ad79665a9855f27c23051fc382b4b5c2bf36fb49b40004abd93297a84718c39d

Analysis

max time kernel
174s
max time network
189s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03e2a1449cb9b48403b947eff42fef29.html
Size

254B
MD5

03e2a1449cb9b48403b947eff42fef29
SHA1

33427e495ca56d634ef6328256d71ab744a3a224
SHA256

ad79665a9855f27c23051fc382b4b5c2bf36fb49b40004abd93297a84718c39d
SHA512

7c96f2db8e245e8810d5bd7e172db461a4e7417a920cd8ae4f0cac9d063b9d58171421ba1c246d96c6ff585a2c28b8e0f9f646dc8b948c9450923c9c407ce27a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57EA7441-A2A3-11EE-B383-EED0D7A1BF98} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000001e81dc3b04617d528bb9b81790dda9c2c8bcae270b84e101e0601647d7697a99000000000e8000000002000020000000edb3313e5f85c7988d1eee5935c799548ea1e771d18212a1edc35d09f9c6696c20000000d8d53049d0d262ecb37071a56809795b3c4139a9d7a64108c2b41b63d47142b34000000005c8213a8c832f3312e27833d7df95d7f872d6d4804c5c4ffc5ccfb053011d55643db9c22c9eefb26d8a507e0380ee7b82880780fe0ef15101b058b5836bc3a3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409615226"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9045622db036da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000043866c37ef6b55de11412cd3c2ff221834c7a60ba661c39d113d7ba529971ba000000000e80000000020000200000009133d4475d9b0fd2950a91bae5b240bf0bd3b82a1d35c835ada8de393d36ccb89000000028643d4e3478494f3ffa9163b8b21f4ec46f43684d4e5c549b0e848d7db53750cba87cf2c7e95213c4279b718a462ddae246009e5c3cbc21685dd9b24715ec88d663a3dc438b48e6f6f67174c14860594a826c3c24d675380437e4076024f56374dc618abd2cbfb05a4f792b4d16d790d4d7bf706fe5bac75fa532e562735384ce73127b983a5a788d684db624627aa14000000005c0cc926d06d3aa0891e71e4877c7b5ee869fc78554c1a15a84992e60c5627184d0e5e681b04878613215a396777d59e723280bbf8ed05853f6be55b638182e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2716	2980	iexplore.exe	30
PID 2980 wrote to memory of 2716	2980	iexplore.exe	30
PID 2980 wrote to memory of 2716	2980	iexplore.exe	30
PID 2980 wrote to memory of 2716	2980	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03e2a1449cb9b48403b947eff42fef29.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
186e5daf1acfaab11312d5b11f946b4b

SHA1
6a67bb6916eb259681e1f292b3e93be36a3df4d9

SHA256
4d04f0f279d52f56053c607abc4d88d309fbfc2080dea956e76dd32da67444f8

SHA512
6ffbb08af3de20d9d3bdd0ea07840790f1fce52c9bc7c4fe84864ca05449ecc156582eb43e21ca5de833a030634137a338672bf48a56b8001be4add6818293de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f12a39d4aa0a185f265b8d54f56cfc

SHA1
0957c3de13767a77b8cf62fc6fd1d270539dc1a1

SHA256
a898c467d013ca241ff45f32f1752edfcb07a0ad156e9af2795a7c1068570037

SHA512
9454a45c6a06fec08048aad8b4ebee6d680ef92742708c7f345d55939ec27be0e69606d789385a99482469d03b4a85c85eb80822bcce265bcfd9b70db5f0bb3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6a198cdd895cb24bf2ea0529ac7c044

SHA1
88d1c05032897286d19be2494ff4f409d6afb7a4

SHA256
2f8bbff8b9dd764d17fdff075a2f849faac12808deff2bae6ad14808fe877be7

SHA512
37f1be7745de5968289720ab004277dd06ab320dc5081ff89b188196ac7472080292dcaff6b979d3b1d4a9018d7ca63beb2573a375c1ccd732cc5311310ca720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2fe350fb774a2adf5b4fc6809948818

SHA1
9d56a9d076a2e6c37d96f652bcbf3d717dc74c3d

SHA256
952b5f9722647f91e3e47cdf18375eb5056aae90aace64d80171aced07ae81b7

SHA512
70340106ffa34a210e5c8b4cda9137b0477b04799fceebba0f69624ca9624c6baa5d33f75da8d31c7e5796a4a67f6c4cb388880e0b8898767fbd5bd87379ac6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc2ad01147c74d9a783cd7e00f294daf

SHA1
4c749f671ac2ad7fee75db82a7cde654d1092258

SHA256
3786719e55378fbcfe05f4d93783e8bb96b2b4b924f39b93496a1d418038d46c

SHA512
62c57d1a5da3e8456719ac98384aa5c5806219f1253154efa642356322ab4c3e619235d99f5f4c70681b98cf1f50f5746e37f3129ba269a033cd665b7d204690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ce95555e71d0c99b4c21ccfa472c5b0

SHA1
c40c947bada8b79bbe5ee4f9f780f3dec0d92798

SHA256
0a17a9b91581d18e65305e8352bef2c9bdf16938fd610087189463b70f2c4024

SHA512
d81a59060bb0257812bf9551fc3dc5c21a4e76c9339970e10f4c2bf7dd08c0c7f9fe648ca7b8e0a5e0266dfe45ebdb00005e223625a310c55d7228543083331e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbd26ed81c0fb3d780147536483f3f67

SHA1
86df97a9838eeb94cde6ea081a4bdf851c70ab1a

SHA256
8fba3523f5bc455342b366b5c5631d3f3fb81f4b0334b97d7f5f1884ddf3a34c

SHA512
96c56943fb3ceab3d2fbda60511bb2738216665ebfe8e1fe2e7ef764041ab5f7d41e4173bead02d7f12c555e43432b012c57c0dbed167126e810f861f92fefd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80c0b0360d55dcb8944d6982630a81e8

SHA1
d227b9682f2f3a799b335bc44266e2c70218713d

SHA256
f8ce63b2c46eb5c9e68c3c92f180e1c7823ae65e87e958e097ebf342820ac850

SHA512
306e1267c4091ffabd8ea97c85a3655c24cfea5399c20319b17b1611628fe1144c7300858203e9ac9375d928e0f11acde67944a1b66ae3f9db2673f7b5548957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98f3623aa9468c3c1898f218e869cae1

SHA1
b5d58d9d91fdf8afdafe81cede72ee57642f7f48

SHA256
bace896bd9afaf62708e89619e0360510473aa01a265a74e42b38a4c93e0e729

SHA512
cb4c8048bd95ff5675a315f8daa9465412ba0046b414eefeb04c4a7be67f46d43764acdfd276e57a74fa4f126934f50866ac1ff5ecda04f6be4a9e38cf50be6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee59be2acb537d037a3cf7b40af7d16f

SHA1
a7076b6f83067e5e31063c98dccd00cb3d63abe2

SHA256
8735e632929df18fb3b99ab63f4f1be31e3ca7bd8559c06e86582fe65219f2e3

SHA512
bf901e69e60a5892767152e3a10ac37f58896b4362ffad1cd814cb6fddddbb55ef249cf1ee7120bdf9ffd886c7d795b1c7a29e2a163cc35c0bd0227478a53945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfaac1197a47b4ba4bebc4e1b6aae5dd

SHA1
d825e37e3b820c551df72efdafe1895c12a860d2

SHA256
ad9b1b519d04f6cb22c6d7e1f3eef292e19a20ce0f4b19563ededc2958904827

SHA512
a5794458eca9b4fc19a01212314ff9e247aa997b0ec69a45db771686cafdeb84478dfadd0233838ae968113053ff7b04f3ff6b1a482edb276d44d4a314328625

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4DA6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4DD8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit