8ed1dafcc6b649e751b46b54d2b7281e4a82a0718598f90a3cad148273242cd6

Analysis

max time kernel
137s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

420ff57804af58f325b9b1300787dc0c.html
Size

888B
MD5

420ff57804af58f325b9b1300787dc0c
SHA1

e5753e351f2b30afbd4a395b9c701a952dd0a91b
SHA256

8ed1dafcc6b649e751b46b54d2b7281e4a82a0718598f90a3cad148273242cd6
SHA512

42b2e64d99f68c8ede6fe9321bfccaabff234ed850b7575ec951836217a4efb2b9a339cf3ad73036afcb84daaa456218ed2504fda06d4d43f6e99289d98a531c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000084114f3528dc79fc6aebfcb11d6b880b984a3b6eb5cc7072f6539c85b0e139c2000000000e80000000020000200000008bef8500138ed6cd354020c1ff951835dca3274dd5ae3564041ab92b1bc555cb2000000060c25e9d2f3bec5890594957de3b42f08bb64d1561224316af907365081879cf40000000dac40290ea18a4be6dfdb25a7967ca528270a100696638992766adf539ec2309140d03282048c03b9588b04d72c415522337eab9fcf589afa173d7454a2d92e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90355e3a5138da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409794295"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65803341-A444-11EE-8183-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c7752a1c1051189ebe35ff01032164cd4d25289aca36f512d7b03e1c279e87d0000000000e80000000020000200000007000612afe43924788bef4c8b969736d2cc7eb8267945d42135bdcafd44dc76d90000000d206c6c78556a750289677f0a588faf741f586d6635bbb0b623520ac68dafdec433a80de4f159765446ce63c14b5d22b2095931d71d8960019b22270103799e23c6f6d12d6c6a1acd53eb26da19934ba5b918aab269960dd7c82ac3fad69b7b08edbe36d6728b5c3be684b4c861559afbd1a202154e7011be3a63afbec04b0f7a64ff530eef6fd9c82fbf4a6310f072f40000000e3f9d3f4e164179a413341e64529b47819f5b3055891dcad82a2c9f4150316842e0aa25be144dce6c24c448a31d6f612d9412667c381bf43320fb565314e01e3	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2672	2188	iexplore.exe	28
PID 2188 wrote to memory of 2672	2188	iexplore.exe	28
PID 2188 wrote to memory of 2672	2188	iexplore.exe	28
PID 2188 wrote to memory of 2672	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\420ff57804af58f325b9b1300787dc0c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2fda13ae3593c2cc256e98ede32585b

SHA1
ad0f33e43cf84e39e61d25efdbcf2bc9cbf9374f

SHA256
40bea9212fa9240bb673caa96d125308e191e3b885c6f61ef6297d9d2d6f9700

SHA512
957ce13039c413ba21fac9363a06e58cc2435f7057b5b1de90657142bae29319f97ac3961aeafa42c185b5242ffac9a9bed97296b13e4dbcf95cd7c2c5eb739d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
445bfec1284b6a622518a074c78cdd66

SHA1
660903ae109b650b4236ac4d90d3dfc67d4b59af

SHA256
37a5f0e30376b3a63178600218df511694f5443ec19d6cc8c60d7fafa84ea0fe

SHA512
44d06f84bd1dfb0920d1cdfa2ff27c30fc22c435cc40c0ceeae966f3d0dca2f092f456d1c8d9e2a6a46fb8f74838f5a9fef53504209378d354b3928ed972f46a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
003423cdf34c33d75f2a89f67e6f93df

SHA1
d2c0ec03178e805f54e620eb5ee114115272ff5c

SHA256
0c5334824dab4d1a94a212af89f8c0606567332696ef657ea7dbb795570c223a

SHA512
3c968c9200f7235792f84708515502caab044ed11b7eb5c3a21cdd3d223ef5e1043a1d9914f85a0d739c66a1881cbf94f7444461745559648f98a977888c7a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
683f6894b28ee85d2c5cfb4524b6a16c

SHA1
e0c8412ba243762245cd698dbb30304a99cd4cc5

SHA256
5e4963903a2977ac3a46dee3640f8b87356af91af503f58d98b8035af85cc54c

SHA512
2cb0be9896bbdfd5809ae662631cb83746a494192cdba85817165c070de5143eae6fce1506a246f6cf1a343b2f0fc104a19a1e0ab5e514600f7221ece5fd17b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb9ee6ba5442faff8f64296508ba0b3d

SHA1
1f3e06d2526167d58fd34147bca527c22847f7c0

SHA256
e0d405ed398013c9e1c5196e075d80c4ce32ebcf7c4f91bfbaeb88ffbf625302

SHA512
3ce401425416654689fcf662edd91dff4b3db027fe8b32ce25ba7bdbc393f48df3c26453e8c4f864c711a7065d69b76be0d50ffb7491ef1f82290446f2aeec70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5570342cafcefb1fe3b2fa13b2da272

SHA1
7ed313a4651be6cc7dbaa480872d502dcacbc60f

SHA256
8e36cd83abac874db30341556bd3c6b04db41a62ddb2e7c22fa6f04b5167c7d6

SHA512
72e0fe0054b353367b3f76b16767b9287c3cc22f890c5a4ceb43e6dc1ba700d421068e07323b1203603bb7f81c9e751d9460e509f28a35cfd55602896cc9eaa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dd73c177cc38c852bf6401226506035

SHA1
58be95223a31f806eb1e2e2ec7f3d718922cb9b7

SHA256
9b835785a10ba4cdfb78a4c84e52171ddb4e7d4d5b821ffbf84cbf6402ac125d

SHA512
47ec1344da8c44a3e95b354d7ea20f9a59a101519a04d697ce89775a2a3919135004a1bbf3c2474b5ea2e7ea18e9ace3dbe8dcec6be93201aecd0a067ef1399a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dd0e28074a82b1a92d63b5f1ec607a2

SHA1
eb6c5a63ea2200d772ae9c8696b39595d3dad4d5

SHA256
83ed3d8b2073f075949b67f5f9691ccf2d48572eddbfe103e597d2cd3e23dfef

SHA512
184a8849c9bd157b78ac6d66211c607cbb9096343a3d07f5ae60ec7c56224d5e210401676cabaa12550f21390d9d44051f1c5de8e37c6f398c594a3d4a372498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7568cce3c44d330a21765685918ab7a

SHA1
48f570f7b020d52608302474b45524191eff24e1

SHA256
c714c62fe90a2de7b629b7ae90bdf1954ced2f6e44af492c0e8e6d7a08776a68

SHA512
9e35d5138ffe956095bd78ad17e3c1c20dc766a22f950d152d1db864161a807f99b58ddec8e7ece02c57e91359a9a8ba07fb74b993f140244df863cab15c5fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e8454125d85d1c51a05d20bed6e811c

SHA1
238805725d189f3746f3b42aa21eeb3db5fabe1a

SHA256
0bf10918d880b4f9eaecc97ac6ae18694969cee4c8316835e645615615a76714

SHA512
cb3441c00da296613fce3d464bb4f8de77c4f59669989f84d422c8aeb61a538024cb77e4a630fbd48007402f74cb320bd0efe759666e643f40ba719b2cb50b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8cab37cfa66096acd4c4ccfb3642ec4

SHA1
2a7a1f05ba3c4958c6db0d9c09d82f7b7cc692ae

SHA256
b5d744c229d837a8f7d3013f75d2f648ec1825f40503fb3a94189d5e183b1a2c

SHA512
096922bac3d784bb8a323aed7cec151d977ee6061526d7b376de449178e4161def39a6c84f624cd49b355c6c0126dcd80e2082d6545373ea2d3d0c2050d4ef9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7dd1199aa13e0a2f3a8c7b7f6a11640

SHA1
d9491e0d89d304e5c96bec66b5ca062b067134fe

SHA256
0c149b064739c5947580b2c3e71fc8bcb9b4fb750dae812e4e4f931cddb5c9d4

SHA512
2eede634b601895eded4cb1dedc9b5852c307dceb2e2ded171ead012e707ef2f03aa085172c1d94ceff0ad6141f304e4deb284916b0820141183bf64cb6300d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0439181d3faf25a18ac491c594d1ee7f

SHA1
4b62397602dd874a5d6a54ae484672a132497da6

SHA256
fa56132c4bdd7b4871e67fd3f072607eba164f86fee3e8079242dff8e93ae76b

SHA512
57707050128e0453725552246bd2cbff7a84b5ae09a42916bb2e467138ce76d55eb60a67b57a15442ae1172369974c797b3f221426a8ece21153dc9c67784c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EB6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F17.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit