1ded8f8e864d62d9c1973ca9af087bc1e3febe8ccc6b1c9f2fd4f19904a0052e

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11f7cad3ebe26b0f8ea441f767e61b80.html
Size

2KB
MD5

11f7cad3ebe26b0f8ea441f767e61b80
SHA1

edb919f1fda5158fd3d364381e16fb000ed718d4
SHA256

1ded8f8e864d62d9c1973ca9af087bc1e3febe8ccc6b1c9f2fd4f19904a0052e
SHA512

a95501bf5a077f29d3aa5ef5a37ea183aeace5ddf32cf3bcc2a3410af10cec1c6ede0e8fb73e304c2d58ed3f42e0cdcce3dcb919ac148856871de3c30762dc17

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000003aa518aee5b85184f0da57d2e85e3c0b4136bb54eb85857aff31447c045c7260000000000e8000000002000020000000f97168c022efeb4e87d0808226f96f52f1f2320feb1248287ac262245f3c4da890000000b474437adcf23f861b89e1d7de1594498c670c3db02ae8b07f8d77ec03c1300e8ec2869b3dbe916441c54705842dc0bddd3b15758c8c237e31b07463da091ecef5c30653a786a0e03a7222c1b4d5f6300f230a80f9b065940117092a70b11f3692519fcc025040df70ba0a5ceb8cb741e67b37c745be5ee065d75a6321a6b5b213d4b2a4d0fc97a086b4374eb1635457400000009fae2782b457e4202da1b718eace2e746a32671876035ea5850f42f769bd41dcdc0011f4aec249357b19c2a2549a1106abb9209c83579b576a5c4ed369a0ac71	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000d754957e63ec64420abe1a94205c42e513dc089c265aae7b4198edffc7fada64000000000e800000000200002000000089ac46ba76e2d4e23921d7341f92cf68cb881be0e0541b4353eea046cc0026b02000000057864bc51afd9d699a03ee8cc0cc45a8c0b5d57ef961bca7b63ac402119a433e40000000fd54c7b1f6b697c9e6da473de4494deb2bb34fd4c67a3614eaaaea4ced97656277bf1f63defb78f9eae85e3b704089ea52bb0aa5a92c6a1980b96bfb7fca0531	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209960a65437da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409685803"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D12DDF51-A347-11EE-A5B7-EE2F313809B4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1912	2336	iexplore.exe	28
PID 2336 wrote to memory of 1912	2336	iexplore.exe	28
PID 2336 wrote to memory of 1912	2336	iexplore.exe	28
PID 2336 wrote to memory of 1912	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11f7cad3ebe26b0f8ea441f767e61b80.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c4df586d2ca3a3309b9cab32853f9f46

SHA1
ed1a3290c1c3b3f13ee16d1e25c8876d7be777c1

SHA256
270af7642f3f86d618bb917460130ff3cc1c9b65e662c4b673447f5de5f38fdb

SHA512
7aca723eb8176e799622cb769a0501aa936f0ad85ccfcf29b10d95107ef8ee7f582f00210c82bd875af7192ccac5c637b181d553b7bc2522ed89d73c2328ea98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d28804c8a623790933516834f2912026

SHA1
071b31cfdd1fe4d5b5399d030074a9812d01844b

SHA256
f56c25da7a0564559d19585429d608c5a125c4550daeab5ebab65ac4223a4141

SHA512
3467fdd7f0cda496f52d848e55348f97e9705eecd92856eb3e902cf8793e556bbb13505537297b50e88175f60704ec5b97504aa8ad4a88dec44186de1f019b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
951342299b4b17a1317b5e35cedd9862

SHA1
706aa6890f08b7f1296ad13ae017ba5ef2359bd2

SHA256
d30aa5f0ec5fd416beb61e63ee647a5e37293eddfb063d02317359765030797b

SHA512
2b051f89a44d41f81dd5d1d9b0ec95d2c1e33c5d83a00996eaf1344a1809dbcf2aaca65ad05b78b3b8186789f5f4d5dc2abcde831fc757d23c1a4e167ff12053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
818964838f6872879be55c564b5c1f1f

SHA1
9f8b2d033df863fb7fbf3361539c27b22f5404c0

SHA256
c19aa1d874f10610c8ea01c50dbc352e36132283d9ac6af14ded0771a2c2a4d9

SHA512
fe8da0224c6578ad729e5343dab54eabf8e6c75dcf2e9526f266006fae025af2c0efec5e719ce50cfcbf2e78785cfad91ac3796fea6ace95f05a8623b7c30a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
568fc5550ea76eeff19f4d04b3aa21a1

SHA1
645bb456fea50ba465edc57b04b7a85451b0f55d

SHA256
bb96aa340dba5c1c642eb80b088cb071b9e193fc1e8053285c6c5d9394eaa4c3

SHA512
42b5101678f4faf548333a41b1bb9c7c356162bb17fe293a765a757f4e5c056bd85223be0855aec9318d1d84d2f43a78694e0460e39d7c944742cf30bb0a2ee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd11b295f1decbc1f3755062eb3bf422

SHA1
0216c5d193482d215fd3d4176ac7f52f35c7aa5b

SHA256
2a30f5933ef930f48553e39f535f06b832ade4a9d5b7b2e9c28634fc97f7a630

SHA512
0f22d7105b46ea5e0a8182952cc504e7d066222eaa2398b963056d0b0b09f5963e73abf964ffcedb514b520b167ac0f745a1f82b2e73bee4cc7122eb4e71ec37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e5bb6df30526f16537e5c88c8bb3b46

SHA1
71808ccf0948f99ac1b7f8dd0f040d05d8162fac

SHA256
3b375bc0c03bcfbfea79762a907448984f11b84bc6749c80acb97148b153be81

SHA512
90c0ffc2b781fcde622c6ebfecfda5eaff424a27dedf660a8470316ef9d60efec755f8236874de807e955f0eb220a6000f432f55e97635ecb6338b9bf5c82f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71c0fd73ef91fb91798032270a771a15

SHA1
7114f04f1ee540bad09904528480d687bc526bd7

SHA256
d18dc00b7b71c25c8d4e524d827aeea3992ad5f8e9bcec06deca86d34c4ae8f8

SHA512
7a133456f11da52c65211121b2333e030690e3c512f1007ad55b1a9bb09935bfecc6195522ef56001f0861e7901904555dc006398d5d04dc5ae557cb74893df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cd1844b95107b2e18b16e110a2317e6

SHA1
7ff023257b8e285f1111ed8f8b602c8bdcb53d37

SHA256
6acf5cf4d98cf12f64fd90d86e00cd790ba4f4f67e2539d477477b50435a5c85

SHA512
117557471b3ab369c808b84bf51fc660559d50abec5d28922e649aa1710ffaab23318d74290c87ef8667cb27b4dc3bdb338f75922dc5ea6cc840716ecadffb70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19774d6d58873bbb8e9ceb72bc6dd1cd

SHA1
f3aa517a3d8286e8041fd1dfac1903244288975f

SHA256
c2cc67a412cd721d22a8bb2995e81128f887f4cf75957bffef5682e16ecd5194

SHA512
da4f07cc2467ded4e5035997b5cc6987fbcee58ee231959d80c775eab2b70e7bb712ee4ae8e297a64237cdbdfbb5aa950aff8db66696bf881924cd6ab8111060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
47c8ab209df1eee901eeeb671a04b627

SHA1
f82d629fe84c5d5fd3a9f85a55cee65f9b41b791

SHA256
7a9999cfa6b45f44df856226066bd63132201dd601248ee9296bea78811ccb9f

SHA512
cc5eaeef24064e76f345f970f30d612c2c7f423b41aff8590f6c43201b00a2bc0ee8ad59f11456ca1a1babd99eff2bbe8d3c121b89c1234ee851eddc4f69ef80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
43cc1a7d3d416bd53f37779d66469641

SHA1
118a73add05793a37ba3f5c31238920ecffddd76

SHA256
0f30eec3ab11d814e48ccf1f26374c696cfd142716e273bd919432c75f28b74a

SHA512
5a74ee4cbba9abc3067ddbc7b195c71165d4162f47d13880c981d0d477434dddc022186a6fd614c4e32e60afc2a4204785d0b79818e267678db617cb72db12e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F7D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit