bb5357fc3b5cd167329a1250c072e7c40551c65fd067e635e1499d25571dec22

Analysis

max time kernel
142s
max time network
179s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1768ebf5c2ba7f8eb01afdb9d0002873.html
Size

254B
MD5

1768ebf5c2ba7f8eb01afdb9d0002873
SHA1

693d6f7c9d590b68d166836e40f575e94542b29c
SHA256

bb5357fc3b5cd167329a1250c072e7c40551c65fd067e635e1499d25571dec22
SHA512

c94ee266f85075cffb0ad13cefe535015716b65a1b1c76058d985de9c74ac81f8eba6881fc1874243d2fda6976a21ee7de66197681457283ae436cabcc5f1f29

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000008180f0eafeb233b300b7a429f9d0a3112a4110cea5d787c9477db82a19355399000000000e800000000200002000000069a88c660eacac880a75502402424fe429a197dc9c3d3ccf9bb3232dc0cb8fc02000000042075e33640a6500fedc8de85393f1d8e63a552e5d736c87e046b31faea8b5394000000043ecf77d44d614736be673f4851df4de946c392978d58e82362040242a6d481e5e6ae5c04a89b21c8b04f4c0fc5fb976ad35644163a770c5961f938432ef0094	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001d661d14cf0f57843ff0b02e32636a1f31167453c8f8c8df0f7fc705dc477d18000000000e80000000020000200000002859b466c6c53b4cf3b96f74e0e5b53b232adbcf1d562aa3549a0fb49b1db8ea90000000abf666905113063d6ecbeb375709cec95026cb34c7eee5acf3183490adf033bf2fa3808b20292f8d56537ef352098e855f7df3451799de6908f852931b19dfcd52d835b6418a4c73ead7d4d691f32aceb0a0a989bc64f813a2963ebd1439ed47322121ad67d28be58f8c11818eea47befaf0fbc09016c2e408fad2a21a85d87ae712fe520e97dee795026d6cd19fb6cc400000001f294115b14dabeb1ab00d98a801188f8186f82ea1f279c26e8be38cdaea1ae1de389d54082a3fc91e90947e4475bb72177f1894d63b9fdc330313c494b0c841	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603cbb319537da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409713522"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59118441-A388-11EE-A031-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1900	iexplore.exe
1900	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2796	1900	iexplore.exe	30
PID 1900 wrote to memory of 2796	1900	iexplore.exe	30
PID 1900 wrote to memory of 2796	1900	iexplore.exe	30
PID 1900 wrote to memory of 2796	1900	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1768ebf5c2ba7f8eb01afdb9d0002873.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca4fd99dc586e76b80ffac1ad2af1ff5

SHA1
40ba338e28f5f09467b67f34d578b6150bb9051f

SHA256
6aa0cd076b8e54580d5e8d88756b7885d3d8953ec72d91ea3ccf0aafe9078c9d

SHA512
0c5eb6408d1472ad302bb8ff0d28360f56ca14ae886678e1813cfbb1326e9540f4995a91b639bc87c670df14584896b88f2df234fa4e818a71235cdaee1d4ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b5061b64b9073ff9ea64ac1bfc1fdeb

SHA1
fab1b414b5a09182b69a2e2b0b58f75703a677fd

SHA256
7df1a524323bb3a8f5518950e82d1da5a2475795ff102a0d517350cc87377946

SHA512
791759490ba3dca86558d57127ebcbd00597f1ae9b23faf0e5ee6f5e050da288d5a42b5f32eb25f295fecb3beda71d683d039f42303c084cc08d956bbad17aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f81f73553cc427ae77b0099f9d47a7ca

SHA1
6458bb50eca5bfac4f7fd1951ae97339d860a142

SHA256
e355e5159df1de2cc623bc86b4cb9269f8efe6671f7e5b37131057774cc0442f

SHA512
5622320282ed802c9b584c3815ff2b75eab7413944b0ccf5b23e69af691ebc50670c566ec00fe01708aea40204f30054884d81ef53625d07e6d8088ddeb8a0ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92e2e94fd86cd5ab758a93f64768e4f3

SHA1
6f8258a5f2a7e949879d1979cc200ca67ec479c2

SHA256
54b2b0002e045e10c76afbf16108fc78a08e250e843af14c759a1f50bab20870

SHA512
3f68b68f50ec270630005d5133e65ba5b50133c3c4559dda49cae9040ba436f1cd822d565132a92687f25f196ea63e01b936d8543143a328197e928c181494f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883a60d321aa587d02072e3212da2ed1

SHA1
d859657e0cfe1bf7d30874a4ae366462a81d87a1

SHA256
d697cddc821a728f2c426381adb828bcefe37922cf8d8130e04d8ddf49dfea10

SHA512
568d735ab59ea202d448253d9ad1088a43dcf6cf84625884a97ae85d5471db562a4a82f40ac35c22fbc22b40e85e0b3b31ebbd0d2e8b39a0042875ba52a44e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94f15d6d6c9c53f3ce51e1611909fadf

SHA1
c42dedc105e0b114a8c3003544ed80ac73345e89

SHA256
be8a21340aa9331f0246ba553c5915900e1bf2719cc3912df0c444e5f66ee4b7

SHA512
ecc8f754f43a7533de73ece459770d57c529f489b7f0a91a033d77482da0ef0828092a074d618a31cf78724b9e204ce9d4ff9878aa2bbdad025c7634488fbadd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73d2dbe7614bac219887dde0ccc80131

SHA1
0245bedc9a3da7ef8bfd0989fbe2aafaa033062d

SHA256
638b484f28986c7d96c64437f1c120b9de202a676d3fa02b82458ad0bab5d06e

SHA512
ae794ea231aabc383f1fd5e64ee5c3718ad81d0ede17cfe105bf0165cd39e554554d79667e3cabb9ce026b1c528a04623745ac469bcd97341f9ab8e2e8f7feb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e158d79dc8d8baa5aafa9eee0262026c

SHA1
bef625fb00e5cb46c141bdc1cc8c8d85c7bc65cf

SHA256
3fa1d2676b760c048535a2337121a766300fdbbe8c5e43f4334d822b360f8798

SHA512
e4e83f7840b45dddc616884e795e445b03b3cd640c228dc83d429f28b3feb3dc411263d136757abd87cb63d690c18971955f50fa57b48463c132705677841791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
853d1e2320b810787a77eb804def5396

SHA1
b65bad10032d5d90d9cc5329ee33ed3c60c3ec33

SHA256
64c977fd7f0df3628cdb3ea5f5c41af47a55fa0c37d766ae55eec7d6516f1dd9

SHA512
331ad8eac1aabdd61179321e1394bbc980c681a4a05258c64788d002f20767cc7522bed8ece5fcabb8521b62635a775e94018a4c5ba95640374e730beabef43b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad8ed9f4b11b97bacccba9968523d28c

SHA1
cba7c02ff8c7a2582227343b2c46354bdd72a4d1

SHA256
c1ce2e64e27cd0f4dab75ff5fc8c44908d8f86c1b6c99ca6f0b68d8470c2093f

SHA512
d05524be7f932a4ab9744e9820f178ed05023c5580964c867fcd392314f9ae28202b7d5844b2d3c1f8ac716b3659783608834cd2a5c43301dc63e538c176ee1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7554e877f7314facd073552b386c20e8

SHA1
c18245c8562ca2c43bd4550c126042d6972a93e9

SHA256
32e70052819f690fc0a3642d8f4e3b1bf06db76982bc31abbfaea02169334bea

SHA512
568c5eed88f50e14b0527fd09bacb2ba9a5a94eafda03f2982f32a5d416648525f7550c85ecff93e631fa484894bc37a58f940ef5ba2eac4c6247064e19f64a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
734260feaa5905157062370176232377

SHA1
42edaf79ec97224f2d9e639de57b3e59959b78c8

SHA256
b3ef294f42554c601ebab883507e36121cbd475470cf1657944b6cf16ae71bdc

SHA512
d10638324b826de368bff5c8c9703d0ea24895e74fedef81501a5e7b0609c24bf9e95e714ac8fe81d6efce58bd0c28e03e30aca1cd71145db2618c284f8d256e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee068f588ed9917f96e7732ba4bee40

SHA1
aa87549d9dc63f1e6584b1c2d71acfdf4e3f2e7c

SHA256
92f581599d49923a1fed30f1fb95f9290f134ffddbcec8c8217d298d6fa1fbc8

SHA512
1945ebb2027bc9e8fbeb63a0b0b44c38e3fb7d899c1d9e2e9ae7c4f334733a5440843cd837b97a0e08eefeaada1d8630426e492baee615fcc37ea22105b7873d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f642bcebd92181a83add97b86018e800

SHA1
5041b7ebe3d24092a1cf06c8a71ada59215e5689

SHA256
c0fe865160a5cb6d91de42eb80589ce32947a647d56817ef5ac90108dbe4ada6

SHA512
b4e7e75d3551d5a4c56d97081653dca3ff204322a6c595326a5de8f1a455adbb909b1e0977070bf4aa81d59469be27d47f75acffb8b30934248cf924bd061050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9694e88af8da3336c97e8515aa7c5d69

SHA1
4e50f62bf02714f0b62a8b1f51c1c3683c3f6908

SHA256
2552632aa5a3f5450873bed40689ee48756018395a4f549e59da43fff7c09387

SHA512
a04eae473f99854c3cc4dbff54ba606531fdac8a700aefed73c9928ee72dc5e4d2f45e82db114f0a10cc142f5016bd1356bbff6d38c45edd4b781eb3afcfd9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb9f1f359a60e1a2d7fec11cd9b83f3d

SHA1
4b2d249f4503e3f680ac7ba07dc9ef07edb63581

SHA256
076fd27577a026231d829f1ec1c2d9ee67c26b3faa47fb97902570635fc3cedc

SHA512
fd874ed720530df42f8f016a214d8257a726a93e0ba98f40e05fedf0378704f3183bbcd9be40c12ec98bdf4aa912ccd2f9463acac540a4a98e152eb12d3df32a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1413.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit