dcba43f6f8c9a3d52e5082e43535fcd0472c3cd6eae19767c7a592a815a76ce8

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4232ec4ed73c751c04d87844e94828e6.html
Size

1004B
MD5

4232ec4ed73c751c04d87844e94828e6
SHA1

d83daa345fc938cee070e1c687d3b520556b6dba
SHA256

dcba43f6f8c9a3d52e5082e43535fcd0472c3cd6eae19767c7a592a815a76ce8
SHA512

53e19c834e8d98c8547ef35357bf487ef889155afd7801cf064a5516147846b3c794a4c1dd4178dc37ee89210b669f02fdde49b269ea6afa088218ae8a95e9aa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000cb08f0f9b16b88e0d5fe4ff30610d97d87d57170095fa115d735d6be0db827d9000000000e80000000020000200000001b15a7b426d82b44d4e7a0b95bbb057dc99ad2a0effc3407bfe9d7e9dd6951cc20000000a0b63f266ffcb49eeb013674d9ba7d8c0219d406c57c228da1af1c091e0eb295400000000d04a9e8b1f9bb5a1ef5784cf1966e5fe9a03cf714534031c034b154552d297cdd631b7ac90b10a7133b3b4abb8ea66a3f7aaa0afd9fcf8cec6d7b432a35a1d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03108101-A445-11EE-9240-46FAA8558A22} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409794572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702d33d85138da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000f9223fad9dede944fd902ec154dca6eabaecb9f2076c6004e8e699813e8b512000000000e8000000002000020000000547000c78c24c318f13ea1417c7ff67a3d8fb9de53175693889876875c23164d90000000f8875a456145700017cb37ec958a9edf263a07a2aea15661d56a057ed02b0a483914d99c9ad3c1a6d08ea9abfc3eb24984800f91a07f19688fb8a02541f4d53cd9ee7cf3ae2d2841199c9bf4d938557659ad0e08103cb201cde8bbd3ce477faf13b02bf1bd750c149058a04331d8059a7588a0b0ca43c8d15166f01105586aa6cf93816fe2689f7d5d61297012c81241400000007219b06b8c2567d63c9cab095ce93c5fa4dbf5e7cb2245ec03e91309fc3ee60be196678d9f5538461a4e05a8ed462c993098c92e059b371e68c459828117d4e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2336	1964	iexplore.exe	1
PID 1964 wrote to memory of 2336	1964	iexplore.exe	1
PID 1964 wrote to memory of 2336	1964	iexplore.exe	1
PID 1964 wrote to memory of 2336	1964	iexplore.exe	1

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4232ec4ed73c751c04d87844e94828e6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57fc26ea6bc28e628270e5a89ff0ec78

SHA1
3eec0a4e2e5076340dbca7a714faf5a10964e5a4

SHA256
e62c12e8379e31780152f049fdb5845ccbef6180dbe39f1c079e40f1592198ad

SHA512
be35e6be45965dd2ffc18df864dfd685ad0bca535196526a721141e77324158aed61f750fab530f18975d67cf72c1d12b00e10131873c5ba223c0960b13bfd12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73902609992121bab0849b49f6f9bc5e

SHA1
b1b8ac381587be23314f291c85380e8d17cff923

SHA256
fd08e90876212897c0e9adcf54fac6c4301d6c507fc151a565212d0ff4fc7928

SHA512
8b18cb3ce09bb85a27948985b332658d5442896f24cb7ccac5df1c143bb50f4a7ac2093648b914882f296b101b9bf2dca2821b3d5c964a42489d2b14aea29414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
332cc0a392a370d11cc12762fbd4e0f1

SHA1
73c01b32fb2fadad1a10eb03cb6a2e654338f873

SHA256
8be56ba6b9511587974512a9d607ae7b6140afcd0df54fb7e2c05bae91b07621

SHA512
a9546844f908b83c44d76fa52e59dbce0fe0ebc57ac64278092e42359586d4deebcf354a64311f5620f32721ef8bc7622d2791575f9259d6f23cc47cbfb31924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
692ea88279f83cd5a3a94ca920de748f

SHA1
60160a3386965edf25fe4619d5d57bcaeaf69902

SHA256
e65c7027fe2641462712388c47c886fd77ddba73f554f5f8168ae1857ccf5014

SHA512
3771a28479ad898b18bdc59c6fde09116d26540e0e8c0829a17c3a12927a13a563c8bd898966294a4ce0dce60aee89df5b0d98955041fe6bcbafe63c15b4b5dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64885b39672839e7e1992a2f47dfbe66

SHA1
a1fe1ef6a392fd9675f39534c33812c63913df74

SHA256
77e57bd2ee3fea06897d21c2456795f43559310cb89668a37bfdf0e0a5537c42

SHA512
4b63cc39c8d2a83ace30e746837abbedb25fec45a0a914c38cf82dd1f4e63cbf8f3e824dee92db9a0695080907c1a93c4ed45655e6142ccb5b9a3ac1eb85004c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bff1f05346151bf8127f451e331d5d5

SHA1
67f2faae56d1ae27da01510aa6bfe21139b14e9b

SHA256
edc3796488e70ba28d653a8dd86eb747610299394d14395b630ad0689fa2651b

SHA512
0e865c78467e8fb77e4244ecee4e89ebd6a0cc16b42029a5364d9e622a84c0abe662b46f4021c1d483dd1de04e8001ca1b1243fd620821f466d3e2d034a78fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f75ddddb65e7cfd60c21ef1ab953cd8c

SHA1
17ae7cafc6f930744f5caf6269ad101e87aec221

SHA256
b312174e2aac601905c2d68dacdb95ac85f05ba224066a6f4c5b4a3f3a313125

SHA512
1c73970d28e75b7b86352f2547bffb1296b49db8dd423c9142015285e7a9a1cc572e5276e2dfd9417c474ae79a385f82e89b0e6b762206b8b892af882bd5274c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07f3b86a7af8b2a88dd55f183a24a546

SHA1
e9e0b8d1e471c68d7f84c41fa1e4cddcc5f53328

SHA256
5a061a2e50459eb6ec9edff034f649b1dfce034660ed780d8b85d127ad3d6ee9

SHA512
4802379ee5f8cd8c7de80061c6d5df1cf60abdef2c2ddd5fdeae6528dec0e6e581b430dc481c0808e628728eef0a2fcd366cef5b7a33175a33358abb7bb05850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57a81d85fb22a55a447c4d7ea26d1492

SHA1
50154aaf936c47acf2969d3e91f274e15b191aef

SHA256
2f752e58a19aef64bc4072118e4838cfcb99f7e7b6de912746f60fa07b9a7711

SHA512
5df312230bcfbb351c76967b2511a3fe3f66e108dd4db7a24ef42653536adacd8d6848c4f413faca12f002eac4b9b886cd81ea54ddec889404652a9eebf7da4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3de311d8748fda1fce782add8e2291e7

SHA1
1e2d2f3275bf4f8d5a20a68d1c84ddbb351a892b

SHA256
eba33f18b00a1ab4f9cfd6f6219b777d07748dbd4799b5a205844cd89acaa9cc

SHA512
c41ec4a41645741a9866e8dfc67b34d4c5392a83d69c761f29fa13538fd151ea0bc9cf3984cadaba4bf063c9bfdbebf2ce20077c0eb4a2a0f835bbf4dbabb0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cb000287536145a072730aac87a154a

SHA1
b39cc79f5bd8aa53d07ede10a582095ed702cb00

SHA256
a46f94c4dc9691bc0454670d78ad26d8a9a85f2f227478b34044ff2e719e275b

SHA512
4f717a286c7180bb2ed6c8522b315cd7d20d5e1b4d14943890cfcde4731b3391fe51f635970945069c39faa8ea6112f91791bcb65460848da087371936ff78d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b7aacfaaf88d971d5b5cb316e5588d3

SHA1
96dd7edb06fb418f8efeac8c2452df7f6d4823b7

SHA256
8580b5e8015388fe35d3be1872373b68478f13f21fd2b89af073001aab3c776d

SHA512
07d823cac1806ef946f4fe352b3a04e8bd674b4dd466e6d4410e00afc25ac33d153263fb707a70fb311cbd167657c5c71c81d70b21c6b9c9e317c24d46f9d813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f66bce9f75e0ae96644495865fc5895c

SHA1
a380bf0a25a9a60bd7e9ace2a79594162bf46fb6

SHA256
c4c73818c52757cd790d3fd688bb040cc5aa781d9cacb0da6471ecdb55abed08

SHA512
3bddcb001734a86243f12a96032a9557fbe134a06a40ca030a33df8b6cdd7328144e9c4c2ba067fb703c79f20af5b7264884b38ecd8c3a576b96eee402b23ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e09c2314aa696f0f85ff46a17333dec

SHA1
82093475b779c264e7029db462a1f1a4622ff932

SHA256
af52499612057f31fc3f65294cc48aba2a78193a15611edb43b20b2f511463cb

SHA512
2376973f8feab33545f889595dbca5c5e3c4eddda797bdc0fb69d2ab8921fd8be007d78a39dc34950ba4d76d9b46d8747bfc7ee0d9e298fad6b62d7523a7dcd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8baea79b5e08b0c6281e23f714bd3e70

SHA1
ad213ac7136003db475270beff1d111fda5e8a6d

SHA256
87cf654262fc57fb470d74ac4a333c02591c89c009cbc0599df32053e21a8cbc

SHA512
d389117845ad953febbbf5577efeb56c998bfc7a951f0d91176d7f61422903856d40c5d12d8de264d3a6117f169d9576d640b94330b1a75c281c874fbe542c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E28.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5EB9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit