e3bf25f6c6ec9cac7fa2f0f660fb7fd39570119b39e674037e929a41e3fbdf2e

Analysis

max time kernel
220s
max time network
242s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41e2cf6679d1810567828d9434ed9dd5.html
Size

11KB
MD5

41e2cf6679d1810567828d9434ed9dd5
SHA1

9621f9160e0b024af3fd0110a67e0b04f7a2aad7
SHA256

e3bf25f6c6ec9cac7fa2f0f660fb7fd39570119b39e674037e929a41e3fbdf2e
SHA512

e0dbb2e266b5342a50da131940ce33057d27cedbda4ca0aea38b07333c63d7d77d45d28a9185bad0a5ab418cf204fae08c9e8981af19746f03681cbbe6689fe1
SSDEEP

192:6d6qYNPMMnIooSGW/idPbzrCg34uNpx8ikiuNphVa6eyS8:6Mxpy/ehVa668

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d460a80e1df0142b2c5ea28bee6106fdbd983affd24c3dcba4b3342866c00f6a000000000e8000000002000020000000239d77783c8ecee1bdd40dc23eb0d3c14fa26801bd2af8acb0b6b30eaf5174a52000000079347c0d1332794df5cf8668eaecb4c28a49bdf781e4201f0907b649b0b5d6dd40000000710a3ab9bb84014da17b681ab3b2b90573f0f1e1ff5a200b0f685bc127c0e87dde9fffe89b7965d511995b33cfdd99ce67263554e49dac1097a156f1c99530bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC78D2F0-A443-11EE-A03E-DED0D00124D2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409794063"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bc47d85038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b949c3657d2ba252edc436a3f0f5c1cbff7c0449dbbcb18cc919ffe9896ff429000000000e80000000020000200000005f1029b39722f785d4ef52841ed30fbff50fccf3f08a5527614b6ac1270a97ce90000000aa37eaf93db5f10cbf7f9e610561f061cdffa5cbd97f1169acd0e2777ab58209e1f0cbfc8e6ca10bf27e574ec613b15535c80cc3036bf18e8b8045466dc0584eeebd707904b154c745db0275ea16d2d9587e90a485cea52e76906a0950e3414e6b81c287999920a6608995aee918e658331eb3c1037dee7398f103dbcdf106781df09b9aa0b0c1c3d6439802db70d9f3400000008b4442d4fe01ca6c4288d77e3affa586610f00c9f9b90a2ae16eb82f6e7c4dbcc6a2f8ce458576c86ab8d0785f1cd90ed05aa60c3701f7a5e51b9066df8722ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2628	iexplore.exe
2628	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2676	2628	iexplore.exe	29
PID 2628 wrote to memory of 2676	2628	iexplore.exe	29
PID 2628 wrote to memory of 2676	2628	iexplore.exe	29
PID 2628 wrote to memory of 2676	2628	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41e2cf6679d1810567828d9434ed9dd5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531baacc7ff7b58531ad8dadb429623a

SHA1
b20db381730fc7d1330f5300473c67068f4b3e0e

SHA256
c236a331bd40ba60cb2203c3cf022b08acb1325ead7eeb68d0421f9aa8989377

SHA512
af68ce11899bf22ab49e14d9dd43bd1f6ba2d49fe96ae2e47d832d0754c5ab0eb370af24a4f2930f67c2fdb744cabffe4c4481730658915e80749edcbe1c4224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54a804a955d357308ab073f690b02001

SHA1
cbd404c9620b35b1d1ddb109db510da3b0d2f28c

SHA256
03435a83fdfce34d5322715e8fbebea2d596c8f646dc1f6d612080f4414574c5

SHA512
d9cfd9eafc228cce220ac0f136e4315ff6558d3d823bb4a153123e08a7c8971b78edc9b8fdd04d17513b262ab5d07d2570123ff0920899072fc5a85ec874fe72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57294efaeed291c29d50bfa0bbf44c82

SHA1
cd934572c3b09df128ecb28572d7ec245a4ce2dc

SHA256
e287cb53c66c33529ae283cee78040be549b0fbfe9acf8ec3b6eb634bfdf1d04

SHA512
98ba7d7e7c848389acd87bcc06b97dab870c9ab588d727dbe2915377bebf1b2f50c954fbe94634a2777027eb4258e07dcbadfb916c92372b4dc33114e49af1af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43a4018ea68f1ea5497aacaff65e460e

SHA1
0d04109f0fb076ed414da6fe7e934024d9fb0ab0

SHA256
d1ca627c379c8017f8b87f48fc768509e2fba6e3fdad4f631dfdf85bfde1c333

SHA512
4fffa8df96c4df8d918f68592d1ac42b70691cebe20b260ea9ae041b5d7fc251b36931442a207c5168a9cd067b942c3b2aca93480e84a47830cac0ad78c34cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db23e91bd78814c6b45a9da91bdf656d

SHA1
8318768d406ea858066faac0f66350dad2282a8f

SHA256
eb5e4533b6d47690053f97b90a99e079a4c6f0a208341a332d033c462aa1bd15

SHA512
2f9e790e08dd95be68b4a629e0366c032fdefb835d68ea4c7937a6f268fca1388ad2c2d864bb295f5a42903438ba54e011c3e19188e6fede7f9f83efca0fdfff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f811d33917a66865f68b4ec088f63e19

SHA1
30824ed7e830c91464898d6241ca80f5e9a68a1b

SHA256
f92b22bb49c691e6ae41475ed5c82d552717e0b31e2e85ccf62ae9d5768bde20

SHA512
b6c6ed51f6353ecc46a3915855e92fb48573a31479acca7cfdb91ae0f25c75250a3ff4bb1d60dbdc7e5e66bbf28968e3cfabc9cc77051a8d4de5f5f524ca0a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef5841602b117ccbaa0677530ac5ef05

SHA1
a18a3f0d22a258217f4c346e1055bde06da5dfc0

SHA256
edbed3bcbf7cacddee6cdef9e231c02821faa12e9b04a0c3b009741d19d1d92e

SHA512
f03d0f588cd76f31fc4259a5ee8750982be13ade472da712155abea8459152b0dd820e719725e04460bb08fe9b2c5acfbf8f230e543d831d3631559a238ba6d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02b5bae4978ab59e1643d458c13c9869

SHA1
e112c2d3385602a81bb5e9f5ad9400b9baf5bee7

SHA256
d365132031b4a0a8a30ca78bda75aca4037f17e72b0b94eb0b11cd8c5765b1a3

SHA512
2d790bae76065dc86c9743bd7dcb977241b528078f72218d9acff44b1c602c2c470a62caff4546ab596e8066b980b19f28fa4a1d3f36e2ee8ee6435c17a8d35e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85757df84956f2a2ae1804df3d79d4db

SHA1
086d9f2edf1b58a68e7aa66ad1a4bae9fd13b7ab

SHA256
6e8ebbf752607c5c64f2bb8bf0d081111c9f5852c41e963ee2d7a099a7fb1df9

SHA512
8e23bdab50974feed7f995664af7de98fa187e85fbd085ca95daf6d911c5432aead23a1bfbd3ae2047f840b181212e8c2573809882f3156527b0b5df4358ca17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f6d7b6c6a7edfd329455bc5cd6ebcf1

SHA1
6d72c477f9b75fda50d7ab7e0bfb5cddbac7bb84

SHA256
9eb03800379b032b0e8e70ddee3e87f9886f85b0df872d5a04dd510298a51591

SHA512
44749b112b03f9d024b51a2bbc54ef143b18682741f9a4d0e969a3829361fd0842298334e48ad15417c6b546e03ffccd63dc68918c430d01f173a66f8e6eb86c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d798fe4f82ffcc2ef66f31193d5af1

SHA1
414cc56f32c0760b156ab1dae0c98280455c370a

SHA256
54bb66b94897010a5d93713bdb8caed47979d04e9516aaf745ec4df1c8bc0644

SHA512
999c4aa6b5f1ce5090510a9841c4425d4000d8ca01754b1ebb401476785e552e24585d21c6d6da8da07a43a4f9b1bd5d62d7f7d646766a6d1f303f68bb5dec0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcd64af491d99510410bf1026ba393cf

SHA1
145476e2de218fd4fedd0ad46f1246934f0a7f78

SHA256
fb37c79af0a8fb1215519b0a53b6cd7f0b2766014800b3143ce12cb70ddce826

SHA512
c13e94e54addb6d2e808fd66c4bc8870307cce415c56f2dfbd7a2252a3856dfa9247691660d4f1f57364c43d93df8d43f3ce88a4f5876e660d6ceeb399eb3b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eac068a8fce333c59d3f8b73f75793e0

SHA1
76d18db4fb91cee135b69a24d28b002ccafdb90c

SHA256
62bb248cb8266a61f6e73c5b6cdb3170c5c3d0bbf5438125af0541e50b2d0273

SHA512
009bdc899dba05a631ca735607240c7d7daae80dba23a196e766c28a15a38529e9e43e6904eae12eff6cf7bd747c1b3faae1a7fb7dabbaf1aa575bce84434dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c956e5be14d159f2f98536bb39b50bb

SHA1
c74fd3ab8228f416e977e2b182b2df3d2fd1181c

SHA256
c4cc8773b9313f371540f8f405e4ddc9499fa4445dc457d6318e7ce305dec9aa

SHA512
a6574420b49041e5a0e076132e55eb5f8e0087a89f7a62562a4e32515c20b715843cff59d8b06fc3184f4872daa8174558ba1915e069fed7618802cfd8be976e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6bdfd79864ffa1097abf5b8776a9447

SHA1
571607b608f0435794f28e1789d58b1208b81aed

SHA256
dc6d4a7e9e454605229bf4d61068886dbba353203fc7064b719bd32336af7221

SHA512
cea925dfd852ce77f70b205e2e6ff3f56aa56292da35400ee7618cd1c376c3f441d77e0b4665090288ef485a4435dc509a2641af4de3543b3dbaa248f754b598

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab71A7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8107.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit