1ba3c67965d49e36acc5fb58276cabd39524dcf0ffd64cabe6b277e812ab33c7

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

007cf8e697b4a40a000ed18e57c453da.html
Size

163KB
MD5

007cf8e697b4a40a000ed18e57c453da
SHA1

7c15c4befbb1a3a6a5360df69f659a3069383522
SHA256

1ba3c67965d49e36acc5fb58276cabd39524dcf0ffd64cabe6b277e812ab33c7
SHA512

3db81f88108019f61210462d8416ff2bf05af9ecd409d71339ab9906c52a8dae024b2f07b1a00a6ac4f831e168163c4fa5b40bde6a25b78f4586c60a974d74dd
SSDEEP

3072:ukclhRtn2eDiIrJHqWsWWWIWVWHWtW0WsWWWkWWWWW9WWWZWyWWWiWWWfWyWWWSF:ukclYPId8bX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{126C0CE1-A270-11EE-B279-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a09f9fe8afc8d1cc0c3b4a7e12ab525a95a871f16e701ed116b6c1a4c2f71692000000000e80000000020000200000001d8c2c5a09ca63be6b3d637405bdb60bafe4729337522959b29f6ea37339565b900000001e1880a11a666e1e8f9b935faf3467dd19588f55b6fe88c80fa8051a24dd865df9b38263e8e66ecc8a8d7beabcff78e56f82ed6b1af0fcf912616643ff7393e2cf3d6ccbae32c220ba14ba5050d4076cff05b3c0903b11f847b7f8e1402398a3d67726e52020fbdcc0f894b92e1bf9867fdba4e86696620357d2dd1ae7a2d537fd90cbbbf3d927f622af7eb8801da0764000000067136d0bce0af0e6bb2e2f14cb3ddd6ff01a5d01d436224d6ede7338916642d367db4bddcac60812877aad64d482440b3b10a0f51e6731e7d45157e231e26b5a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409c19167d36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000005b5c1d8320cd4760d8a3d8bed1cfa14f2f0b81058107361c8dc0b7abf6c8296a000000000e8000000002000020000000d33dc5d66c864f7d2962dc28f2632ffa06a353a9dcfcc50ea1264df446e862b820000000923f0e3d1d0af2e8afd55659724776a4dde663e45e33467b48331ec6c364e7c840000000686a3309ca7ca5d56325d278844b40cc5f2932f4f956bb3fbc691e8e10f88080495ce380b9166d066322c4b5239a48c8b1e618b9b50965ba6f23e33c51b81030	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409593148"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2544	2172	iexplore.exe	28
PID 2172 wrote to memory of 2544	2172	iexplore.exe	28
PID 2172 wrote to memory of 2544	2172	iexplore.exe	28
PID 2172 wrote to memory of 2544	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\007cf8e697b4a40a000ed18e57c453da.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37bc3b64409f170e1bc308fcf649086c

SHA1
33feb17b54608cca1e3fd14644b12ac7064053ef

SHA256
493628c91fb1e1ba5c4b89f938790feefead47fc404ec860da23839fead5690a

SHA512
c53a471189e7a8d9e21fcd2036e03b3f182cfb4076d2d80d200f465b6a0b32533fe852467971fde0cd0c5c4f5e5ec315891e4250e873d35d1e40e2c76050663b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65deff4372e83b018f91dc5ecf6cfb2a

SHA1
a118df5facf6cc0182fc8fa57309d8d9ac87aa0c

SHA256
d6411c64b9fc2ec02005112d2f87c94c6e2a5b741e60b5e5e5dcf46eb0b26749

SHA512
b520649247302aaf895508c280b0b6a70e0211afcf5f8ae0b1c68d9a9b14be345194db4a3d1b1daf2714f40c6eecfbaf51520ccab645821576a0a02d98605605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7642a49f86ba42151ffc78bfa724657

SHA1
8877ee6a9b2497c995627c122b00a7fb03be867d

SHA256
000095eef1537742693208fb08ef767e19fe367e2122cdf0d01d2f16a18c6e8d

SHA512
9241f51e584e6b492f4a9d7f130bb25eea6024a8cef114882fd997c87ba2bfed8d6e8c82e4da89f8438e6be4bc6779d308da1cca1b8257db245abff353748c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3443268b7803d047ab4f23e52fb5e833

SHA1
82432c1a7a5119bd02a78dfcb0e211a343c6df68

SHA256
94ba1cf69a2144f4189e6b59310534b92b821a6837ee29718fb822b192409c46

SHA512
56a9010c38df789681a4b7ea7a094928aeea1d32a5ca5fe8087a08c132695d7bcbeeee6f16a3ff5139279bbd43bb9b816826876e25679242023e65ff695d0c30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a353221fb1bc853f298e30e6f229fec

SHA1
e2a4f58459bb15a5e0f163803c791439fb60fdfa

SHA256
e5c7ecddefbfc3ceffb25497d21e360623a06b802cfdb61f7ad7f5f1fc40d346

SHA512
4a29f0daba52c42a1021ece7c4ded2158a1bb4be0d61e882af48ae4461f36e0e060246a3fabc3ec77620a5143ee82ebd2b8b75d30aa41f0ea538a30859f60477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f51ea6fa4242873d1c3aafb3090148a

SHA1
869ccac3f5f96a9073557413a8e6f94df3b11298

SHA256
549b85261da039c49a87ad1502abde9c26811c8188ab17b8a021ca910e1f5061

SHA512
95b232e3f99a5d57449b0c1d5e38a989c94874704cc4e68a08d86cd50f057cebe2004d163feb91a45c905c883618e51115c4578500c9bb3d1f5408734f00c725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b095f8924b99b8a1c6b58044f7b6fcb1

SHA1
bbaef9fecf5df02c338cd05f2a7995272504edf3

SHA256
cd8662732fe8744e8d8f534102d5a63e57c4d45faadb5556a445602f4a86c6fa

SHA512
e7094aaa00f30b0041769de55f44700c80dd5c4c487ac6d47fd4cf256169f37befbda125c167883ad4805cb338d3b3adca8d5f386a93ad260a1a56f6314198f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd9d9b1171168d24838fa8c37336edf3

SHA1
4dfd42cf5f1bdb1436296f206556eff2c690609f

SHA256
6a876d7ea2fbfdc1f0a618c5ca4aad7fc463aa1b122f8fa061c49c2f551d698f

SHA512
52d2aad181f53e13abdfe5645adec46f67f1e2e0d8d04d40f6a13525232ea41001050de57a7d99cffec23e4a59db8a7325f13d11a355b93a0122adf6652ef17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5347769bd98fc0e9c0924737ad15a61f

SHA1
edd32b2ea5c0d82c97328cae33f13e0039f44183

SHA256
82c1d11ca70c81b8f60ab10006cb5a16cc9d2c5d5605dd2849c9cbeed7db38af

SHA512
176e872ed46f8c77af691efdf176f1017a7243c0a49e3c96a4c8b5cf6164b38ae2c732f9e8fbc43a1134d70c98bb85d5d1d031b81741a64af7feb1978f74917d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1bf5bf371aa91a5d2c47e32c5f3b9e4

SHA1
415c1be540d5361cb39cf4d5898e05d4ed37f26c

SHA256
6509f2f80344141110c55a8e697ddec6e6121152e22754f40017ebea156d0264

SHA512
ddd44369163174092b432d3fdedbb73e2f9cf9097f0503fa442fdc46bf86fca1c1642cfc10c4582c2f91ae04106bf0e54836c31dc730b54aea349f6e5d466876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f7421e23dad65e84bb6475536538de

SHA1
525bf6ed838ce2f605cacbec6c90b9cf2f058cbc

SHA256
f2853a39b9cd3b381bc85ef37483036e12e11b4b66f2b3fcc59ba44398267e12

SHA512
52003ee9755734389eb2e72149c87e81f50b3ac88b5644795dbb2cc40190e5e3a5de29f71341f202f252256bdf8daf7d271c14a9eaab4666f98acc86ebcf7888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca254bd22f07e3735d400a92ed204a30

SHA1
d09348b5a6d0e4888043585066a54eb51dc01625

SHA256
f8c7579e63504143f25cd7cd5390942806a4b85e5a8c93d7f4a3cdf2f9c5988d

SHA512
7a1a1b5f50421b79eaed76c58913f8fa0b1c0581d7a841cee132df2f6863fc59788cf412801813bbf08c05a7251ef1bb03bfba09b5c8dd6f4b4d13027268398a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4c21629a3970eba950fade020ef437c

SHA1
b96aa9ae6324a1dd4ed394704551b67e7f8310f7

SHA256
1eaf917920dd3fb21e771b9170443f9d9f65689c488e88f8b752c41d37059b72

SHA512
e646cf6c5f8417eed74012cbddecff688b6a1646339c9a7fbd88bbfd0adcdaeb6bfc197b69e3ea02cd814c561d1ed2fa8af668a6b4debbb158719fe5eb3fadd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aa24a991d6a75d5e75bbed16591648e

SHA1
8a71f845696c6cbc10673c0adefb00038adc3e75

SHA256
aaac598d8cb3eefc3760690b36d4bb79fdeecb940f6bd09e807d047be714c5ef

SHA512
a52edd234741c8f08d81ded86cf41565f4af29eb2e43dd657eee01f42ea1742061a47ae949a546e36654b24a3c1e7e79b933561a6eec78a73af23484718e84b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\cb=gapi[2].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C07.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C77.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit