f01608737dd2222b790f2e4d027d16cfdb7b183bf9830dc8eb52e66a9e5a3a3b

Analysis

max time kernel
119s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

007f87ba73959d82419cad27e2bc8f12.html
Size

12KB
MD5

007f87ba73959d82419cad27e2bc8f12
SHA1

a7e3023039fbac6b8ae3b14473ab9a2939ebbf08
SHA256

f01608737dd2222b790f2e4d027d16cfdb7b183bf9830dc8eb52e66a9e5a3a3b
SHA512

eba2011fe5b2785d873308cb189c3d1ede3175262c82fa33a2257b44572543925be3b7a1501739c6c5a162a645c63f037f8e97e61c8724656b92257909e94e95
SSDEEP

192:V0WKZ98uG31yXIAazYvoNb0VYLpGP04OnOV5fj5vpmshLCcBvYiIOS/u2:V+/G6azYvMQY74mEjlgs1CttNh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409593218"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39166D41-A270-11EE-A371-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 708e4a0e7d36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000382ff756c4cefaa411308c5cfc64d043fc4378a887b33814ef55971b9dda7047000000000e80000000020000200000004956636f0382d1ed23c5bff9ab9495c165909c9acb795975a39acf37031dc9b920000000f4edd9b4669b4d99df4f76153acea99ab2da9ef738360a5c94374f7f7ea08f4040000000e98c0d63d879bc9d1ca311388713b67a1ea0dc4ddf853a00cb41cd145e01b676051b2bf02d765813306319b8bca4bafd91410b523d132da121585c3b57a16d55	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000030d05ab3244eef15c409cdcfaf2bcaaf59d5ef2bfb802f28cf3370e3e35c253d000000000e8000000002000020000000dafb965b142c71efd6c83e63805190e0c0a348abd126548a5e3105a5544ddeb6900000001b58c81f258519cc09edc6b659eb16e1d9625a6657e7c7061b8ab285f6679e56e6ecab08fb18fbdcd0d7a37a5baf269a2b17ff98d69324de62ba38e9e27330d19df6e8f5e009b26947f46460eefab43a911a3d7deb0084219d444031ae415d846b5c0887fe9881bb96ecf57028ea5dfb4c89cd609704bba41a8df5a3e19fa944062e4807f2175bfc26f516c841d4390640000000cd4cf9efec4d26701c98051d59f6a5c499cba5bdd9daddf938831df225bf8536e61e47d794181944938a6e0695c1d7dc52d48940a98939a6115ceaabc1c5fa16	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2668	3048	iexplore.exe	28
PID 3048 wrote to memory of 2668	3048	iexplore.exe	28
PID 3048 wrote to memory of 2668	3048	iexplore.exe	28
PID 3048 wrote to memory of 2668	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\007f87ba73959d82419cad27e2bc8f12.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d822b62d2f7db2d1f648aed0e20d5298

SHA1
fcb80ee74fe1e4ecf505b49088c80682c53b82fa

SHA256
dddf821edbc9011880347517aa8bfd885f33e07d96e87be4616050852a78424c

SHA512
3ae58414c4629ac8ddefcc1bafa614bcf9df3da1218ca4db1541db48cacf2f1e24dce2964d1e52fca63c5d4b68b366c3428d6a30729909aae9e3dab2d09f3603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f49b221d08175a3b0eb80fd8f8edd1b

SHA1
aa5b643501ca11beb799118e416698cf82b3383f

SHA256
2b414778680a222fecaf2c183c4f7b78d8260b71d20d14c844a70c71bf01e7e5

SHA512
05ba4f31c05edc0db56049216ea23625a23071eaeb0e5744c6228fadb1ab910b451ee07086f70458aa1dff947b08aaee54aadc441bd51dd76a57869deea49dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00da46384edeb8999367d9512e11f81c

SHA1
f412b29d3e299e644bf09d4894f20fc5e70df694

SHA256
da65674e2d82814e35e1348f42e1dee8e994581f40dab2b6dd303ccb97cac8f0

SHA512
f54be214d79a6f337e898885da3b0642e132de11333d5776228d2adf667e951e9e5a55338e9e0a249902d6aea56ca979cdeed411a8c510a5863678a71542f71e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c6be725d8834ccad1dd078aa352875

SHA1
8f6f45af7b6e9a2b84dab84fb2dab1e68fb219b3

SHA256
44ff449241ce02d70f831c81ba0cb8ace3e1a099607dd3ab97e58df38efc1662

SHA512
c1fa34e6be9e230c84c723c210b69262794f966798d46c51481cce7eb6452eaee3e3a53b77709055a50095f26b274f3bd247bffde81ae5e4076922d939a20b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42c345d9ef2c76b027db174d31502d63

SHA1
957f9ca32b984e83dd45e0e2b5a976430dbd586f

SHA256
83a555884c207f88ecb1a4dc4c04d88fc781910bbfd545cb51b08bd479f0de17

SHA512
634f38f3230fa37286f5866eccf7dc8ac8dec5e76879fed41a6db97ee17cb2971e1ecf2c86ed750742b6d8d3d389ab2789227df803ac1d1e9a2c6730cbf22784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de0113de6d773a8c17c9641333ef252

SHA1
203af2a4f998b0d07315f0a8a62a1a9014220632

SHA256
0f1289dd989abb84be2e803e78a429af34099ea5195ad3764421980073cbbd9d

SHA512
d54998e0e8fc441899e2c7d9ca0ed4c664a242c8f5eac1c9cc9a3fa41873ba13f4af49417294d7e68caf9c912c6e319540c2cc246ad9735ff520e257dcc41a44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48a9d8c2cdd29b54dbc66bb5c2625537

SHA1
47779d25bdf09d0a2227b4ff82a3c7b4e763c2d6

SHA256
61f9f303fa2aeeab08076ed25dc2d505fb8c998006d2d54e69e008b4b01f6191

SHA512
26c49370c94ca9448593e48cc0b3e7736db220569401288035aa8a6e6feb186f2a01442afbe3295455f38d4d9b9f4c33771d3b068e88ac42ec55da9ac0fc8776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1b29d5f78fc380bb9908dfdbd560f44

SHA1
51ce001dccdea8e76df468304a8a680fae436559

SHA256
402566786a2a019f0ac0d1fd7e341549ff0d36ef0171d8df681a8d46646b7441

SHA512
dd7d69e777a5b5720755b882ba1c402fee72448679c72814b07e967e22acd36c30e7f1ec3b32ca5f1edb53766d19d109c43ae181ee3b03c84796b5417e2785d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9b10c093e69ca164e8de14d8f884597

SHA1
f8b3e4dc930c514b3d1709e2cf6c19f76ff2c610

SHA256
82f9ade52e4ec5877ad27414d41bc5ca1013647b12a111cfbef1619747de78c8

SHA512
0e5c419d862225fb912c7408e25054c05cd9141f8f35ee2b28367ee714afa81303add62a90766bf25496bde257815b0a8a1f4e2c0f712183c0757ef9ded7f303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a16130aeed8965a48a373b124173ee9b

SHA1
97de44169962fe20d86b71f2ddad89c7470f1f0b

SHA256
f34283ec8b9e6ad20182621ff4d16d00d8b36cd7b9cef408c81ba8c61bd1a1d1

SHA512
4fa1da7d2679e78942672531d8247ac890214c21afa601782219d3fd4fbedac41a818a42f3c17194c2ff09e3b35432b4f207473a3d91fd6355a18a73feeba560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad578e9b2e33262eef91d3d56267e2f2

SHA1
c58a8c3722871888d74e241ceeaf0a2622e3d6d0

SHA256
64701358ce519c845ae2eef05ee34d8030f1c21a051a5d304bc71e27bf7e4d04

SHA512
dc584591ce77b3cdae1675661f1d8873b6f5c50a19f4375dcaef69e65763a577ba72c0e5ba86da859b668558d8dcbf23ea282abd88a954a5499da96996175519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a51c355471c8d25d49ad4c70115e7c15

SHA1
f3cd2a84e30654fccbf3741882ecc8a230bf1dec

SHA256
bf92740f46f142abc0aad8b6b722233522d21400ff6334e4e82b10130c3c8d1b

SHA512
d107f43bbd75263721f09c7aed0fae4fe33a82dedd1a1dd48608d7a35ad980f174f7ae404b82377856d9be44e575a3eb48f59b1f92fe8e80724525fe05e9123d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbb6007c70aecf6ec4b3cf02dbc71da8

SHA1
905a6977205a58979c290728cd258f5374a396cd

SHA256
6bf407d4b50e77d6ba638c2ad624c747bf28fa5525b53aaf38b1699d4fcb6ee8

SHA512
1004cf9a5fc11465b609fa55d4d890703af764bf2a3ed302667eb6e02d6c43546e73cf70e74bb89b2bedd2a28d56cda5cdad2da55e24410a1b9061bdb8271cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
339874a17acb548a5089efb06859b5b8

SHA1
625bdd0cf95de9b33a7599b7e53f89aa95fcf95e

SHA256
1de5b3f72e0d09162e7e9e9d7e96946aa37628f99dfd6ac138b4123358abd580

SHA512
a5f72a979c760a8426965ccb628142331118c023aa72c6e6a1383655997f65d66524e81b92aa79ebc6e333f992a306cda8a4456e9625922323f1edf98c4a060e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae51de4bb2b9eefae965887240b0cabc

SHA1
aedebc52580d1a3bdf42e0a1e61c8c0ef8623c5d

SHA256
1ae10c3675e27afeea198d7095a5b12ad43d4d706bdbe0ed1230952083b42d55

SHA512
38d2c0769b7147c3116bbd24035c7f8dcba6757644c034eccd688b34b68ab6c567a2a3a2c2b7161eb12fd4278bec166e698017d6957bd4a7ea31967573b44bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52010040184f96247255d5a85018df63

SHA1
730e3b65a0a487ec59eba80aae3b019f549c9b39

SHA256
ad609c1a2e779e217ca60c2c1b50cca67674e2c68f4aee9111d64af7f9c681b5

SHA512
adde60b3be107cce91cdcd75b6f5cd365485bd055b9fb284b7ee74756706a228613799268d25f25c3ee76bef62c9b49b38c68806677fbfe674f739c24dd498df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B78.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BA9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit