18947c466a5202e14b643c078e012432e641d87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6636b14a418308cda2bf801fe3e0f7f

SHA1
664368606bfce225a986d4bdf253e2d344d50cb2

SHA256
0a7928f58c63fba144d4c56a94170bb81dc0659655e411c003f919d9ea0b671f

SHA512
4078141049015c54cc627a03c15beb731aef4f02a6c0be9c869ac71bcb5b37c6ae7bc3997e251d6925f72d9d3df41de68c5fc68a29c75f66650167e98972e611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ceb7a78bc72fcf8ced27c4f24c5f28

SHA1
8838f80eac03a54e0350c6d66cc9047443725a0d

SHA256
e097d8df249ced7a1fd63bdc4a39a0fb9dc461a05c77cf93e4c7f063fde48d8c

SHA512
b7425cc850d13ecb84396fccc4005e82ecf9ce57dada5a76eaa42fd4e4759bc6605b7c684d44408c5a412375e7fc9f6f9ced6b0104a2494522d6b62ffc35a553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2344b55ffad0f1441c3892b2c6ad7e9

SHA1
72c711756d02ecc26e50c40b65a2c6ef944cbf65

SHA256
38ec67cee030cc0b6ba0a77c138ec8895a0737932d2db30009185020adcad250

SHA512
0c23318e6a877962fcc1b34878ed50bb1811a08a25c510c19b8df4cfbe8392c999efd4dd50a9a4ba634d70c15e2609a54821dda35d31050d294742ed6da3f2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb25b2d11ef3fb69b3129aada8ff6266

SHA1
0b2c82efb3e57115fe19166b9100c4e97880ec69

SHA256
b73d95efc7a57d8bcae9132cf0113aa06e7244bfde468fa5a225856e9da80935

SHA512
81471882425099e3f92d24f6f2eb590cb4b3b369c37461ed394787a7fb42991dc8e7e347e91be5e3a66225beaa252aa6aa74d628f89f7d5e98940f023b32872b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a8d1e19bbac6e746de070f254bcb699

SHA1
7f81cf1bedfa5d322456a2f5b00368c5d5af8fd1

SHA256
243fb7e5975c5a473251e8c810ee902a6593753bcb84761a3582c877388b8e8c

SHA512
a777f42bd2e48bd2aabfe6067037d3ab1b440ce0d6f22e75390969b0e8b95ddf93fd3ed4e4b07eb59a0cd9c509bf7ba77c8bb350f434903c6ee74b4089d20a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
917dfac965e8f60b8e9c9b04d5ae0001

SHA1
c1962aa79ba62ef0eee2f788acbec00ea1b3b8a2

SHA256
6670883b171e242aef7cad35b925daa71519c7d63c8c8b6e3e0c82667d8dbd2e

SHA512
8f26bae21ada17823afe24c341502aa40119344b372061b0726a2c92d5b8601d993c87ed697a18cc0752a67055342f27adfd488174f0f8f2260440c4e12bd72c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31bf7376a88291ca337b2690d7d9b396

SHA1
b520a4ecbc8bdc4c7d5eb94f276c172bc92fd3b0

SHA256
dd9ed52d12d2f54e323cc0b4d1ffe06d7682ef1beef2852f26bb085a283ac6ab

SHA512
d4d83b867d8724797a82aab1c7aacb3d71468b344fb6abe9bae07e9c11be3423e510e4575920a56674444383ba310a7f1af0805d591e1b306896251733c4da5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c087b04e36ec5dfab06937944362f4cb

SHA1
84fec47e4f3148d4ce25d60a34177eb4d4a60127

SHA256
f8b7e61cbbca0fcf84746363eaf7be8325d2164154fa938f000f65a01576157c

SHA512
9b27854caebb11d8ac2ffa685bd664a552a638dd43d4ce68187b03499f6544ae513fcf107b67875abdd740913a7b2175b3627e8806a29a04dccdaab217ed66ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89be09b89f9d93e4d2164d248f7af5e6

SHA1
ebcac601ce79118e9dcac44fd6159a480ebdae3c

SHA256
954eab31b2fcd4e3ba3ad54b3a173f37bd1e26f148c2bfccb825ceeb9f2db096

SHA512
2a100c05e882a52b6f179cc2ae43eb8eefcbf92e712169bdffc6d20e5ab44f48436a1c7db22b0f5ba76622bf0bc519460ec74e28bceed5a05ba2c8325ccfd677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b204df9d43d3fddc73033defefa6824

SHA1
01364313f096f4f3e708f4b22e048d14c855d1f1

SHA256
9291c796da4248117670d2476f8228015628832bb8354f4bd0aab246e1e90add

SHA512
37b8a20f0d6865133532b931ef1cfc58c368eff6f8a85476a32ae7ff42a812114e656cd7130829ffbb689fa2339b06020f0ea324c479aae30e95dbc5eba5eed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f868ad23373894670a35ce1230398f26

SHA1
4ca8ac4d4a3c25f71f0cf6ad2191b5d45f32a183

SHA256
f918340684417c9a27362de2a3162f19fdc397b84eb304a5dc3e6e00932bb048

SHA512
b2bcad5ed544ed77383a0f771e7288f3dfea017ffdfdc7909be19caed748d6123e86223c20d8f62d6bf9f4ae9de03919dbb0afe5e4a8ed6efd950b0cb9e873ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8b55fae1d0ecffe969b9ea1db022794

SHA1
2eca91cb688553355154557af9c3285dc1c7b5d0

SHA256
f7e15128756b2ff444d5e97f71fa9859812bc98bb276d2816f90daf703fc9684

SHA512
2874da946f8f32a15f7f07436bab4015e813a66754b6d94033c6169d507389d1ce853b37e46811156b43f904c6bbdca91fe208a7f2b5c8fffb41380e1e220bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e9ee3b79f2906190cf589264d19a91e

SHA1
554bc05c18949046609059cd2a58399d5f546638

SHA256
c885d0faf7e0b4c77f6bda6f933458e35f0d89d4f0f3abfa57e8614fe944502a

SHA512
50e6dbd520217bd2d61fb832c0aafcf8f384d1769c0bf1a1643726df27349c0e7801b08719642766f09ce3509ba88f478f048408a7469a14a12c77758eda2f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA768.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA86.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit