ec527f32b062eaed90f0f6d4b0dccdf708faee5136ea7e11edb1284eddf5d227

Analysis

max time kernel
170s
max time network
183s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

033194609ca84caee8d3f4e088565f9c.html
Size

1KB
MD5

033194609ca84caee8d3f4e088565f9c
SHA1

7503f1fefaeb9dbbc70d512c71bf458791ada8a9
SHA256

ec527f32b062eaed90f0f6d4b0dccdf708faee5136ea7e11edb1284eddf5d227
SHA512

43425e1d850fccf85f45c6fa26ed26f324295064061719753850c424d1d802d123d4a10520d8e02723e9c33f1d726ad9925b07583afb787ad8c4f3ba3041c8b8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000c7ff9831c1ddcdf60ed87ee3760928039cd66b6d72a2fdf55d09e2bb5b97b955000000000e800000000200002000000094863821e8e5691254094edd45c4072d6d6d17554e91d40dad028484be52456020000000d07eac198e4e4da673dcd26d39562c9176d61e40c313b9d63f41199e94e37e7840000000f02ee32c818632f160d539f003eda60384bf785e9c185f888eb8041af0706a3838e55a0759ea675f86cabaa1847a81616bb394127d366121ac5259682e9f817d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409670018"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702e82e72f37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E688DE1-A323-11EE-AFA1-EEC5CD00071E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001a603f0e50f69270b30a8112746373b2a0f0f0b89d85d898c7974b1de27d6cc0000000000e80000000020000200000002b270fdf89308430904607f3a7fdf4a04b88c2151618e882fca3efc0ba5518bb90000000ad6bd6c773e51a351a7988f9cedeedce1754f9afc77b04901ee2f5b500a8a19a8fa16c38e618cbd41e3656b78c4a9ba046ed5d86df6cb39e780915e16369f40658f202d40c47ba696ecad6c9742b27ddb03b41e589d6cecefb0b7dbea497e6820d305dd1e8ebe0a44da30f58e4922416d15c564180897355d9e08975c2b9cb4e0b9abc1674d140282b482c25b5722f8340000000011a82fd54de9afb723cc7fbaa735edd26963231776b529c336bbf40632f3aaa58addc0c33d7414b5c282e41f0d4567647e1575a2b688587b4ed6d791339917f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2464	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2464	iexplore.exe
2464	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2724	2464	iexplore.exe	28
PID 2464 wrote to memory of 2724	2464	iexplore.exe	28
PID 2464 wrote to memory of 2724	2464	iexplore.exe	28
PID 2464 wrote to memory of 2724	2464	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\033194609ca84caee8d3f4e088565f9c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48d3b73d2ff6ae9b9ffbbac7fcca6a28

SHA1
deb75f13c634ac34112fa54cb07fb6930e8e4c48

SHA256
f16b4b550fea45768f3c37e56304ca87b9cceb086504093157d65015fc099c5a

SHA512
d426593dca6ba29b6fbb06b9115f0c459be2236adcc6e6fc6090c79b7eceb2e15683d5a8ea804fe1c80177042666e8e96250ba8680fcdc169528b0fb911fdb26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b194860a07c9201f29b6e1f1df59cb

SHA1
e77c55c55ab9c0a0f821f074b3e032332401b9cb

SHA256
980f00a68ba8b29bd29eb5c8eff4d467541971442a43fb2a16ea50bb5c43658d

SHA512
38ad48f6232c9c0a06614d591338133a6c1f356e8fed883f9ae9c7692c48ba3848e89602a62bc2f4e7c69eca683982c6d28e4400d4e8cb0fd6b6663855e133fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7efbc694e973f7ccd91983b06926ada

SHA1
c9bac0871c748d7860f638dda24d371dcbb17db3

SHA256
d741ebdf8da5d112a1430976c762e573e0c0cc94c146c61b562398e184115b55

SHA512
852ca5b44598a5e4c73f9ca1a4a6461d0888a1413011de81371dd5d180b6d98205c8afc273b21934b1d588dd4a890a89986e339f106b5880ec4f67bc24a7fdb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
035d8408abd7731ec5a410d23d59912e

SHA1
be5a7d641c0a1532df810e6c6339aa78869cec6a

SHA256
b017958ac10f95f185829ebaf269eef2f40c0a28c3e762030b7a4277accfaf32

SHA512
f8fb7114c94a6ab0fde9b029ab57577916d28bd5b296517f7df9cc00177eee367b37e88d6a0628f472cc6088e3ca679d58553014abca9d6436140f740c4ec2dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f54f13e3ac3ab54323ce1b99b01855f4

SHA1
a65558fed4d00957a5ebb13160c3170117fa08e4

SHA256
239916f5cdb5b5290ad257a3ec35c286465c59b314cb23702434cc5643f7c942

SHA512
4e3f54530a16dbe56cdc1362ff70676391a7b9de1773a5dafa2709fa383b0e7daf384ab5ad4db7fb60c2d984038934cdd9cc4ec3c9018bae7dde8a85db50347b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2929fc7e5ceccf9dfb8368fb1088be0b

SHA1
d39714c26482a24921229b5cbc86b35d2933f352

SHA256
80cdcd0ae449cc3caa744c533698dbc8dfcc29e26b96cd5931a7d435796d3622

SHA512
a4d1b9e951cb93e018c890d503186664649a387fc1e4c05e19b1004923d23d746fe4976f19a1494e69d445c58aeeb3385ed23cda0327b3c4938c46e40e1e7dcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26e195cbe5162010e66a2b69433658b7

SHA1
97c686271992d6e47b7520ecb34d4d8b08a8efde

SHA256
53a5973f02e4c07edded234141203d2f33e2c30e63b2997b07360915d23d9950

SHA512
196b74cf04467693f553540f814ba4cc7636460460154848076eac6bbece6001258578e89969aa174df0fb31231044829f3ea68db34bd4985b0204e1f6994bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1638669b5766aee9cab364ab8cc8f2ce

SHA1
801e08b9b0f48a6b194031a841a945a832527b5d

SHA256
34dcb1417eb25c88131287395a748acd2bd72df881c696f5b9b3bb0f90c83c1d

SHA512
96d7028f3a5da54bf1780962ac7a8a433a3589d96d229e204a8995a1d3ef84c528b4e2477fb1275507e7cc5271e9c292599369f7c3bcfe64a3cde256abda4a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c59b93bcf6d78d34a8f6066022d45fa

SHA1
421e3a83dd3dc2a8ac5a01f30e036fb1091a1da6

SHA256
b10190fd363181678844904e6e27ea6c9bb10b6ff9e95ec524f2a789f7ce6c31

SHA512
0a85da08318a5dbb121645833d5aae302d119274425c235d6460674a7de9c73713a048ccc8c2010d8a305904f43543c51acb26bbdd3eec9747ef6cd35f4e1eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d1da7bbf033cc6e3b220baad336783e

SHA1
8595ec37287ce32d55869b9ee1482fe7a067e6b0

SHA256
8f3bf0c1cb47725215bdcf744627dedeeb008664a716380547b0adac33406198

SHA512
1be6b4c4874b53679293ba51f8921de57854ecd9778047099ce7b3cc49f6959997d8c24527c99881708c5a8d8ab0e88c9dba9cff33fc9f63835105aab011d184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ddf3b38dadc5a604ab4ac989386767e

SHA1
c2bf4e3451aef5f50b37c4822f04ff1db8bfdd8c

SHA256
ec6b97ab41eff6a12f06cb6a237c017c529861ea2fdc086d36cabd09cbe0ba75

SHA512
483515694cdcba8c484059062148ac8e11ac88857f2bc79ce58a030ae7628c9efb702a1b5559305dabc1bf6bce8afc1a59b2700f17f8801934c2e7e42c8ed30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af10f6bfcd09cee05289d091431227f1

SHA1
abd87a4e55530949308ea97d46fe5fa44fe3818b

SHA256
0f8c96e044c639e5b44fc75b5a383c025c2d6056d0abf64a222df291f8790f04

SHA512
8d35f9a4c9430e76f1632af77751183f52a3cecb5f077e7fc74f65679cd8d80a08a4dd1e73ffb3ca4204dc5ee9c0e83249e3fedceecf2870d8120090ce44c974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f04b30a5b0947199603e97cce7f2f218

SHA1
87f7c3757d349a97fc2b7af502f00b6f2ed19165

SHA256
57da09ff208413a3c96c33485777c040ffd4038d2c9883f20ac93729e1c4d349

SHA512
2076538acf23496c13d334b019b877795f3d81eb2c29c6196922c0be2e2e0b37820ab15eea3a864fdf5859e5103f9fde2c32e714fc7359f33ed0ce7afc0d6369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
277daac24ea3fad65e378f49bab5d0a2

SHA1
964766982203d7cf764b5543c086c65c314eb15c

SHA256
42a8fed78eb9c254158c333115d9e2b54ce80aeee9701049a0a13018812fbd93

SHA512
72805a5ccd92c12a0827049e7fc01ab62a0b2077b4d1e0c181efe20c18076876216ab9817650932098982a6b1f87db2a2b78122a2193fc4bd287d484fb3271e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c00937d7a6aa86e16a6f577a0444c131

SHA1
12a9652a0530629dd0a36cc1f8f0f39187dd5943

SHA256
79157de1a108bd63e6629f53688bce08ff5a6332d07408aba94da3a3282346ae

SHA512
483f2737dc8b5a9ac373d4f7073f368025f6249911f44871d38d7a7adb35f28b8c93061972f01447424593725af0bbbe981b0277b6429e3ebb399304202539c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98c8caa2390a451d6b50c0fa090e6551

SHA1
999c4e4cbae5e8f0adcb9cfb53ed85db9a6b8d26

SHA256
ac927ac6b511ea0f1fab6dd62cf023a96a16e053433df038e7c3277b055c7aad

SHA512
ffa0acc50bba44ad966df89285287778f466310d0e71217e84aa8e1f559079e924d87bcbae43cfbd27d039d290d123619cd3d9a79367b684b2b61430b91f22e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
669bed3e4c0f86f7b68ff37c1688c192

SHA1
ca4f3ada4b29987271d7e8c94836d100820de856

SHA256
9bae6c62d5ff41a0445156c92c49e3b158157820db528325b084a7bf1d5c4e85

SHA512
30509c1cae7785dbea16cfa410fa41b1684844edf93e8355c9d727f4af60aba3f219b4ac66a163bbd438e369bca32aea3ce1c9ace01a31cb251a8fe4b037c2bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab735.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit