f924eab6d37b6a8f416a86d20d44b45abc8268c538eaf73fb7a194cad6c9a5d8

Analysis

max time kernel
178s
max time network
201s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1038237b7a7f0b1eabbc7d6c7f998fef.html
Size

17KB
MD5

1038237b7a7f0b1eabbc7d6c7f998fef
SHA1

b85c6ddc76b0fe5ae49b8a5a94a0fa0ef033d6b3
SHA256

f924eab6d37b6a8f416a86d20d44b45abc8268c538eaf73fb7a194cad6c9a5d8
SHA512

c72605072151bd02084429dd31011ae036f7e0c0d1b510efe4be029693185c35ad7e6d53afa6baad00accef6989dfe6204f7602eaa0d6f1fe8c0aa578e8dcfa3
SSDEEP

192:Mq3ud9YlrywuFGhMeysKArQRFol72YBltbB5xYd4H7I8W51YW:McRiGhoFol7t3gCI84

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D89B46C1-A364-11EE-AFA1-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e7f9dd1c4064f1e0334e2da40e19ac99e7f892df2b890cd474bad85cd73dd082000000000e80000000020000200000003a69769e78376ccc2265eee27f145782a2e8aea60700885e1dc5b08ef76423e6200000003af4c5808897483a91e4c7b4c5939583ebdf7ad2eac69b0a362de5adafb7e2824000000059c3be780209e35e4dbac0c982af57806415d40c60d51fe9625cd097450ebf0767b6dfb2f316197ed36e8af48fa6e226e9a87e851006134785d33c8ab8386534	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302abcd27137da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409698274"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001e1b1e670da266eee562b6886143419bc63b97640c39b0acdd2e452e8fc5a886000000000e800000000200002000000087ca3dc2a566897483a38e27f0fa8246014bab0a345c312154dfa854d01c5ac190000000491fe8bc09bd119e0a7d8f0ad7e5140811b84d50fff60300ce858d702a52dd8f9c7ce913d73dc2398244d195780d27691600cf937dd86a03395fcd81e3c9f333980f69bf7f91a682a905d30821e243aa62060d6e89bab5cd8c8d6f6d1ec1a98e6670edc43e82c68a1def781b9613cdec9be1b613e8d54081eaf45583873e9098f8c3c151ea53ee4349d213c12180b73540000000af183691e6731ac8222788a2d50979db1ab4641b031c271ee2e5b549bbacce87cdd65e76fa83bb4c7150a8d9987d1fbb8157ec8994527207e95104717b567688	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2656	2900	iexplore.exe	30
PID 2900 wrote to memory of 2656	2900	iexplore.exe	30
PID 2900 wrote to memory of 2656	2900	iexplore.exe	30
PID 2900 wrote to memory of 2656	2900	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1038237b7a7f0b1eabbc7d6c7f998fef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3d060e724049f37ab05f3ae106451ef

SHA1
63e88a435ce46bbef5e0e0779181724da91047ba

SHA256
9cda28c7c2c56f6da573354df4cf6d0ec399d594e11a97065ff16342914414a9

SHA512
552796bb1abff1dd49de17e3b72af8ca252f9f5522d75c62b920401043bac52840cae89a2299b6a13e462f6a9ca8133bb05fce1e8fd0af04e8fbf38e7acb2172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5e1888901129a2a57e8678115d9a82c

SHA1
aa333350c178c07e03e7e3d726c1f475c7581c3c

SHA256
171130bf212e96cb534366f36eb561688cb4d072d7f8871ba9e90032fbbf2212

SHA512
36f942529beb66fe55514634d6a16d4dfce170216f284a76a732c5ecbe0c0498efc636cfc9933dc548ca371e3a03774c4446e3d234caf3d94203138a5605c31b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6c5aed3427351f9cdd956fa4163087a

SHA1
103ce850044ee66b3ca9b8cdab4d0b3f5d82859e

SHA256
63a75156d7c0ebf60930afb0c595ccb7d71fafbe2edf807f49310890a31bbe30

SHA512
6d35e15f17dbeca016d6af1c88030b9c34ceb6b858cb5f314afab087d073fb7070f4cee8fad6a56d2fa8ab7371556baebb948d376520aca11c72fab1b840c899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6bbe59037f2a8dd6039c5e4a4ac1d54

SHA1
4bfba43898e2d2393cdd6c5275e08db8fc5d14d0

SHA256
e5ea5b0b1d05531b82b7cb184fddcd956a898c7cbe4a034f36c234f0a5b895f4

SHA512
9df4ee8d7b6d5ac533ff3ae8ffd1cfff079ff0986e9686cd79d38b6c15c7985627490f31b9d7d0ab0740074b02ae6ca62e6fa1e426e10f0224b4d4ef7aa8d017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d608e61595c5306659f567d8bcdf8d25

SHA1
653ea73c84187e71b1a5c446081baf25471f8cbc

SHA256
c7252b0f71773cb506acdc8c2db9e0cb66e93aaa2ba57a5aad766122301c88fe

SHA512
30c49dc12e5d27f6a26c227f6e33547fa59a9c1d9d276f952b878e20cd0829e6ba1a5a4336f1dfe900c45f0c0267a7433f6f8bd38139de7077f547d6d3fde06f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f0cfdeddc9d74259056897da631629

SHA1
2cb113051c27b5efba8d6bbaf7bfa952db4edfe7

SHA256
e499cd8e298b9f414e9e464973e0f2e6200438b7fbceebc8742d3b1676c0d5e8

SHA512
b27faa5ec3a79f870ecc273e7a828fdd662a54d41da668ed86f1390315a9c696cb0ebdde441d809ded623bd4cde0002708c213c9d408128bf9f3b8d3092f5bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae53d5d394eb29ab475a20e0b721665f

SHA1
d96fb48bef509210886e4d5fd1441d6e00889afd

SHA256
a75b507c57fdeea8e4ef48a2c8c517dbe3cb4fb1904b9f151853f0b96e3a20e8

SHA512
ab4147d93c19bc3ea927d3deeae6d0eebc0a2e01438753bd076aa2bc7223019260e863278cd15ba873cce9969897388d1b4a2969859e96a0addcc51b9baa7b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
058cfd4e562c43474a2d68e7e71fe232

SHA1
9b24efa6988bf1c4091a63cce1281f26549f43ee

SHA256
fc2c22ed6d960835762e8d92f81fbb017f8410f44912cbf57596d7df609153d7

SHA512
b440aba440ae2e752f689437077b5002f1ec6bdab7de448f7bc857dd5f2a90b870d5bc7df12d2945d5b909e7ff253e305e74fd7392f2c1313dfa18047473cb6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff8b7101a94e1673397d83c0acb4436b

SHA1
e3cd15d5d2fadb37ff79ed29c7f14cfc759d24aa

SHA256
cc52cee04f4ab61a826adb0e6ad81e34955ac871f938f4f84bdc623c59938f49

SHA512
884138de6dce58af2f13b46b2217dbe9cb64ea4c55075551dae04a3f87d2553e05dce5a6dfe1ff12efe076bc67fbd482fec4e0b8844d2ccb524d9e974205c981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
302a3439d7b45ff488474d78734c55a7

SHA1
44120ea75e1961d1c58eb470e634ce707d6de80f

SHA256
7372afb81bc778ae89a80d7a1c4206e93b5c7cd8562394c42703700c8b74f8c3

SHA512
168344b02f6cfc7cfa191e8e1fd439edfcd4662ca8590cff4290a120ba7d0e878a9a5228d0c77b7feeb7333f28fa7fc9562a2e9c82acad5d59739d542858fa5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8672570aa87019cc65c70873a84d8642

SHA1
22d10439e62d2b2669e0446e22ef304641dd1e7c

SHA256
f2006bce90df7997d93aea7c6c6a47fde589ff61e838ca87493fece021ac81fd

SHA512
cd266c472121378420192ab343ba32a2785c1ad8b854983f5a1c98f4cc370e248df02b1cff78ee9356b529d53e180c97839c57449ea84e8fce1c9c99eb859849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f94e7a18059219a4e2d8ece80d3701dc

SHA1
066793343de4cf611550b29dbfde3d1973cb7bad

SHA256
6b41adaf46d91434a7a421b7c880fa598a5d7fd6a02ba50b2939701c72d005fb

SHA512
68aac67b6019c3b1460106cc7684c03e33210aaea90fe5bc5640124fe82f60ab0a46d7ed832a946c8115261a99c515e57c441a5277b60187ddab9456b8da4a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6925be22d431d29457d7b4e5ea1a1fb2

SHA1
561b0512a6d4b06025f3d80e80e586b1286156a6

SHA256
7f84033da330036cf09276bada0999512efba545684c5711de01f7d74ec58c40

SHA512
8f838e69fab0eb3620c23718d01a3e3a97ffd069da23cf4eb89a46540feb231d85e55213b60bd523ada468cfc8cde3055342789072d496529bffb67ff97246ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E3F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit