78f0c446eabc371275f3c1a07032f412e265e4bc893c4ded57e48b2f5b6f81d0

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

031330889a90b505ef39a2bef592cd23.html
Size

10KB
MD5

031330889a90b505ef39a2bef592cd23
SHA1

4ed36bed15c709e48eaab25d1b6a123ba7eb1c2f
SHA256

78f0c446eabc371275f3c1a07032f412e265e4bc893c4ded57e48b2f5b6f81d0
SHA512

871344166fa82dd09688e1ce246dfa539321062b79a8f8d73e10366f3b1334b29bfa775f55ee35d9921c64fe5aa814d63ca722b52e33a0ba943ea1ba180f8d3d
SSDEEP

192:SIjlctK9phIwH/3xVyhxI4UFpMKLWgTBUx0jGLQPHK80dlKcKWT1fBC5eru/AmTF:SIwK9phIiSuMPGq08QPbaIn2fBMuu/1J

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000cca74ff834fe1fb81a3f6b1764531edb0270bccc216b19e6f9d91e5cc7863aab000000000e8000000002000020000000ed0f6ae95646c24c302c839d7f2b554593cac8b562c790c48cfecb03fd1efe33200000002ee48959aafea3fe003d7115ed823690947845b82215f102eec473a1d5bba11b40000000ff69cda785602b7a7d84e664f02e66c390c7ff4fb0230b78a76e3d4101a9cef06f5039a012961ac0614d18b522e0f001b1be84c9572af17e71764f82217169ca	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4077f398a436da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e82d60845f74ef7278c0fcdddd1b7609043309c5c30673d7666daa0b8a31c08b000000000e8000000002000020000000eac8de14201b77bb0e5b259e936770d70a686314e9a161c7d1d2dc5650b48652900000007ef20bf71ccb85257c3ff09654c386aaf81b8b35f5b03bf22e4aeed8404cf60aea08ce6fa2a6ec1c663f0b82fd27529e8cf470cdd638d975c4d255532f8d54a300df569d961f8f4cc09763a59807f7f922a5e2c7c69b8af57f06d8356f3c85608e74be937e2404a6fb03faafb4024f8a0ea3dc442dd07272554268ea4c1de4f52397401711085cec6193c73500de01c7400000000876b2df1a68bb00b01780d14c73b681eea0c9e00a5fbf3ad97f6be450c293f433d6ee8753a66384c40f15b999edea690630e2f0fbd869b0958c3877b7baafac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C11CBEC1-A297-11EE-8809-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409610194"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2364	2376	iexplore.exe	28
PID 2376 wrote to memory of 2364	2376	iexplore.exe	28
PID 2376 wrote to memory of 2364	2376	iexplore.exe	28
PID 2376 wrote to memory of 2364	2376	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\031330889a90b505ef39a2bef592cd23.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa76f56d9af880ba27fe714b5800cdd1

SHA1
6ba8d5c346957fba0608effc1b41a65e322968ab

SHA256
8eb35f00d621f3a20f54f67b72e423e21640d27b74754f53d8ada3e98821d598

SHA512
52d342a613b322da994fb64028b3fb48271ebc5413f371568179e2189827b3ab0e6d3d4bf314bb26a2dfc5b30ba1218b0aab7e8366afc21410e97316b01e2ece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
111a05262c33c37ac2a38fb6491e3e11

SHA1
863eec61ec669b7582e1519f68f16259d58f790f

SHA256
132ca4e282e645d866af4e9542226b4ab1dfc8c56b99ffbee7c89aa46c13e84b

SHA512
aca4c587d7bcc0a838edb5320421dec223b751a446dc07716b15390dcaae088590f621bd0aa7b1396157cfcaba21a684fe3e9873e26bcd24cfa0a95a0e60e922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cc08a660c52d01d7ebea2c2e45ddba7

SHA1
f4a7bf8006dc1952504624d44e3dae94324346d0

SHA256
dc2304e2721719c5d95b31d4b174f9cb72e05adebd6dd7a1c4f0a71dfecffb8c

SHA512
836e17747f9ed340a3e8b6743935a9c222aca7f435504eab7bf2ce5a1460d9f56569ee01a86402be2f9e11f35341f694c36c09fa6301d9657707358783e6b98c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5409b3a021b2eb4df717a31f251641ba

SHA1
272b3d1cc7adc32ecc7494bf3b63ab4f39aa4714

SHA256
594606537d483b8bec72a3da699f195de61d1af2538e3635f41f6fa5f128c111

SHA512
dd5b69491434c725352367d34bf3699975d26cd4d3ceb09d847c000d0ae219008c610b4185b85e6edc74d0bc618c71175f1fedb828d3732537f83840efeaa738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
957d34f84d86b08ad1950713e728fee1

SHA1
19097d00d5206a998246e8285c4259f2e64d9886

SHA256
83a9de964b63c3f9d4b6a5fbb37657e72dc920b6409e6c3eb301bdd7972445ac

SHA512
24b0c979dfcb6a3494479b472c2c5926f9f3291bbd27bdeb526558cb6b837e87c27ee313a97eb1000824785108717639a7a8b5e54914f5213200f65eab7371ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd74151041625be5a4b60620ffa9c6bf

SHA1
4451788df89d4d630f7a4f35ac5af8ed01bfdab6

SHA256
059e24d3ad23b3b52520f5d7972e698db94d564f5e075dad9d74a5692fb16e4b

SHA512
08fab210ce98b44f67bdc697cd4d5150f6cc91d9379037789942a45b35168d1347ed7b86bc3b2c117cd2695ab352b0d0e0623757385053d4e0f75422f20acb0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91496ff53d94920e4b1dca25eb4ae149

SHA1
39d1f7c8699dec4eea853fa21b038a758ae8795e

SHA256
e140f2df072af1328f2c2be5673d5b62ba6a562976bb06f664b540fc88705548

SHA512
94de272feb8983d2279ee952e4f42dd1e30ced2e126bab045ee785a860e93364401dca1f7b464138b527501d84c21c5a07c159564d0fddc20f6b1e4fd953a6d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ec1502245cb1b6f12dd330f45a78cf

SHA1
8fd89df6e0e855cb250612db839d6389ca6d7ed6

SHA256
6feeb68f4845ee1635e117142e458a8166c4d96fa36753acc6441199970ecb2f

SHA512
be89e4ab9070e79317d55fe73a7e8a2045d55fac63fb4eb28912df49ee286eace7e9e3305374d7006dc2ab3e51f1b071d6253efa8f0bc7ea8721a4d35ce77b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe16b89e7941fb2a84c24090c3170db

SHA1
2c40794b2b0ac103499e597cc39e30a240e5866f

SHA256
d6c2aa5fc84462b95224c357a18b8c428aae21c957a272f0336863bbc0dcea3a

SHA512
ebfe9b42ad5e98583d6be98a6cfcfc2d9c03bfc4709d88af8c2139315b0138712aa2b66bc4732d250597405c51e126f93f6e80d64617da729e4c8ce226ad2935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a3d3ecd24818b55715c80d61080bb6

SHA1
396360c727904743d72dbc88371e3289b7086995

SHA256
35c133ac9f2d24dc45499c218ddcf91339effae4801dbfb01fd5bf5ca4af5bcd

SHA512
f57271680b349115b31042fe62952531a2a982b516b2c366af5b88031de5b79301096ecaa488ebbaef73db53ab541ee7eeaf3662de2dacc9c7b9229551336989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
460c5116bc78be16bdf3506f9d612f85

SHA1
4330437b4c0bf07813f7688aaaeb89cd0760f478

SHA256
14247438cafdd349e80b9ebe93c866db2db594448cc39897edb2fb49adf8ae56

SHA512
3d13f9edc9595fab5ea74c5c608325c8d1bc4caa877c197d67fa6cd11e0da91cfb10203beff1337d84c105d737c1efefad820585abbe20eab6acb139cb087fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d481c35d83577c2d2c46cfe655c9561f

SHA1
be27f2fd742d29aa1266a985e31a155076bb4036

SHA256
4a00e1ffb976e08e682ab148c1d2b44550a92a74fb83900daa8f599030c8b55a

SHA512
d85a398a3426cc5d93a2f9434e4391662880aeded7c72f29addfddbf16b311bae845d15694b3063fe9cc438c0be59e4a186a5505afbdd773e35b9711f51ba801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c64183ab15c2546f2413188bd9105533

SHA1
5c62caa424571d5a8549782ec6d9013062566b7b

SHA256
ff786f960e8d27d3effee53742b83813f25a869592294bc632c21b474feac807

SHA512
37c16b891e6482c18142cc3e9e2287244f9e9f34663f55e302af5c278bc6a55ee7c05639926530d1444292b92f1090e9fca55b04e6cbee70b9fa743469a68f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5aa6579d440c30e20f6d90c1344e1b

SHA1
a91662c8b3720d90e7b987c0d31101e47c7be3b7

SHA256
7fb048922c81b7c33e77571eb9ff18bf0c2716d6b22119c180137f48ac5575a4

SHA512
6db1b5c405aeb995d8da16b3b6eb3a224547422ae24e066b6cf368e829d25bc52ecff77b73a52132eb1e63326814ca0d0f66dbb204686cf2803a0c81d6c572e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2fbde6e1b920bda43493a959d8710ef

SHA1
b791553f9320e8dd9587fc72e881b53cc0539992

SHA256
63639833819ab1beacac94064061e2bc449188bf17b28fd6d7e4cb6e3e95e022

SHA512
aa6ecdfaedc56b8dfe89f71bea5cd0149d14ad2075d7c11c338d907c36ed2d3cb0c0c0a7a6b2314d9d554c1776097690a22cd0088b673832a44a344780656a38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36939a9454325f1b9f746b19cb13325c

SHA1
4f844350b4de9eb5a1e9d621e3854c528512bd22

SHA256
181a066f064f2462d565d5fc0bde82ec75e91d01601fe57bb5d39e81e8b46e2b

SHA512
155a0abf9c5b9b93571e7f35e62f1af16da4c859f480a82672c517ea1029db24279e0ae750f01186355e041e0125700a53b9d1e507f791c3ba33cdfb185fd01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a08ae35020824b40728fa25b1906b6e3

SHA1
0681df0ab61ee0a0482e01d4667f1bdbc8c8d879

SHA256
11fa914bc7db227c5ae637871daee7c7fbae7ce3fe7093181330d6d6b2ebcfca

SHA512
807b2a9e3dec4262d1c539fe5f2c07e4d1928becedee9560da5b3ff9f0fd33afc8bd79f6b37aa1d43592d781fc24e3eb8ae8aa8f2df4a50d0f9b67f584ae6a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6895.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6954.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit