6f88b85ade8ce068108c01e018e326fd9da37a1a7814705a0660167b68745086

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f3a22207fa611d9f59ee029216b049.html
Size

8KB
MD5

02f3a22207fa611d9f59ee029216b049
SHA1

da1fe030b240d6ea22b9112013231532da5dcec7
SHA256

6f88b85ade8ce068108c01e018e326fd9da37a1a7814705a0660167b68745086
SHA512

e0bca5c920f3b0c913bf92d265998d06ecd57f297b93735d7038885bdafc44fe47b8ff5d649a06e21a2dba7fee070f035bda9a79de078ec372557d354c4bb810
SSDEEP

192:zIu9fe1LarC4irDTna6NRd1qODOXu1Q0qiSH8i:zIu9fe1GC4irnLNRd1qOHQ0qiSf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409781067"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b36edcd46eb6c308447a2f7b28f68a7d39a1c29f4c0f2bf653a4835467e4faf6000000000e80000000020000200000009259b95198de1b722ba67ca2c24f727f761f782fe7526d05b91f57a7276d4bd490000000ffd6545c44b051282490fd71f2de80437481795338828557bc3d4622ed64cef6a3ce3fb5b4dfa5f071a31606a12d2f9d9ca2c769132280e02ada6396e14df1b46ab5cf83ccb0b65dde89be4017fdb693fbd4c822593f77ed84e8cc1d89bf151cd715ebeabb16ef538e4d35a9f56ce3c41940a40186d2dbb6779eac0b4b6985ebdcfd719bb430d66af24d004d317a13f640000000582372cf775b6f1c8cc64ff68154d290c29cd6eaf1547d8e4f8d7285ec49eea50d4d8b6822bfc78aa7040d041a11c2ef500754f338c1aeb8a6ace654eb574f12	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c074608d3238da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E867831-A425-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c34e2a65cb8083b068411646bed73663eb5177b295d549c2547fe7eadc0b1dcf000000000e80000000020000200000005fbb89644bb47717853c561e089bc85e71e5f88f7fdd6e1506f97ee6da61fba3200000009109ed00deca25ab7f373c85689a9136d37ca313d672899a29d6358e376af0a740000000114e7482fb5f52e6920556c3763c7528852fc8ee5b5645b72efe7f07ec0eaddc3dfbddf0a1db20dfca69af148844157488f200793eb52247e2515de0e2e84eea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2200	iexplore.exe
2200	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2364	2200	iexplore.exe	28
PID 2200 wrote to memory of 2364	2200	iexplore.exe	28
PID 2200 wrote to memory of 2364	2200	iexplore.exe	28
PID 2200 wrote to memory of 2364	2200	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02f3a22207fa611d9f59ee029216b049.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6883409ab28690ecbb47cd03a98a363f

SHA1
9c375e6b413a0f52c1490b89a2c4ecfdb40e8410

SHA256
6a306e9ce1da596eb88c9aaeacd6f765f41e637e6299da008318fb19c2888b04

SHA512
b25a8c4b6997bdd0218a8193ded40d9babb5ecb18199f9f630541a2167b6fd8cdc0979bf94a289f292937d4d3bff96aea995532c51f252980cb7597a6fcebd4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d354e47fb470a1bb4adeef7459215926

SHA1
05865a1be57789bf0184f1cdd01c7cf2f9b76da4

SHA256
dd2cec23e1f5ad7d171668177bed5247d4265b8e6425c75f2a60c89c2624452a

SHA512
142a6a9daf82be664c1280555f5cab8a7a77eddd1d637a0a24fb4322d8a861aa4a2b202cf72b12a6b795173717cf2952981eb76cc019393b62f87774d29dd836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c28cbd1db22311427f4bcc2b5b57bd6

SHA1
eb6d675804af84f1cde27896fe59610dfc9c8b82

SHA256
ceab07200d568b9b506eb3ebf2b6be801613ce5b5c77b0d7cd025b42aae05709

SHA512
bbd81fcdb1d69ff19dae31341e7a094ae23788c3a6f37dfa1eb9e9b2bc465a1cee0df98542dbd09992a7cc735daac205b2b29f0616052f1ae0c1583e76087618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b01bc9004cd7c867cc6ff05c61fcf42

SHA1
d13b9cc18288daa4f65a1b3020013978ac59a52d

SHA256
8171fe6a0663475218c2b97e57588cb8101991c1933d3f36dd63ed8a91cfcc0c

SHA512
872318d6d40e392d05da38da9d52f2b35eba0787c5057553ef4eb9cbb2610b50305c0f44796490d8983085ab450300aeb89f54150e50006dde62584506a0f3ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1fd7f01710b594c9a04436d50c72b06

SHA1
5ce81c5e2eb7d6651c5850a0668a9f5950d3d3e8

SHA256
79411293f4144fb364b822dad0de6c81d05e82c200b1e8eb7558b98a5d667283

SHA512
b67f3a7a6f0f5506198da454da747cd1947085d2c0f222a7841901f143b5ec031d2509e5f8ad8ee55ef41e1c297c69196f55ef283822c3d111a54340beb8ac2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
539f89ee4c00f1707227922667551aca

SHA1
d1aeef1387f9ee8efe1f232005003f4f50624d8f

SHA256
32786d64cd1cf48d1ae6a363281d894d6c570201cd456d6e23aaf6373c5ec659

SHA512
47f0889a655e9d39182fcf6a42e897b86a9c242943debbad9115dcb1a92cf4255959158dacf96f068691f0c0deb76066c36402ee478b89684f42e1449315100c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fcc758fbfef7c43ffc37659529f8771

SHA1
4d13413cacbbad6ed773aefb466079bc80e544a5

SHA256
abd65d1d003a3b02e17351fceb3b8496eca19d025b4c9d5b54c83a8683cbb675

SHA512
df4221c417af526bd66553eaa06061a64a2fbf6e200a071cd471ebfa74ce6ce139bfc3d97428104d0ada4e7c851ef52e3bb2adf6b629ac9596cb13cc7f3b6188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6ee0ae8ce2cfcd7df3e909d3e67ec5

SHA1
de9f68e917bc8e3eacfe945f5d074fd872029384

SHA256
5bc18f86f26bb0ab581f76c50932beed09501b42ea23e5e5cb9ebbcebc494a04

SHA512
4e1e6c981b3de617339802de578016202b47b521b41fa3b881cb6c880d0cb4cbddab0c9667faee8984f89f8ba013abc6de37a5de2997d1138ad0d54d56d3274a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40d0469b03a785f8711a9c25420c4e0f

SHA1
354d3d86afa6a1032ecbbb608fca66b980d4587d

SHA256
013834c59ceb173693d9350650357ce74fc20f5157e80d2f598813762490634b

SHA512
86bc6a0577829cab70f2c4054e8fd027718c66c24a2b8ca2646436caa980a390b18c6a4d56b91a533b0778c344625cfcf8924cfd6b33ac3591ca3d9d459ad507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85400d1e00313f1a7a9d2162a61ae903

SHA1
58820e837a6c728ee60d75e1fdefbecb7ef0b0f8

SHA256
d73eb9506924b1a459ad6234b4649a180f125f9ddfd0e6b9a2dac9d62df7f74e

SHA512
95ab5154b5b43d1a352bd7d0446b3432ec12dd0ba015ed2cc14eb209c6c936ef0cb9f769e2f72edda747d3e2dc725c1d3a2e61a3b632ba8aff0974d6e1176cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3945430eb0b400ff558511c8ee7f26d8

SHA1
f3befcc6ddeecc7da6a135b7ce5e3c828ce2e535

SHA256
345faf65cbffc2628052bb76d4f141fa5a8e11b6361baf441fe95ac6036866f6

SHA512
ae2442602d9cda1efa6116b47cc3cb63a281ea5d2e64f0d41f40ee82ae9a84c849586ab40da0dea355ca042beca37436f579cf83bff3c4de779d8685610e9e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f6d6acf1f90b31d4e189ed4263cbd28

SHA1
bc6b9dbac99767336e41ed11e960437a6dc8233f

SHA256
af0456542fd473abffb5c85f76d3d9ddfe8ef48cf6de2e4d8b3a3bf30727a15a

SHA512
4921ec5acd9eca9f9a927be60cacde9c9d966fa15efe846b757f51d0a3ea000e1c62e6a653a13019ba46ebdd493d1ca48ded15f17659a7206a9e43b9cd90dfad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4e2963e160ac224cbc3ed0771a97247

SHA1
3d226d0d582092c1691fd3ef92d9e01529744bf7

SHA256
3b9555df7955a3fb8d37b9287a89e0e3a6baee8e3ea41efda0b2ea052d32858f

SHA512
703e8bececda61bed6429d0688590cb87006486ffdadd75d66a1dd302fbeab092ed1a2e37687f2691230f9d0f5dd4b1d216b7da18ccacae7f9b3789fc4168455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ece60f2482f6ab59b5913c2e54ecb7c

SHA1
100cf78710ee1e4b3a5bb33447ea1cf726f08129

SHA256
944a7b38a8efa2b0ee2192479da86280b1e3c11e7b0d231564539b0bc691a0c0

SHA512
c37d92c9d92a36f2e744deb0206d963b5ad48aa542b07f2338a08ff466ad7e4b0f29f02a39a2dd1e686cfffe41ec1ea795ae5d9752f567d3e26b29e785165a9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd520c6428b8d8cf14e6d1470eb20789

SHA1
109cd37c740d9d59ecabb009dd2ba9d6a9caf1a4

SHA256
9b691cfbba8833af3de7018716d1120f7195bc399dfa687cccd700952c6d7303

SHA512
f0f159083282166d2c1721a8bb2fdded6517ffa3ec7c99e6019209b237fa644731e67c2ad83320bf813c85c66bdb2ced9db2e9fcc9093ba7533ccd77a4f3c41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b65736145c927f0a49258b879d3388d

SHA1
bbfe53e884be69c5dd5344e3fe76905f1204baef

SHA256
22aeff5f4d979c87be5b3d959d7b18291e4178822747f6bd27bab0699bee7e66

SHA512
46a5c7f75424ac949a1642fc2652c87a7782b84939e0b3615faddf522f98f514ab6a7eeb516a707675c91d4c71ad35eb0ccce5cb1104a16fe439e634179b602c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B67.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BF6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit