7e64ae3c994aa6a9fdc1b3834ad7594ae65e77276d9801846fa31d494167c4c5

Analysis

max time kernel
163s
max time network
184s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09c3df8d1d76b3ce5f3bd612ad493af9.html
Size

1KB
MD5

09c3df8d1d76b3ce5f3bd612ad493af9
SHA1

479d1c55b742b77e295710c932cedb705109b46e
SHA256

7e64ae3c994aa6a9fdc1b3834ad7594ae65e77276d9801846fa31d494167c4c5
SHA512

425d33fa7cc98301c999d3f017fdcd5567740a8bf99c091c3e49fb1bc9873edcec1e9da56cd6e44a169ebaaa43f3ebd29ed1f1d02c78f7ad90eeee2b848dfe0e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000037cc3247ee9a226de4288911cb8bf94e00575e6e3bf81ee46956ce50068958a3000000000e8000000002000020000000196b6474efb043b1a6ac7e6c24671302c2765b5a2015e7ecaf287b5f226e0bab90000000c1fe6dcba188af6dcb1edfcd5bf521575d7b3695e36dec2fb226d9d7d2f6593cf7cdcd21169c808fb275497258bd4c2220537bc67d31992da74f06486ec9221804b4dd4bdc10e8189ae27fb5936b6fd0a8f8dab97bc8d3bfdc7f22b58fc156efbe137d2c8762f9e245faaaa4388c8bf0ecd0aa7f69fb253dc1961469cb8fe99fb3604dd4e739b1af32737abf1db81e064000000090807d8a5bf5642a9254c9b576454b9cda9a006b6881c1bb66723b3a990e039ba007c25d161278869b3b35d81d21cbeaa9248e759e416fd63e4c721564b4199d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409685351"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000aa0b87b7b3603a742a223de4d402545f9dca53743ff334d7bed19e4e6b41d02f000000000e800000000200002000000006828b902e3c3a69d7e6cf7bd527323767e991136f2e454b897c6b3dafc09e4b200000004da8797034160cbb942266dd99e0b83f30a029993cc6f1105a9c2e477f0431c1400000007d10bf89a1808a79a61044bf2d386b4575b9efe44414a28b4be498b0fe3ba636278c993ef9cfefce729c4f72c5b5a91416f9f237206d7f5025bffcd470bcd4b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF943F11-A346-11EE-8C00-76B33C18F4CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ef24955337da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2808	2796	iexplore.exe	28
PID 2796 wrote to memory of 2808	2796	iexplore.exe	28
PID 2796 wrote to memory of 2808	2796	iexplore.exe	28
PID 2796 wrote to memory of 2808	2796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09c3df8d1d76b3ce5f3bd612ad493af9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790930483f966aa271d28acab256b1ca

SHA1
d9f39ca15c78d90cb0d35e9bc752ab6f12e69654

SHA256
67344a7c724aef87e8cf06b4bb58415b46b78c1cd99fd57dbc23fbb2a2e06081

SHA512
739a5707509219586abe4e823e8134ab1c50f95779545e95ee7cbb48c5042c284270c85d70244d73700f8aa691d0c1c519e32b91f746d3703cd9ee59e92cf3e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f85b0bcb36cf3d1bebc3f5eadb8b9e

SHA1
6e10ef7eeaa234ad797b158c2a3debfdaaca1c8f

SHA256
32cdb210e9adfddfd1e0177bebfb84160931f25840591293c6e22bcdea137d97

SHA512
8a010a6d2baed71d1375285b7cde40b11f4be4cb5a5284eb1ba618a2ec7c1b53ef8df766005fbf6f1127929f4569b5abfcaee85724507ae67a57932a97514267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3372f348621b957e7d4de73362bffd1d

SHA1
7482153f7feff45943921970abc71cfc57d9d55b

SHA256
cdb3d6b3957c133f9f82fc7d9768f0e1bbf351499ce472d9ed92afdd76a621e1

SHA512
dcca1df6085517c3ae83d1dd2cca10927769a5cd95b9070b96b82f931fc62858aa7ed1264173a1640eb0c0efd824537950fa3fa592a501a6a1ec05d6abd117e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f26ce4fc6d221f1a8c6f96e3c17ece5

SHA1
e3b7ef9ae2c43b1481a48cb6b22bf0a2e933f5bc

SHA256
9cf98b8347889081c0480b74d88657d526455287d229ca329d94745f72a709f9

SHA512
e4478f799ce3494e50cd35cd92d59390e166d69465bc7ae5ed6979f3c5da529a44bc9c4a4e40cdd2a760373e656c4038c7215b384b3b2c8872a30950caf538f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63d38165e7bea22b7e3f96f7d2a31534

SHA1
f302be547b8a5ddf65bd53e8c776b15d3eb60801

SHA256
dcb88fe0f00cad5d61bde0e9d8dbf6590ff5940427cdf31ca304a01c6dc00064

SHA512
d768876a8ab08e6306c27e0ed109ee69db4864a93103f6e43b761d9051f2ebb0eeae0bd609a686ac590e56052e1399fc98cd9978ec003a4289adf1f391b1de70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8679716040a43936d1d40d236d080265

SHA1
313376da3670eac40bb766a32a60040832032c2b

SHA256
0ed0066db1d84200cb310b1ee7812f6ee83933910f939c7c6147ca3109c2f417

SHA512
534541c468b2fdd36dd6584a218e24d1486f8355d8cfd3cf4564d7e3db9cf0a311e96d356f1ad965d4c7105d689586bb023f51c62b7225455b4ca690b2e7b0cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
679e2efd144e280b62446b7f03e7e57f

SHA1
31c5005dc8a4de8a6841b49e9dba02e33598e664

SHA256
42767850db945a9afed62c59a7d0cf0dbf9339773b3b0e88d48eeb215a54323a

SHA512
8a79d928366f852b71f01f9fb461962fb6d67bb810c80a9cec58611b9d7b1b2c47aeb2d91bd5f9ee17a752d402cb4138c8cd686350dcb2bcbdf22361d6034953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e74682a54e03fb655cd205167101df0

SHA1
313662c19139f687215289d2f84611418b41da98

SHA256
bf4239865e0fa5ad12df69e9bf5b15471ada237879a7d15b02e5f86c194d8dd1

SHA512
8d379af7c998f45ed1a1e97f4c928ba5b71dbee14b6915370284e8d2838b269ce5f37edccb7f160df6c1655068325e357bd94a1f276ea16df9101acc5b3f8362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca48556cf64ac2543beabaedd76cf7a0

SHA1
32c8e65a14e246319c31551d10d70704e80679cd

SHA256
20e1162a653b9d0976c4f23795c516d578cad669bebc7fdec0e07a1c0afc8d9c

SHA512
850239fa2a3419d550825caba669907fcff58eb9b8854e5209ad8ada074091905a69f917c8924bd9b88215771bcdc47c81d83dd23dba169fb287676ed8a27422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57c900d199be62e2b6035da8c4389f50

SHA1
f7b94e924aa035d660a323a762b3464bdf63d4dc

SHA256
abcc2d3c07baa24008b0cafa4fb741caf68c077232543fea8fdd9e9bd97701d7

SHA512
6f7effb47d042190f3a0d706c211e49e185e1066b9488228c7f2e2d2a267edbf7ce29e9df585ef9faf649bff723b4a44ce89265633956b7d0c95c0148f5aaa26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e117b820a76ce70d09edaf56f7c99de

SHA1
fabbad15a15b7fb6b46b6e5960c0f5a2a87df0ff

SHA256
e66ee067e74f649f5b34b2a55c57980fbe44f872b3d760596295586d28355e50

SHA512
10607d9b27464aa5b7015b2d55b2eb6d9439966fef2612c161f6a34fc3bf5dc28c2b238481bedcbc67087931473b04487259820d099bc8ca2d27db6fa803f85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0e7a05e178abbf6c3048665cdc439d5

SHA1
95d5f6694f8664865a8f71222455a8f7295c3dab

SHA256
af5ff08d548ab160427bd34faccd6ed3a55e053a403d33f32a757a245c3e156d

SHA512
449ae44edc37d4a4af539d336ceac885c807f77a8737da9ae8aabd20397ce4c604a4b73b4403ae39f904a7149b32aa49c075057499f7b2e33d82c892ac498221

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF662.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF6F2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit