207423fcf3eebc678086b6b79cb42f76fba357c4dcc16003fdbf05aa32a9a1a8

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d96f62ab8eece5dc0ec8e116350c18.html
Size

972B
MD5

04d96f62ab8eece5dc0ec8e116350c18
SHA1

1c0a20b12f582e6f9472c5025f7fafdc9bd4d832
SHA256

207423fcf3eebc678086b6b79cb42f76fba357c4dcc16003fdbf05aa32a9a1a8
SHA512

d5eb889dca3335ff4c27d549f95ae95ff47a94d247115a749a97bfcfe28456fb2bb24adab06699262f1ccedf053f128f5ecee4d98361422e069b08d8a91d5460

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000282fc90476cf6d7057787341a7f04734e319fc7825ee7fd0b24966fd6a3ae2b9000000000e8000000002000020000000c8b200d25cadb5228e088a6d5b84b0df23a50718dba7b936c5e2bfd0ff513cca20000000be95ecb4d4993af6027326dcf1177a32fc32452ca8b22eaec0d952d98c1aa8fb40000000670ad0c4027e71e2895953522db7db3384a1744dfc80f3767c4b26cb8b99c24878fc02e081c252ab9caa5ab29b5c242d51e32dcfe154a2ab4d1350a1500e9f6f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000001fa23c5358b6c1e04a9075f09a76421b2217bc2fc84bb507546dd83cf4ade398000000000e80000000020000200000007751eaaab346b99f78eec36c3a5e1620944dd3565d34bf0b504dd3b31756215e900000000cb4511ceeed85eb9ef5c81b719439cda73f341fe698fb15dcbea0b383c1662593874ff5e2347dd70746d9360d19f72509c4fe988913bfc8959249547ffec8e9f0fab03ed2745c8cefc014376c9b29ce1d2d41c950039787e55f3bfd9cb5ec8cfefca41148cec54d374b87cd3e1f31fe337fc8bd268cb22fd0194370aaf65390adc78397ff8f01af82071cf3a3492e1040000000505153642fb16832212393351bafe66ce3dc340ce7529a570dbcdceefa5e9d6964e642f02619d2f9f11326138448c1f3f72f6568691ca16ff25b4c2f74037030	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304ec0d33937da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409674288"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF594101-A32C-11EE-8EEA-EE2F313809B4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
848	iexplore.exe
848	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2932	848	iexplore.exe	16
PID 848 wrote to memory of 2932	848	iexplore.exe	16
PID 848 wrote to memory of 2932	848	iexplore.exe	16
PID 848 wrote to memory of 2932	848	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04d96f62ab8eece5dc0ec8e116350c18.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a220ec45389f2b671eac830dacae6255

SHA1
fa6073945608820c2e00324010bea39640d4282a

SHA256
421b7b97705f869f1fb86d6bd1b1db359b2d649002a932d9cc6d7fad2b1a4c9e

SHA512
a06032aa224842945c24b2306f86531820158327504a2cf2168ccf73cc678735d8b40cd198938cf012c8db2e1b825df32133433538ddd47e0439ffaf2d4deaba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec1202940bdbd3b98f76bff68f865dd0

SHA1
0d578b83dc6f839ff145ff61a30ca27bf5ffd789

SHA256
fac2ca5d08f944107598518758af0db697f9e0c4f69ffbc21aa399b0a1b1372d

SHA512
d0938ac521cef1f03e96d1a4a18c19fa9f33825d388505c98d3ada7924447ec80ebfd7712583ab0c4054e3f4117b3bd18dec08d28ac09e9ee65dc7e1094880dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1d09aa73f18831e51e866bad4b1daf3

SHA1
05fa89e293271a21776587272034bd08f2300d7f

SHA256
e7c4a6e16f841e754b264fdf251bcd887fce2d9c31a3adfd52d330db2a3f6a8a

SHA512
078e4cf66f8464b70911b472c2162a2f9a1fd1a96d9c6869e66f4054b611b3840d88ed9b7894f63f56f447a30911750fd0cb3132c6c9468cb5f32999562547d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e475b9fb57cb1d2481f10ec28926118a

SHA1
85c5b39c797f38b7d8e5a8dfc9441afca5ad7740

SHA256
f55e3a7b45356d1043edcecd76e5c9a455fa66a9f786c8a6a9245c1d7020478f

SHA512
7e7afb6241e1a14e704020ba73c5faa819091fa9d8543f9f1f44ca238eb9488fae433c49f1833321d33290f3c1cead4a2f08589c8ab4e02673da6a05a101fa56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12a37684114871fa854287d9aaee51f0

SHA1
e1c51f44961c5177e4a536fcf21cc00b2406c141

SHA256
dcb76841c5d219ba8fb37b549964f97aff8f529a7b45c97f732a8631b61f71ad

SHA512
ab5b179e39f5becc7ab2df86113e34b2c18004fe436b78ee5cfdfaf4330527590976cc3510919ec2a522f76f6db6d3cc7175cb51f564c6b3203b76d862ff44c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c15d0e9f78e026a4e7b770b4b504c9a8

SHA1
142cc3d9ec15fb53a6a8009286394a6904d580bf

SHA256
ecfdb91f8cfef3148b936e17e39e2f8987e591ee793adcd8887159e9e98ab79a

SHA512
2566bd03a3cd4751b5153391c6e03959bd4d019f0848d8dd3fea8dccb603b94576163b93cdcef17b3e5d7a6e245a276815f4efdfde22af8b6476838e6fd96cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
614321403d609774d77aaee91d517b02

SHA1
74a16184fc8707d616e1f60a1865165570990650

SHA256
be15addaf7b3b5c84835f7ad5daec9fdc76aa9418756a362e7bd68ce9a5069e2

SHA512
0d0239529eb75acb426851ff815d035c986ea3ce3d209d4b7721351cf3ef857af43ce81d59dda986657e5b89456e886249471444966ed897b5579f4e95c8d136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
eb65a9d6d9450e8983734d9be5d6f28b

SHA1
982e39b9b71334a5ae471f1f39237285aeb73efb

SHA256
9bd53cc703e8f6c357a0350627e098b1e88a6ec9ffbdb5937b3d70a683b5ab24

SHA512
d4b229f2cf7d04edb7d07d27d692f8bbf7460475816b3a96380e4d1b530c774db298e281e38c885cf8e0ca2c51af9f57e7a3845fc3ef9f2db80dc0d5f714dd6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b44472189d052725b5f10cec3436b80e

SHA1
2a7018451648934ff1d5c6d514cf6cc66b488ecf

SHA256
e33d6ce76bb0aef685e612090a22b36679c1425f7c47751cbca3103f6261baac

SHA512
fc2b8d2ed3611db75992d1baa3470f1ba052e451f54516d1fb6552b97fa89a0c696d7bb85c79b9c33683281e1976ece5a764d86bf40dec4592fdc23bd97b1b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
3KB

MD5
eda036e642b1575f5b16d653d160b694

SHA1
639b71d67dfc17b8503daaf4b73484a831607656

SHA256
ccfec4052c575cd4f0b26682c5fc07b4e813530e23162e8d5636a3ecc6ba690c

SHA512
66edee73419e6ee0fbdca1172db7e35cfac9a0474d66669e340ad707d067271b08a3694278fa0b79480ee5b75fa4fb1b0f7ac2328d40c05dcab5656574f86657

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AC5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit