c34d478a1ac79bcde23fd2e9dc53aa022e873ff9a0f7a22a52ad8dae889b6947

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aea7365d09d79d816fa8ae8bd5e72dd.html
Size

26KB
MD5

1aea7365d09d79d816fa8ae8bd5e72dd
SHA1

623ad7678ba3c696c3c8438c6fb1f4bf8b28d192
SHA256

c34d478a1ac79bcde23fd2e9dc53aa022e873ff9a0f7a22a52ad8dae889b6947
SHA512

087093e4c9177d3c296f95b5132a0009ad6a7512ccb39e779f488287258e154daf808328e2504a5bff767440d56add296ecdccc422986f8d05a0d53b59c718d1
SSDEEP

768:3vQyMyLgb09bgamg02ZuE3lgscUUObwXn:fQGLgb09bnmg0ouE3lgzUUObwXn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002a1f013e852b0b86d57b4fbd9c954873d68de88d67085216cc331c96216bddb6000000000e80000000020000200000008aa0b99f2dc69bd313bb3e38e89bb8b7dc230ade305aeddd9747a344aa6599fd90000000c1866c6b72f9be8a5317b448c0fee2c589a76211cbcaf9efba2a97965b760efb468289c969dcf69d94ed5c14f3183797229a4ae54c3327e6b4c5c1715299bda3a8ad4afd8d99f463a54d1295c02ddeca5e3c64028b2c3eb9db70a3a1e0d7f522c9814ba5e95a287838d9294b99fffbadcf5abec58d7dea8634883251962c9b8fcb7cb44c7c13dce815258fc6c8499b08400000007c0e2ba5ad42685798f5ee16da2f9122aaec1c64452dba7c3c5ce17c0c643e64fbb8748646cea3cb73d0e0a11ea9dbb3059becf1ae895eb20fb7fd2edac80ea5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10174a69c137da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86C70A01-A3B4-11EE-9D0D-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000065d324c90bf5d5f7419dda24e46a6c6253728bce2f427cb0520a1c427acde982000000000e80000000020000200000008ba4c8f94b69138451c77bd9313fa5e4a9ba4a1a4a363a62b3f2d849c426454520000000e0566dff691c8404ff6c96ecbf37891d7a9f6b903e4de93da21c366ad1d7269e400000007d50c7ca7701e2d64080a9fde6c3f67ef477d844e70e8a5cca1923423bd2eb9ef1ae471e84965b7717547712fd3276b924281bbea199e04daaf9ef9192b8808b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409732502"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2716	2656	iexplore.exe	28
PID 2656 wrote to memory of 2716	2656	iexplore.exe	28
PID 2656 wrote to memory of 2716	2656	iexplore.exe	28
PID 2656 wrote to memory of 2716	2656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1aea7365d09d79d816fa8ae8bd5e72dd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91313ae9682fcbef09f0afc2dc0e34ad

SHA1
133a3dadcf96ed518066b1736ac19a790b9d8cd7

SHA256
071321cbbcad42e00a2c89b156e6fa6fabded7ce199ff25b8936e47f326a2823

SHA512
519d7aab772a4d9d898b048922e51b8fc3b631269eaed9e0ad2059a80e6adf0992d1a0395d29fe6a7cdedc50ed0ec6d1b6bb3a0fbab27aed9faf8cb3f937266a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42c15506896d759af162df8832ebe66c

SHA1
52590bd44b5f933cd9a5aa29ea9d7efd897223fe

SHA256
1b36bd7f64637e82a5ebc2f5250e803f24cea1926a23c2c7aeefafaf85d033ec

SHA512
09a54990f7fc457b1c5183a4fa9045bac0d597e548364f4271366f4d2aceee1aadfef6a85d5797c9ef6e61e8afcf2d9cb4727f3b158193654bfe5fcd7980fae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88917cba09081199f58446aa82a7ee63

SHA1
6def7523c26925cc23cf91af93cb8dea53aa5a7e

SHA256
077a1921ffeccc76c26b567e737269f1b4ea1e2b55c525a5db5ed442ceeace97

SHA512
80b00fc1047d9df69c127b3af453d58e399cb1149c4db0415fe3d18735e1c9a14039ad238998130332b5e1cad116d428c1e4610c770d2641c937d0d051824eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb7fbed63ef981d225c51db841b1c14f

SHA1
9b9f5c2949a43da58d585c986343b62553e1d4e3

SHA256
a9fbef6f27f279640356f401f2df31f4d81f5418eeea2bfb80bb8f1d896f52c4

SHA512
73db430557ef16d03f39f7ffada993ac2ef2127ab56a957a1309f085a1b6caa169ce1a28d5a65c7142513a743f45be3277864640ac886ee001c799cff49bbe35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d8660413ac7ed914192968f7351699e

SHA1
e94064d8fcb95740ba40b00bfb8b5fe0e8203e60

SHA256
84c7374e835f8d97987c423a0f2d6a2898fd4e011fbada221cf76fc3fff79a75

SHA512
21ef7296e38d4fb439b10573d89573c0764db247f231f4c47b70a3681f4a5c0a779d009ea74cf3a7670248d1f58bbec6a41e263738aa23f0334f5026f9ef061d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a6f84d689e0a2bc66958498491c8b9c

SHA1
26c7e3ba4eef9b5ce1aea8864899a96c3cbb9031

SHA256
b4edb1555d82b0e1671661ec4336a52073cad1bed22fe889293efd2ce7d0c242

SHA512
6f5b4aeae167cf16ab87b13ffeda9e3604582f8ed3122f0de8294b098bdde415f6db04ab5bf69cf47051ca9a216ebdc8969d623ec50873cf5c58ff527f144a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f1d727ea1298fcd68401c72800efb61

SHA1
78ee52abba9aa3a2b52c52afcff37285772a88eb

SHA256
b7338e1a3504c529b1933978bb4884eb0b8a84e7fa63e1b5050275052ee25371

SHA512
2cde5ed339fc6a0ddd83803e4efab9d136fe5b885e773c441314ff1c65b4bf61d53744860dc84e3c7c1d990f579854345133d882b2b2f423f00b0ba4011c606c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dcb436d8c57f303bdf4c4c3e76d1699

SHA1
f1125e0a530706b17731e21fa906a38eaeacab9e

SHA256
43281d855e9d76b1061118f7940f560139d543a8937e05c823baa3d03e5f6478

SHA512
c10660a80286d302ccade56a683b4bd462ce612a2f4b8e9db342e7dd8d94cbc2e2906470019f5fd6608db9b5f3cbb0eb7f5cebc0fabac876c29ee14213235fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07ac30b1e4e99651104f6204bbcd1689

SHA1
4b802e26c5ecab9c451e760153e1ffd51d06da45

SHA256
64912a77029f5d952f2d79e1e89cb98ca08d5b4e808a560f4ad4fa783751ffea

SHA512
69929e5568ad259c5e0be138b0c5fae3b9cf4713464e8d60210f96136dbfdb0c6e75064a33dabf5885ef198488f1ba9d5fa2eb1b2fa59c0287db58b3f126c61e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8d0b46099a4b006b2bc51311bb399fc

SHA1
4ba0bd8b0f0bdcae2cdfe34e1bfc9ed1a4738688

SHA256
6ef17a81a661dfb55d52ad034cf82ae59ffb79e54176a58aa151d8dc8630ae65

SHA512
d619a0a14c38adf1f4ad1d0c5be512604f82ac87f79a58505a4a3455026f1b6556f112bcc60ba20874e6a20cf80ca246ddd590c2350efa2e7e8a7e86598c0093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
359e2e1aa911de8931336c069b735168

SHA1
8c630fc68de60fb0852e3fd90de41d110fe6f349

SHA256
94b547da7a7efcab3eb32c5ba8db721a04df1e3c89dd07e1a0239ff0addf32f2

SHA512
4d181f4231934df2ff0d560a9f754b07351bee245adb472b9e7413fc43a991ed2fbdaea174974573295d18af4c2145daca20a2f19c560be516315f2166fb5082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39f0f12e58a224717af9c92aaabd64d5

SHA1
47738119ec0ec4fe1b39b2ced8ffad89ae4d583e

SHA256
d6903f6e089144a6e4b87d6ba11e922bbd136dd4405aa7aa8f94157bd92563e3

SHA512
0e55f30dc8c3822a770190fe88922bbb9b923116aae4f0c410be927468e5e4e0d3e84aa80aa697957e8579367ea6ce1363a7dc9add60521570c438caadf44bd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD2AC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD3C9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit