42c0170dd7bc00387ce949cbbf369df2924c93881508ed0191b6e897d6cac1e4

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b0b9e8c016e7b798cf9f9d2fe362a58.html
Size

9KB
MD5

1b0b9e8c016e7b798cf9f9d2fe362a58
SHA1

137b26f03bb35425802b492d02b12372eae1cbc4
SHA256

42c0170dd7bc00387ce949cbbf369df2924c93881508ed0191b6e897d6cac1e4
SHA512

9d9b03c0bcf2b2d0d91690585d4567a3c8832c3ac72a2bf8e4d5f04072c50d8f59b296a9fa338b1c4a83c5b76af1b2ec635d5416815a590b2f0c5d4596fdaa30
SSDEEP

96:5hcHEySUtxa+goHKBw/q5HZZA0MFkpszZWBl3rBm746+FsNa81XDZz:PcHNPa+MwW5y0fCVWH3rBmIaaYJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002e92307052f383f21bf900c82cc0f693a31202b4267fe0f7bfb1b27d5d5f63d1000000000e8000000002000020000000a64015b03541a49f6306d2df8f7325fd8f0d0a8de1b98e87439fb4bfead2b1b8200000006ff109e19ec3b93676d602af0447cd6543ab834011791601a9df2379096283d340000000e17ae3311762f543054cc5234cdec613f8b058035b5aa72c0f6e12d6fca1055d61c534c033b9c96332649110c3142ca32b7e227b02e5fc60d744e321c1a05d1d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d6876ec237da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97F5CAE1-A3B5-11EE-B683-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000505ec66d7dac3297874003819570d32f73c9ee993333693dc4c41d33089ef5f8000000000e8000000002000020000000ce7543a01e7268b064129fbcfb6b01aad596ff8df0951554d0f31a246739ee5b9000000008d6149ba45726379cbdc9780430b269b2f4ad016ceb8c41cbd11df07559f0d4937b7b84cb312af45c1f8b37166179eee4ba12aa6ca89e96b51442a05cb15e29db5d01e75a807e6141cfa336e170587477cb54e52243ea29ea90c26ab6196ff3dc43be8545b371ba0e3fb425a80004ab841d69f3c60223066f3b53e98d06a57833b3c51c51e371c70519662f077d78ad40000000e23e59ab7f4de937ff15f68f280e0b21abefac16ff1e75b32f3c4130243878f0ae07cf7837f44912a1f9a824dbdd1d76be4ba962a9741a289f4d2711b7c3a1f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409732956"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2464	3024	iexplore.exe	28
PID 3024 wrote to memory of 2464	3024	iexplore.exe	28
PID 3024 wrote to memory of 2464	3024	iexplore.exe	28
PID 3024 wrote to memory of 2464	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b0b9e8c016e7b798cf9f9d2fe362a58.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1c142cf7a61a01293bae5e0b080296a

SHA1
fa0c3215dcc79b9ba873760fcd1520e01fbfb942

SHA256
225af39b0e8ca79d7177022169b2e29f28132bcca39f48064a8e4f2d6d649c1c

SHA512
73abea8b21980242db27089d58dcc98635b8370d3b5d482fd925c65da8c0b2d64fbe794f1784d0199807cbbc73c009b717e9315374d067dec44c4232e52434c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1de376aa05b572dba5af6d572f327ec6

SHA1
6710b65100d76e31ff3b4de267f8fa825bbc6a30

SHA256
9d677d75e47742250d71ef9b2d6fe0e36141ccd1a3cea3a26366e66f72ec91d8

SHA512
f9440b392ea61c3910e36e6453815c36983802d5f54515f0a6077bcf9fe6b9553438fd4a131becd90bf3ef45fd0328cdd7de94e514adc83d2489a139b4bbcbd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fbda7eaa870d4f5e7fd88b72cc426a7

SHA1
b03661523c384b3a1b880a3d8c9138eaa80aed68

SHA256
e8521b87eeec2f1a03bf8e782ccdc086783ef16d17e78cc230e034a1568c11fc

SHA512
6ee3dc74b8a9f7dfc1504e3f8e0c67b64fca119285eef672bdc8f0630f1adad2b1efa35c7ce78be2ff60c5d8b86167e3c530b3ede61d6c8e81bc176f8017a17e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
933dd47df2c157b216387330f2501de7

SHA1
4dfc2df88024635ec210319821fe01c4326c9ff8

SHA256
bec14c875360fbc39ddeb9390f46c043c15bd552fc8d99b9291f92472894e381

SHA512
8f620c4d21f425136955a48ef50207120fb1e3782cc66a4cf8d6747b8bb28fa64a5670fb038d5747262fbef75876c9e83434aa61afd48891d78acdcb221eaafe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04e208bf765967fb9e95979f8dca2a3b

SHA1
4ebb8ad2ce0c3a969564c4778b96c8d6dfcf3917

SHA256
0af3f27bb9ad75af63389a1956bd4323755d629beb3a1517698bfd601f323b75

SHA512
7814307fb2060ca241b1b399b3ffdec173f7a88278287e32219393bcf64826fe57f5edc19386805505ef58995afa1130f990ee7c3243b75d4e72a1776e75f28f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73867f6273972482dcf04debc165b81a

SHA1
0cb7489b44b03adaf13fdba6326a0e471c8adbca

SHA256
21f6390416457c4712d9ba59893b4e910f49023d3e9e00d1800a526488aac23e

SHA512
254c2c9f4ff201bc16b593c4d768a00ba17fbba50ecc8c391357e1b31e395d056f1a2bf21c5ed0d58f65c94b19fe97030c928452034e6306dcb79ee3948d3782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f7cd830fa7b5d1ba0cb24ab693ced5

SHA1
77c423c2a8c82af7eb55c7626e921d8c7778ac8f

SHA256
748b045e02f370c718b86803a4341542b21c7431bc1cc5a76deb9e5ceaedd4de

SHA512
718a9f72931b2ae2c7a615363087821a2d1fc9ffc911c41a7bd89a427e964aed328f900593a97ce6329eaa0f581655d30ba3fa1246916e128074b78a3c981151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
830546cfbb67c96aeed894eefae88d8c

SHA1
4f6804972bebb0dd031118bb0660143447f5b9ba

SHA256
b9a7d01ebf2f4cd4743296a8f01db09e41c39c886462f9db20660e9df9a22a73

SHA512
1d75b13d94175a9957abbaf4d87033486c5463b2213c90dd0427653bb68b42cc3ad4d784dac54b7f03a0a1c5031df45d365eec49c2adba62d8afe2555b5b4d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12c1e9c916ccc7753ce3f4085cf65b20

SHA1
380b7f4ff34856d8cdc0c86dca2237adaadba3b8

SHA256
36105319e408d7910ff1c8f7acc143078af1a96c44c3f1fe407e94f2fe1f1dc2

SHA512
53a447a7ff2a157314908e6855bc3e28f103a10a4b0e8c85a0dba95ec4448a80032a92e116e421d24aac05d842f3f617aff0ec28b8ca9b80f150dfd84b95f457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22512bedb8a43ccfc067731a98afadeb

SHA1
13613b93de3a39bfbf162c3eb3f2a262450c2990

SHA256
067266ad78d42e83c1bb0e8b40182b0d67e7886a6d3c263b37ddc59074f592e3

SHA512
b232dc7563f596222b382fa08856b5048a250865f377d6a54a150776de1e0924ac6d10d8fe419acf280ae40d167455f3c1a29c2278899059d50072c73a2baeda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bee03766be52b446f0ee6de91b883f7

SHA1
3890a0eb8e274accd59ad6ff2005b03eebdb0571

SHA256
6013aa1cdab8f29577dc95655aa2170539840ec93fb153ae889a83bc215fa1ef

SHA512
1c73282429a61890e09bdac0a66854c9c657be1f2a8fa4240c2c4fe95df2ad58f93c07afead2499d8744874a55f3b66ab2a9676cd45f9d8670fda1f6947419f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7e0733b070c92a7534faaabcf205ba

SHA1
ea61bfca9f9b85fadf9e52809f0e4a6ee92223e3

SHA256
8c6f5dc5043eba0a68c165f036afa58e8101bd7a34961cb34c18b4162405fcce

SHA512
ca0bec79e71cb0097e12286a911e2f75c5c89f075ee34cd398118f574ddc5ddcfae25027108841ae829cdcbe090f3a51aa0b8803654b17f510208bf334e63778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e3d5e898596e905217e215cfdf7b4c2

SHA1
9645afd6c054fa41ac1d9571f8e25fb81515d499

SHA256
bfca4612b7bc6739561c80f92915fb4f7b8a0763db73dc12247a505bf6960db0

SHA512
62b6ae9eb726fc6504202ba155b521b92f78e000befedbbd005ee41168744f7acb7a1cce0847eed1558773a731ec8ca4bd1042aa91c4442ecca20a99ed8a77f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fb5361bcef8b0c4ba60a8f85f38c7f6

SHA1
9dde63e81a059e1a8a7e8fc306b02d7771fa5eb4

SHA256
5dfb4fabc72a0ebd1057de8903ab5c245ddffdc858b95edb5227c9aacca8b0ce

SHA512
000316065544d16d199eae96bac5962b392e2146bd3304af55180ca1af01ff88386d71993ec8f8dcae447d3ed15e603a1f83de3f0d03792e29bf5b1698f53252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38549add02586b8fe431b87d8f085be0

SHA1
f00161dc46be5776ed64068c23109df8171c2213

SHA256
e5b416c6e8ec41f1e667cf1e7331d57c090d888714453002c18eee0010659fc9

SHA512
85dbb51154c5a72b78ef20d6759f2849ba14280370ba05a75afb2099d96cac8a5038db28387e0b2385174becc4ac267194d1e09db86ac68be8faf3e86b5386e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7957.tmp

Filesize
64KB

MD5
d71dff97ca86ca16c3db8bdb5285fb35

SHA1
271c01246897497d069b81ed37af296cf6c1e498

SHA256
4a19255504acfbd49c4e1aed722c7e62b50b5742b860eedabc5f46160f8aefac

SHA512
1fed2a183296b563e35d803927e539d28169895f6ca5b522a1c714f222a2d3e578b1e167b19568b5ad4800b898f7ac041c7bd8f6bb02d1361b32cbdcfb0f682a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A16.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit