3951ffbf51c664a4e814135a36bd190ac0c499452d1d551cd6bbe4667ba4e588

Analysis

max time kernel
138s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

067d105f6a323a8918326c4b6299cfb3.html
Size

1KB
MD5

067d105f6a323a8918326c4b6299cfb3
SHA1

92169f859c59f0ef3cd705db6a164504b0e0ae01
SHA256

3951ffbf51c664a4e814135a36bd190ac0c499452d1d551cd6bbe4667ba4e588
SHA512

cb09f3dd91040000af4508268121d819c66effef4060ecfce11a729bca0a9070abf52384cbbbc0b734af801318d025bfc09e1622ba38ea78fb907ba8f7d1c180

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86D7CBF1-A2C0-11EE-8CD0-DECE4B73D784} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03f8f5fcd36da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f017fc4005475c6efe4896788ff8a438615123f22aa2d1ebd7970f26c71e1d22000000000e8000000002000020000000358f8954d81e3ff65cc76aa6a61aee494ea48acc7d2be80bc73341dd334b417920000000049fa63300c35bf3ab359aaf473820318ff22df1eb28346676fa6e33b23e5f6c40000000a103b302d8d03451a026d6b3ea86fb6a358fcd427366f096e9aa25c73257b8ed2fbda55f6f3b691b80c8d8241dff0a4464ce6c89657032afc59e1f5b55567ff3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000998e0814f1894290d58dbf7366f193702e5934445232ef5f32a94e6421e27d06000000000e8000000002000020000000c7ac9c52318b2813c5b70696ec690995af8748a2460991a5d13c7659862f14b890000000337552116693fe9a7903f35694e3bd7df07620702c796f78a726a177c4cfcb3a1d1985ba70e9891cee7ced05f575e6f1208465fa04e66053377b3a815e9417e49c85d7a1287cb714238db7619a3fac1c50d3455051904f29c4d4950b6a1d054c06f14c88bf74a71a8283be741614cecdb299cf1717b9870a437a98f025df57a326a86d5bf2af268a7e97bfec0c48eaca400000003065a1edca1108fb2b842e2d099bcac0340dcf682e514cba8613254d2e053c2d49f9d35da4e466ecc85a086fbc4ce76bf6ea57491dd8034afb64267d65b2969c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409627699"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2668	2792	iexplore.exe	28
PID 2792 wrote to memory of 2668	2792	iexplore.exe	28
PID 2792 wrote to memory of 2668	2792	iexplore.exe	28
PID 2792 wrote to memory of 2668	2792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\067d105f6a323a8918326c4b6299cfb3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9770f35aa1dc733f57d0f24c59deed40

SHA1
433c1bafb5c52adc3c154cecc54535de6cb2ebca

SHA256
c36cce7a20a777dbdca66cc311fc870e2632d010a5fb10f2045bfe43a86b0325

SHA512
9bd77cbba87854ac7bcfc06d886d2ebc4474bb26a8f13353995647f337adfcbdbc3dd523e821e3e9113272c6259be733d511bb208ddcfcf26dcf5fb3e40874c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb82d8627842c9a0c0697e23b542d6ac

SHA1
4529f290183a3827bb5cc8cb21bc95c35ea0c87c

SHA256
875b0f1443e57337041f97a5491c713a1b4d80b2df7f823d92781fcf2d0e25ea

SHA512
d9ce53f6c9635f967ee77ada87996dd0f582f279bc918488cb03648c08bfd1bb00562b9b12e1954f9e276af90597048d9cde6ff703ae5b4f557a43f8b984664c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5673a205071d7bd85c78656d7fb017ba

SHA1
2db20acf4d200e75d5779dc9ef49087c0bac916c

SHA256
c31025a1c11dd914508a6526081fb5bc5de19b266264283ef3e770e88fca8ab9

SHA512
bff565f389fe20ef357e5e8398429b32a43cafd07c178f12bdf0d62228911ed8506cd10da350f8eefddef1de3159ba880f4195dbee3b3e2259b7c987169cd296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c0bd2c0d0fe94871641de56c33a1d7b

SHA1
857974bce7d6494abca979bc3e9f9e44307a6031

SHA256
28dcaded0a87497bbb1fef37a6cd3b2522bad74fcf89f4274336a9a360d6e964

SHA512
716a7eaa9a7c30c7287debd29fe0867929b79e58b35cc01b7e8a444c370dbc7ada54627f68e0507ec50834afff2fcb7793063d195aaf9fb815a88bd5a8d2170a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cabb6dc2d41bfe036629f19541dab0b8

SHA1
1769753e7eb8eb1105b0ea684a86c76009e332e4

SHA256
95c127f854b346c59f44d8d0c6c4bc4f8a4347b941d246016a8dbfee7239abee

SHA512
e0da34c53c42493cdb0de2f46ed4255bae96aff016c2c68d575ff5c220f2202016dd0090f887796d684086d2aa724d705fdb6ad28c6ff9ef557b0c4e89e3101b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ad6a83a3d1535eab3a176299a135b1e

SHA1
7dc6b4caab64accec6849a48aec489b017f049cd

SHA256
5f00339d757c051a53874fa23e65a2ee6d06cf37b60b4bedd908412329fa6d6b

SHA512
177e6d363c70101a45d9a2aa656086b00f7453df92dc02640ac4a013e107da31e18731d30b042c32f82f815a962f6ea6591caf692f87a88bb663b93ae1597750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2901877b6479125ff9694df170cd441

SHA1
da6d2c0dcfcf44252edb6dbfc88f3a8be1bbdce9

SHA256
d3fe6cca976ef4c2c4a8d068c55c509fbb29461519f59f12e88f569e158c7d87

SHA512
b7b1a2f064c2902a548d45f8bb18b6a30d653188c15c5491bba2c2275ccd7e6e4b0663feb040fa0a6b0247f352b692cf4ad9c6b2e212a0b93e7792e3f9e4e5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
846e7a89232d3cf6cdb0cb644cf0d334

SHA1
f1f6a80de8c7bca299793f2ba0ed3228491927b3

SHA256
70c4d845875451584f9912e2252eb3a1dbcc6aaa051ebe5832a018c8209268ad

SHA512
6ce8f03ef4fc6036a54d6e855befed5d5ec99a3bcc036942e451759dfc188fdaaa4701acc60405429f70c12a5b07728cd3fb3f8df5b0d87d1640cdf35e1af3b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
381232b7f0fdaf4312fa9f672ede29f7

SHA1
a8955bedc38c2dd95cda2b9a9a57a8d7d125448c

SHA256
cdd568ab55ca6fd7b29eb5cf250d14ee6ed9b441686d46136fc7057c66deec7c

SHA512
50cb2e6ceac10949a14b8007ddfc264b9bfc761b72de922b3f3e6cf744ed7720683922d4ddce70a5c81d11168b8dec13ecc0cb6cfb0e0b25ecca13ce0e6cc005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abd2be77470fbc4dfb07ccb586952852

SHA1
783309c76cf67e40948836eefdd89df48c090d91

SHA256
6ff0046cc517ac8e630f6505da655a0d75c16e98236ae2dee9cc70a4b4d70212

SHA512
28a0e84b35d74ef6276711beca6e294439ddeae8cf9b50b951b2f039e3aeaa6fc99d5f25445b5b514310f9a519118cae87fad31d4b828217a6d3fdb64c9d11b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa790f1e65758e193178202be1aeb8b

SHA1
3bf26bf05c0c70d13a5e71e39df6d0316f194430

SHA256
164339753119a0a04ed89a003982a632f43719d9547637bfc2c0ebc9188b9932

SHA512
724e0dc71cc4c62934b58ed181334b59c407112ecb4d6ed70ac250f755ca673543469f7f384e7b9fabe31faba8c6b4cab9789540cc1a5f6df926f0fb11f96b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a510894d3dac34eae302d2a83aa84cb

SHA1
f116eb095205108c498712b1c8fc5d1ca14a503e

SHA256
93784100ee7f49c216e2ef91a806bbc6814886e20a18b2555694915724d5ecfa

SHA512
79d6010a6a84dd1d1889042a00bff25b6c8411fb022ec2cabc6a15e6777fa511baea09f7651d2523da83e3842a6a05d064bd9083013b70d5f711b0597f00082a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB570.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit