e75e42d79557ab0d53dd44440feee6fe4e08e7a3cbae814e333254b186fc63f4

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16d89c9514836c5b03d18ab005518fab.html
Size

9KB
MD5

16d89c9514836c5b03d18ab005518fab
SHA1

a4a765ffa02bc4845f596644057d68b6dc74a8a0
SHA256

e75e42d79557ab0d53dd44440feee6fe4e08e7a3cbae814e333254b186fc63f4
SHA512

b8b503f8f2018af16006756e353cc0e86653b521f0dcf9a6c98dcc41961119302e1729e4754ce190e79c1752a98c61d6c0f9577c50337cc14a028594fef330e5
SSDEEP

96:uzVs+ux76wLLY1k9o84d12ef7CSTUVGT/krIwT6pTFlVHcEZ7ru7f:csz76wAYS/crIygTFPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c15c01746509ab1df388e0fd6b89ce843533286da240b44f3469962d0eacc4b2000000000e8000000002000020000000ea9daa53af786e7081c909ba37cd3d7e614bda064501f80f167f895df70eec80200000002cb7dbdafd64c7894daf447fdb2859d540523b13c983ad6a0679dffefc3b89a640000000fbee1b5a492e1b5541896e485bc1adffd7f1f72ab2e84800e681864e9f36fdd77c9cb48e04f7b7bd8a7157d264d55b1d5525ce67be99ad17ad5c892dd715fffc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f81782a41fabacd8bcb5d0b85478da3419aa666a46c66283ea9b36bfbff09585000000000e800000000200002000000034214eb268667049d454f5b3cd7dfba0e01c29537e5757ba1635e2f19f4993c7900000002a3d89ed96679bea26c6e2cf937081ffd3bb9d01b4b40209ddca85c19594a0ee2724affbc3054f41eb74e36be087edfdc82ee77b59a215e5bdca03f0dea638b2b9c3c3738168baf01b35f6ba3f7f1c0d247f660f97e8054c088603c847f61790f2f6a3e666c905e0a8179ea263f358b919771b7af7a8b486c5f34e2862e90ec4a97f8e717c306b4c55f96cb96608eed5400000001a18321be68769e4da135f642ce9f52f2a773a23431e18018fa722f9238113b1b32a35ac54f640014d9a1dd8e6ea80245aeb27ed5b70640406425270d7aac29e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c5e5a69237da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409712439"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1527CF1-A385-11EE-B578-EAAD54D9E991} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2016	2344	iexplore.exe	28
PID 2344 wrote to memory of 2016	2344	iexplore.exe	28
PID 2344 wrote to memory of 2016	2344	iexplore.exe	28
PID 2344 wrote to memory of 2016	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16d89c9514836c5b03d18ab005518fab.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bf876ea60b1eec0fb8290ae9c4919ec

SHA1
08206cda98df12b984aa179e690d3c7a0f3cd556

SHA256
9ee4ed8405d67b5a2320a6e8af4440319175bde7e7caa82d70dc25ba81ab6f3d

SHA512
43ecac76b611bdfa3da978ec78d2e1e61572e2485b52406ecf20d8c0a9d8293cca0f7ed95b444f61f0035d53d2d9b7dd4b97d274ba77aa4db22efd00b584e172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
babefd7f362fe1948e3504d21f8896bc

SHA1
c0d34e89eaa937f99b2aeb25cc4b7ed3a50b91c4

SHA256
373c95acd25971a7bc81949691397c4a161aa90861905427a0136bb6505681a8

SHA512
5347b9829fad81e2a08b62f667b561da6a9f4dbd4fabf6738650dbd6e53253a31cae90f3e480ba5c41f2de14b73a837875c178781ad5929e041bcfccdecec1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f1b1868d4589f1644d0b6eb176205cb

SHA1
314460834403f14e32827b3c9801ea7e7f331d48

SHA256
4fe58ac2548286ed9fe1ee161a7113085e7371090fde8e8b637293887a2307ce

SHA512
73ca19ced727463894e5b48012d3fe148a5ab64e5015423c3ed413c66b5696bc6adfcd8c35eb34c719c4a35012d72345a5207f38fc4ff5094849aa69a64b3e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b8238221ecaf6d2d5b54ce55578fdb0

SHA1
2f24cd377300c90f874315043fa556d3a31174ad

SHA256
3ac8b4359742d0f56b383b17dffc0df4c4e9767a5411bf75111384acc0f8e474

SHA512
38f06716da1715c905855ac6eb31afe9f8ed14b1b8b1114128f77c4d3e1d983fdf6b9f64e355e39f75c0c12595be5420b0d794346dfea172fb97ac0d46729f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77b0602f8227622b49d67400cfd6ff23

SHA1
7a2378ca73017a3f481df60f3920a2c368f2ce99

SHA256
46ace141204690625aadfe26e09902ed2af62ec3506266a8381f2a67a3b91f89

SHA512
2617b72d04ee2f83757f70ffcc9f1070876917fc835852e48c58a514c741d7278ff68c0ba0686f388b35fe41b05bfe236cc0076ba5ce98d3e36a49fee4d7af9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf2cbb511d78a76d719731b03186e655

SHA1
a568cede4e37a8b8224f3c96e823cebe6d178ffe

SHA256
2163f7f06e10f40268739014a09977a9d7dd504de0e621c3bdabc68341489fe2

SHA512
60e548ada3063208c84a0e7aed3b80b4f19f5e1b9a2c3fb79e35d22732cc4b5a2e880db6e845963e238dc30db508beba0a9e87d5a68cb6724d6801a5f864b61a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91d90334d7cd15ea4d19ac8dcf1ba906

SHA1
7d83f40580fc44814ed8d939ad4bc5d570cdd047

SHA256
0e23cdfee244e44cc96c02325978c7facd75f3b9baadd0a9bc09127d06db6106

SHA512
fda63938d401b72f88af1faa965ebec9ad74c0c41cf934f13d7aa58d8dd61148aa300ddb62dcc5c3a14bb467a845cef4bb44f4b151eb60cc4ec08e8374de7048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3adad6c1daef842ecede814f71f633aa

SHA1
5d361fa35060fbb61028f4fe63309652a08bcd6b

SHA256
06d0dc6dbc9736e8eec207b1b29455b3615b5e68e0da852f138c59d9ea4a03eb

SHA512
c3e42498286caac954fe97051e88a5c31b1df011021f07d95ba064ebe5680a92f5b1e73989625caf4fbcef3cd554241154b4cd5682e308f26937fc9e4f121ced

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04936af63d88983e39c5036c58b85f86

SHA1
0119012c8878e78be1b40791fc15a5a55c02a5a2

SHA256
c97c61b076b7826ddb0c6293b457dd94b7c0f89da7a1b46543b69bba4817e740

SHA512
93909e1186f8844677462098e6ffd79909901f5b030c6fa5b8541da307d631065716402cedc6be0bf936ae2136ed63a45d3bc76fe4b38f4717ee0a30b7b1cb4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ee70fa628f122b404d8adf661ec231

SHA1
f9f5a9e25cb51705d28fd435676b13cb2fcb2145

SHA256
c228e2cc819085df3bdbe873f116341b81cfd7edbbdd39bcdd56fd08c55a98f4

SHA512
2488b2e57e2763d558ce4881db635a01876e0524aec9b09891ed8ea2b72e972eff13e054e7cc7fefdcac94239643c8e332ccc29310f932e7e04535e32c0fe7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d4d073965497cc7707de47259907885

SHA1
f093823ed9f21d75cd930dc7f5ab62c7ec893569

SHA256
f564d426804b6fd3a9306117309f23c1470d13b7a5371b62b5a506f8ae99f812

SHA512
afe5906334f9b668758ec3bc1468bc88e56f0a51a0cc7c0cd84ad164ebcc9b2cb3fac956ef1dd5b80c004eb5c5ad686f1e8ca360650acb0f237ae5fdf99c3304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae7e3ab116d8ecc2c496cdfa439e4f9c

SHA1
68e30251bc7e5b7e9cca8985305536b3c5d9b2fe

SHA256
4bcde7c18500d92afd4d82574e4663a15e188603698a136299e6d37be18e4625

SHA512
01f644c5ae6310fd79e5419a28c9f00510c0f379f5c6f0d92e53ee58743b2651e77a7adc38d6d785f59c2854bc89c840aa2a29f508c70cf8c0ca990dde3fadb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51784f2ff812889b9c0adc4f4c3828e1

SHA1
2a3670be5b5ee549b5882209cee9668960725f4f

SHA256
8eac06da437c7362eab5218b975554cfda95de14fb77b384f2496f087aebdade

SHA512
7588125eb70595211e5499bd8c735679524c020074544577e6dacbe0c5e976ea82c7e8bff1338ab4e1f3fd99d3dec5296e3930ce87c632990d7854ba842220bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3325322f85bd1c28a4ab0ab37bfa700

SHA1
58cc2d9d03cad40419d33b2c99c99856b17dc7a6

SHA256
a893474540a6bac6987b2be6103e29dad35995665280ce972c49c3b1e4a9ae47

SHA512
3bd7f120084a8fe90887c9db726bfbc61294b6de45663ee75d118e689eb0f8495b926628997197037361e93d3094ca67691ecc0833b80f8e82286a4b973772a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1904f1008ddccaf2b1b4f1f413502fb9

SHA1
4baef6086b771c25dca236cf4b6d70cc195c4a27

SHA256
7e126c4dcd7597d524de989cba76ad3088051b9728dd509bd5e26166c31325de

SHA512
5199002a44179b9c4c10fe980e37c6e72f4bd92af2fe34edb8af0daf67d1054b60158927fc62e8223176b368e3d9db8556e9f5ac7580f889b071531609b660a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab713D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar719D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit