d4f60dc5d60ef12c0df9d631cca3ba93c9fa38b6e36172335ed95ad477f15074

Analysis

max time kernel
137s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0171274e181506be04c4e3d164351b3a.html
Size

9KB
MD5

0171274e181506be04c4e3d164351b3a
SHA1

2043b07835920150dad14654e0fb9e3b5d230aa6
SHA256

d4f60dc5d60ef12c0df9d631cca3ba93c9fa38b6e36172335ed95ad477f15074
SHA512

2539fb005619a8d842f55427946be3f6cbc30695d04ca3098d570f1af714ef920a1dc6695133778fead7b3e001a7dc885535579083e66984005ae9bee6699af6
SSDEEP

192:ln8uqnGDSSW0nqukSYjMc8MH1ii71Lh7muKjdpD/UBKZ1f5uHWED9JNT9uUsYic2:ln8uqnGDnW0qukSYjMTMH1ii71Lh7Zot

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C3D1171-A31A-11EE-91F8-4AE60EE50717} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002a8889754ff0e5d338ba8eb644989a970285732eb149c1daeedcde7ac9e770c0000000000e800000000200002000000017373305c5c5e421eba8590a81f3dd15ff5d0d20b70ace17b0b7d0319a1c7adf200000006e774a95fe0674c38515dc78c1f3ecbc398816abc6a1e19fad040b9f5079fae440000000e4f489e30ee32629b9f0716fdfb33421d1f25873c4643b24e9a6cb199015ef8e8c27d9f9ec44b264a28d8c496708dbd93714e3a05503b58459bc34cabe75cf80	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409666147"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f269e22637da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e9b9614f87aaba637e50a1288e2f92ebd5e90f40773b5f82909aea5f509072ac000000000e80000000020000200000005f91f2079c331c369a4199ecd377e4134f7b65072ac7a76537509ac4e0419ffb9000000012293af7f7935e7fa560450c265cab85421c19ccd833e4b5f85ef4fd998a9f6375808fbfcf2b9c94f8468ee4b3f0d82a31a8ccbe4626e7b6ecd605002001cfe6381df886ac901832a701171255431c9826dd9b0ed67ae7c981c409ef14e108c6b77744b5a2e5444c2549285250afc621ee25b32a1d7bcf504cc308ca38a13972deeaf8c97c1f83f13d5d3fd5e44e5008400000004493d9b2a3b6f43cede53c4bd3f50a74bdbad619fb983567f8e05a5962ef348ffa8d7404303da975f4c08b8d851594565a0326a50ba2fe15863a5b1d26103243	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2684	2420	iexplore.exe	16
PID 2420 wrote to memory of 2684	2420	iexplore.exe	16
PID 2420 wrote to memory of 2684	2420	iexplore.exe	16
PID 2420 wrote to memory of 2684	2420	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0171274e181506be04c4e3d164351b3a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a91aca49933ee50079d117cc103c586e

SHA1
e187233e5bdb1d743ac4f720d1b0d15076a3cceb

SHA256
8de08e79656ceb1725e6715129af88b26b7a9828056f64a60be2f71cfefa8204

SHA512
9fb2e1a8d8ad857f6ff74aab7476421c6f9bd94112ed788cdd633c3f35dcf631196e1cb31f82f09a1da67eb0bc1ceeba2607a0cf50b7be4fa544287581b8ea9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb281cc2c8b0adb6ed96ca7d3ed1c4af

SHA1
df20e4dab2acfb476be2d024c893a0436c7adf2b

SHA256
7b8fd142fc04ad3deed1b4288b4b93c93b8b74196c3fff3e90633d91cae45027

SHA512
3f427f0fc57a87901731eb0d53b40a03f979f86545ee00b26abe2736a5de903e3117039db8da6beb6409ec5c9813afbd11431fb314b4793b23e05b2d7910c2f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6928f6bb01a01ad5d6ebd8b69c5aa024

SHA1
1fcb955bee223edbcc4f11de6d794bd4168e84ba

SHA256
a924279f423e5a36d5f48fd57703650100816ac510e49a6714dc7e4d122065a8

SHA512
aa1877f57f89399ea7f8d0c549ba88c99d8f003ab894ef240581140ffea0db6ed6539a94b86652d845e730d785a360b59130a31fed8076f8ae7dbd44c62fd188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14a1c1720fada262dc6a1bf2b0eceffe

SHA1
f42f3f4e63aead072ecf2f9f21a8d8759c3a4bec

SHA256
98f72655858390749c147bbfe094fa0a8cccb8b3f0b9d8a809cd5a9e403f6615

SHA512
60ff20f02a9cb260544a328fec43061633e968196e82cbc4c5eb34b6bc399ceed343a4fd148565daadcaa1438c488ee4fd3f069dd3e35ce665a79976f6f00dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a876640c58004647d164055996c045

SHA1
7ed1c7d6fc3fc8746782ebe71909707bf68df17c

SHA256
ad39b4b962adb5366f6f3025366ecf96269347501b30fbe85d55a341813b734d

SHA512
3b6087a3499ce57799dc682897df0c5644cc5935d6db1821d26effa4acd3549c18f82672e8057e5616d435bb2f1223d70258cae5ab926f1a3b4afc6e967b3982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5674bf08db40123b11f0a8c368e61132

SHA1
d3c77f68dd83e7ffa8db5d49bbc6e7ce0ef48274

SHA256
fc1ee83dc5baab7a182e51cf158d3dc0dcf1b9cec02a88df37e2d5c1282b3afc

SHA512
e616047295188f115b387646950d159bddf036c8ebf22f683d887ecfa601430b4b4abd06d3b635929bdc6c79b6ff0f16fd5663ce5ae00d719dca76381521b530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97d56304108b6af46d45a79d2b5e28e0

SHA1
020310db37d5642d6f4dfa93a2ddbbc6fd452901

SHA256
d151fb50ca0f04d4655a4a958cfa84b4d0eb7e0d293ecfb5b151cff21475b453

SHA512
d027c54be98620e8dbad3541e2ab2845ff422f637066896ecad5109ee6fb9b56080bf328aa87a93909511ed6a1509e170e311ead464c9e5e2c2f7b00e0539daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
189afc897d70b926d1669d2b31fa78ec

SHA1
e0bcc2461822c7e87834408f94e98e73012b4950

SHA256
abb6161e597cbcd5b71e616375fcd0498065952e76fa9c231601e93aa94a12f2

SHA512
11a5342f93d35f2e731fb6674167061f76358aa25e13b13e34201b79a5219053db911d1672ee1bd9e2598da9e831f91567ac74327de328f005896109c989a583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00b4647ac951e42c9eec3a9a8df98f29

SHA1
e1845ffc55f0b06804c3c4f15564f72117673501

SHA256
3afd32aacb99c397f0fdd99b2aaf0f38af033dc22cf839ebfa6abe07c82e1084

SHA512
3b2aabb8143422705619cbd368973fc75672426711642b54f1df56a60f0baddf8492f2639691f4a62161a23fa943974ec69438a8b74bc3de72659c3ef05dcdc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab6d49bc6b569d9ad57a9930b12f9f3

SHA1
b6b2fd32b0a942d0cd0836c7b21e7f7b0b792e37

SHA256
f2ed8c4c2cf5616a784f088c5218f6ed73bd73757a239f4bf5f9fe3a208518f0

SHA512
3461aa967af32d90a6d235d6acc625f6ebbf50f1c9cc94f9e4e59f02cbbd5e961ddeba3367df84d34ebdc08e99ee100ede57f036613fdf622d6060ef37216ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44756f489208b4681662a9e5b218fb4b

SHA1
3a9e23c3c15f8d46b1f1a63b87d658f8a5010db4

SHA256
ca0d89e2937173a8fa9d6b2b906929fbbeeacb626f08b0dcf9758571a920a8f5

SHA512
8d26f9f7825759d43cca4542ea34b7a8d8676155ff9c01ad044be4fd35554f522cc87b6430e8bd07c1183b6078c058495518d01bf79b945dad3243f8e0ef9b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd1dc89da9d289a9675b0757e698f227

SHA1
e771f8a287302ed7b89ee3c94437fe5508198533

SHA256
24d4e5e993eabc8a382f3b32e86ba1a6b49847b801ee30152952762abe708f4b

SHA512
831c0d67774adb7bcf68a2e05fbe895eaf7dea628bedd76d48c1f9afeb8691843d03e4a3d7b7818bf43ada1e005bea38dd406ec1eb595e4eff74e957adf48e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df61951b19a74d746162f3243a28bf90

SHA1
764952184e0e748bd747f7c19d1c51b04921f041

SHA256
066104b5555e952581dd501f2d8686a697d786dc0629c9756a792f23a648f35d

SHA512
d68326c2004272634b5db0209fa004697f21c5d49266a64cfbaf57858a7b771a5e916825f2508127fc8b51efea061d8e0b49eed7f6b368de61e636839ffa3d77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bff1d9690f8079146f34f3966b2fc2d5

SHA1
ea3e762d6ef11bce337d9d9cbc62a20e7297930a

SHA256
ab3b1fd334bf2fbbd472a3d4ed9e04030def9bec6e3b23e972e0dda9807dcd05

SHA512
e53874375ef57a390fd51aebfb375cb258af9d262b50b8d1b9c8803e0198a6e55679d51107679a4b1586a9c40c84daf695b874fd6c22f96352533ebab13579f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dced1cae30b38df7b3534877aab00613

SHA1
d3009cecd58774110fa3e27cb9539d14dc603d1a

SHA256
93c1670b42784a21511cb7bac901372a778d6ae86371e67031cff5ea1339c952

SHA512
cfea5e691570bad0e593a0e37733559f43dd615afb1ba5213887638d772423467acc9fc971c3243260defcf14b18fd62da772d51ba68088521a33af5cb856747

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4674.tmp

Filesize
3KB

MD5
05303236a72ea6ce904e8f15ed06739e

SHA1
11aa497f573b867c4076a3908884b84822f0035a

SHA256
96b1f3ae3b2f0b6dd66ddf63f43d45f3e1b3d2a28fee4f816c49ac7ec1764059

SHA512
c5f07e2d450f6d5dc448da32134771bc99f9e3b6c3f87e7fefa139d618c42d1cfe20c9cdf8e6af67c9c3694ce1b90f95f7b21eb3cb616a0dd9225f79ec4d31ef

Download Submit