78902860d21a4bed46623eaed9349cfc99dcf18693c657578472411fb7420b82

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

120d0e219642802ad0639b241e261023.html
Size

82KB
MD5

120d0e219642802ad0639b241e261023
SHA1

05bc94875ca16c91a98a57f87b1008094fc62cf4
SHA256

78902860d21a4bed46623eaed9349cfc99dcf18693c657578472411fb7420b82
SHA512

a4e730edafa99b39658424f8cdb086b452d680b5886785efc70e5a1897fe967196f158ba42952dc8303fb1976efc9312f9ef5762226278ee447362fb88e42b80
SSDEEP

1536:p1W8Qn3cCibJOGSQ8YbxXpYZRMJYm+X692fNqVzELA0tEiqTDV:yNnMjJx+3XM2ozmeHXV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409858666"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4988C531-A4DA-11EE-B383-EED0D7A1BF98} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800f3724e738da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000f480763940fecd2d7438f5c29f633a7b70583903cc45deb1643af731a7b4437a000000000e8000000002000020000000fbe9c51b1794e47a6db1d5786e7be153d847eb652b9f84c6eb3ba6f84644c018200000005c23f978afb0c0ee90403d640e71b08af1f7617c0d12d28a2f74ee333eaccda740000000edc12279dae2365b18d5e83bbad742deb8d963fe00e7710f2ff6b2e96608e4b864ffd7807cbbfcb032916204eb397fc322ac090441e2d29cee5bc902fbcd9980	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000003ce2d0c9dbab636b6dcec269cf48a7987854fa5e16f1236d6abf0c383d52cf5b000000000e800000000200002000000083073f6e50d450e22045df208be63b9182d35315ad91f2c0e6a47726ecd1dbe590000000ce28666ef4ea808ab149149b09086d8dca9e24b2d313ef993e8146b801c6928fa3305a46d17e1da5974d27fbcbe6a81d3068dbdc057539ea9b3053c370dcf52a3052e066766c1c307ec41085ee15d27a7c0cb5da9ff02d0fcaff6783ae99f623b4211ae881da66aaf628f27ffd2eb7e6714893dfc3084d57aa5d33659c5e62457d16e54894be4c165ba89a22b7672ee840000000046eb0a9fb2c9663b35177f05a6fb0055d4fc6d48c005cad6b0806056b228bb04d7078f8acc2caab310e6f0608ce0ff14be5a875b4282392aa2c8511a4c3f5c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2740	2500	iexplore.exe	28
PID 2500 wrote to memory of 2740	2500	iexplore.exe	28
PID 2500 wrote to memory of 2740	2500	iexplore.exe	28
PID 2500 wrote to memory of 2740	2500	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\120d0e219642802ad0639b241e261023.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
416ebd94ce26b24c8743008655e438fd

SHA1
d08e27c3b96fce49eb433896c6f841d42aa9b7e5

SHA256
2666aa4cc84500b97154901124da7722fd0ca9f9c864bc431b9d4aeaf260f8b6

SHA512
b2763415f564948b7e5580c066b9e42e5ada9ca9ddaefeba2c395ce972bf104c5d9ba0fb418d9607a83922c9ad7fd890b502b75a9aab7d0e94c5cc4712d1a352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f33e29c8c35098c2ec7aae551af6385c

SHA1
4d0f33ad5b8c9a8416bb481b9f46bfd3d6fb0078

SHA256
ce6d6d0d4508a45b407bd9c9651172f79897ddf79d76e5d57af7079708c1d306

SHA512
bd84a4f24edb1fc2e688ad42663e1386bce2e16e3870737448587558e20e6cb1bb92a332f8a2cc8eca442beae748eef444d274af19b59340ded31fefbe34cfc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e26b5ab10f9cada33595ffa69cd04dd

SHA1
95912ce0b7df9948b77d4c4d750c7457fc8a2d6c

SHA256
f1b7ceeb08f67f0b72086a08ce41e251f7be2c7c91c552567e5ec7d011ff594b

SHA512
11c656d179792636100116868d2ad4c0ddd79feeff2f26ffb9264b16759ecfac0e6863040e1c4c019df99908801d2a0eb9ac483deabc0b176655b425f4a258b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65647fef76fe6e618f96145deaf58e84

SHA1
4b9e952d8f21b7ce846db15655a9a62c919f8ce5

SHA256
8cee1c6d99910af6beeeb9cba1b25b78e49c7d9c48932a83c83bdf5d249a36e2

SHA512
67a9b441cac1543e049e90ede9e75e5097a10bf8277ed8150a36d454bc262be248c43a2c6054be7fdc6d47c627eb937a5cc86e392d2f5a0a0d9d0fc88693d37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f712602094bf30a7ce9629b003d6c8db

SHA1
89bdf610865943bd173fc9ee0ba20ffcac24b8ff

SHA256
4bcbdb44474bb75321f95f6f456c6573a66ef77e965678192688b48699c68f95

SHA512
fe30d8090b67f5e7c6f6b4ec3989878a9503d94ef6dbf825e4124d3dcce752e2ca23a5ea3f6378e540e5b152384a6880b79fe12b9f5c75d34595a8c84a6c4dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52807a73dcbdc509de8e5f8cd5cbc3d2

SHA1
3b67f03bd57fe85eccc466ac081abf316a3651c6

SHA256
9863e778fb321e61d842c5bffe7f3a7c9cee48d5c1289834138c7e38a3d4aae4

SHA512
2643cacf2e715256e4e22425f66a939bc21e724c84f2ddcf0616eb1683566a4e160aaeca84d9ec1d62f7b6ea6d44b6525f0aca504f1ad93b4397864c8c96564a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cb71e8fcd40e4ee32e0b403a377ee93

SHA1
41c0b0a5ae40e180b3726b7260bd6d66125047f7

SHA256
275b46192484ca6582c6497faa2c8161e42dd8afd283339b2aba82a2f4910c51

SHA512
3897cefeb10a74d27d871786a6f98251a607a2a0be6c648d74afe24617e2274a23b8f37b8ed084af4d02de7d96455c9523b253ef86c59670d75fe77f4ff85fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0354462247562adad686cdcbb5edab05

SHA1
a0e69bbe74860f4dbfe4d36669d8d3c61214030d

SHA256
4f266c3169a8164132e3fb7703bae6e5aa18e3845cdca69747c7bdfc27abfabe

SHA512
fa177afce388f623b331715145e29a1253afa38d31a92b78dfebe19dfe68555a70d32ba8178a422cfb881f92c8585d7f9200445e9463099ff7396abf9f1c7497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5956800bf88056da6e8dd1fe631e9b48

SHA1
84f0ec8c276b371b3d1918ea70d4a14ed747f23f

SHA256
5e522b9bc88592dbe1d703f80623e41350ff2d5377d647c857f2efb7ad658b23

SHA512
3ecf1fea212f8d103c1b420410556894cd95b1f2ec1758806d6d49547778dcb0cd27c3cd08274d6c565d1d509ab1041c38061e6e777bebb233de56708dfabb46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa1a742df94d76ca3b514ae9157962c

SHA1
07b51a7b6131f985eb2492548accba5821d1eac4

SHA256
51bcd00f67d1fa44df637e32a5d4b8017052ae76d800b33703b0b13e1b6e5471

SHA512
6c691f6e778bfa622e87c758525c80d17482c91b9ee963d7de0216de6a0e446f8ed050e0a677f5b83c15773e1f9d963a86a3abe671bb8a45fb152e28e0ec9851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0f13a0f293cae1ff8e00e13f2ed9c8d

SHA1
9a30e02b09c5a8bd775bf03559c9c5719800cc5e

SHA256
244b4a01b389159535267a922b68a886d2830a0cc21c331a4bf7cd1687fef135

SHA512
7e647dc3f253262753a711c21e3b4563f62708d1c164ca91a8e75754935e37dd8b725e18f3bf2ebc5ed95f85560b75494767df43492bcbcb369bc57ccdcfd6f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dccafc36e0a383446ca44244b0b90b14

SHA1
9244873673387992af3327f3d60dc63c077d3c6b

SHA256
e7ef4c7cad5b7adbd7ddb3340ece0fca7e6d9648dc445cb43af025a64497ea36

SHA512
43a4992d33239feffa38da30c97f2784cb0cdde29ccb4d45966b04d05851310c668f4faa7221b0ad3c048d3a30a8f715a74aeb066b5854aaa7b53981f2c08270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53f36de999f7da1d6815bb7a355d9b69

SHA1
293848fc72ffe684ae2f3ea939839e58e2446372

SHA256
b35803b8837cfd275a295ad0d6971e83fe30ff11680aeb0b3c430a77a1794725

SHA512
d0b9f6f7937824cb3b407e8e6e02032b989bbb98f3950ab674f3f02c2e1dcced60d8d7299c8987267b04b0958c107f0c102776b28d12bb52ca060443b82dae6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cd71fa7a1e2433a9164a3d30a40d895

SHA1
67a474022a6952f5ed6e77c149ae12777796915b

SHA256
34e536705f8a09ccb28bf139e1546af0f0f94c43f79a83f0e1adb0b0578138a7

SHA512
d44ed54ce077c8e82aeafe49777c47c758ef745a4e2f8c334ffb89f0e57a295d44017481f6bc7aab4b2f492c06566d41d948670891536a45873b62d5ef1b34d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9FD9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA02A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit