7912620159b74d413a72559a71243b4ed99d51359ab666cd27088edd067a58c9

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a3afedb4f493d7c6233a6fc128f3383.html
Size

36KB
MD5

1a3afedb4f493d7c6233a6fc128f3383
SHA1

765d494566cb68a904aa6e1349985dca6821b621
SHA256

7912620159b74d413a72559a71243b4ed99d51359ab666cd27088edd067a58c9
SHA512

70e4545cbdde5ac4afbf99f8f55a40bd9d6e88771ba901ceef94f5c53c196e2df05190cdf66313a8e64980deda1a45193cf9b797f54aaac082a00ee73cc5489e
SSDEEP

384:sU8WcFpFCFHFEFbN/QRMjw1bShiIof669f5/U7nlCT:s1EIoCWU7nl+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003c09d5c5cf8a6c442a83831f8e37f85bc9fb2c5173d3d30822174b676d1a8678000000000e80000000020000200000001ad8518b0625301e5584d68aeb8501925ba336b1c3d3f7e1ab73a45aac959f89200000008e8c4c96245e569c015bdbd43f3e399f4c828bf39db492617c3a87ef15aa863240000000750176fbb715d82744bff6b46a5a1497b4ccd65f72918587ceb8b4b589b50bdde186f54057723e9de55157f9ce24f732fa1047710f185463b2ff4d1428d4f961	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000c995b323fc6d553e92498790781ba955f140f1370a97b8721d643dc2d9f1a16000000000e8000000002000020000000361c9ea16cdff61b6a72287df3a30605b9d6fe588fd6a660c13bff5ef4a934ff9000000010a8d278ed2f9c9897879aa7ae89d67297f56c7f895e221dd3b8c6aad07c951c384543e8d1fae43d3d8834f7bab8a6a20afa88d1bcaab1f15764549f86b0f679157e737d07cd4262f3a4e52065dbeed46f35e724ad9cf179187aac229f8d57dad58e28ae2a697eee56722d38ca0bfefc096765da5c884c9c7fd39a825fa8b92459c46e2bd24e1fa278395ad7ae53defc40000000dc2e6eefcabf842d9d137d9c11ab890ff80d13dfefaf8620fa77efeda3954229753b0683354cb56dc04beb72994d3069df1e1c34c6dea81e84cea3bfe73e49c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBCF0E21-A52C-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d207b13939da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409894128"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1064	iexplore.exe
1064	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2784	1064	iexplore.exe	28
PID 1064 wrote to memory of 2784	1064	iexplore.exe	28
PID 1064 wrote to memory of 2784	1064	iexplore.exe	28
PID 1064 wrote to memory of 2784	1064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a3afedb4f493d7c6233a6fc128f3383.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72de79425e6b36029dc0a0aa7b89c45f

SHA1
10e01b6d6ba0aee889a44b2e6bbbb8deeda798ab

SHA256
7d446feeffa51d68cc0b3b97fafbf1855276bc9f8de9439064e413a1bc37c8b9

SHA512
c5ef968f08be8cf62d341a470b5565960f155cce5d664a4724d57eab957c2e7d649d924a3a7df5adc09829780db3301aa8616db8d4163a6eb976299860fcfe38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b0bd1d698deb395fd2fa74eba794bc4

SHA1
99f6e19f9b58522ee93ee88156407d11f8526956

SHA256
21b6095649b9d0504debab12727e7594cd373c6ac27c55a24c7c9bb06a13107f

SHA512
7c601e492de95f68258205d498bc8cda310a628ba99ab21129e98317ac66b202d26bc5337e95ae985fdb871459eb1d6fd79dd2fa448fff564f50d3ae72cc3e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb8df34c9be5c9dcbfba14e97fab0b7

SHA1
547c2f3ca0d39f9dcd5fc955f4cd49fa3db71dc8

SHA256
568b64ac6862e92d851e68620dc02c78b6761eb9b42c068cef5582712afe400b

SHA512
b8fb76c769efbfa3c772b32abd0685eb4c977638ed520409c8490008090080119993579dd5a9ca3b7a0794e4716e7f939b58a7786e8661d040702793ae2ad69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f132066aaa16c87aee9bb3a90faea65

SHA1
93fff34b80023bc78389649087b7d156be3dde34

SHA256
bf132a1f049a3dda21e9d7c32eb13c6920f3fd98023fe8916d2c2314cb0ba2cb

SHA512
ef7aa8a020a01818e1aa9e5ab074b4dbf3f14dcf146215e52979a7175cfecf574f81f4a05f5f69120846ace90e5abddaa8489f25d79787b97488ae9946974f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aad0bbcd405088a79354401dac8d52b7

SHA1
e35cb9126a1d7d010bce0e3a374fac52f53cf312

SHA256
963858f62807a1c7e57c729ae1585144c56b9ff20c6f24230d04364d0f3e7d76

SHA512
facede1a87b8e3afc117831ff7041a6dc266ce2cc882ea96896791318b8d0a12392d900de01eb02545e8f654ad60e93cb79caa7dcfcd5354cdd303f44397f4e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc0511e7c2815189eb1f56801147464

SHA1
0e26712dd3105041f1c97371bef88d6cd3bc4ae8

SHA256
1c2db3cb8b5f726aa857fbde406d39c14d1e45422cbd0569791ddb1eb1077422

SHA512
1eab87383c085697e86dc1d7e6d3df7ed04ea1cd56e619b567058c0d6bdb2197023eaca1a170c442e976d018f40598c40ce78828d5af945674354aadc30dc8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
512c7681bbb3f664c58d88da55c84bcf

SHA1
f0bd9cab5dc3aedcb2bde34dc2187b9d1232a3f5

SHA256
8ac6d34cd142a3a7c38393d65fcef8d305c0cade6a2477542dd73ee8e96f4203

SHA512
aa7375f07e6e0b70b91904b8e9393533f44adc7671e8c0216cd7e8d367db18855a397cd351ad39fb9d190fd1d2f41fd85ed9f20d9ef7308e906eea5ea14a55c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f94e6656aaf691aef675081693190efa

SHA1
f46e895684bc3b02fa902bbc3a81b97018a15db9

SHA256
5f0be82f4d2c22ff697660fd2df67782e11b8e069ae075844da6cf3589a8313e

SHA512
2e0abdf9c84ddcb9c76be5e86565d5c54feb7614ea3c0fc07404b39e4ee56a9cefe80a1af0130031604efc6fc53f752811d15c219fced708e7f6c2b9e7174b2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6498ccc24dc56b74bb7eeaf2c308a49

SHA1
c5310489b04d66aa46994ed44861f9c34fb02cf0

SHA256
3082699150c9cf54766ff9de216de5923e213b5909d9c745753c8872141f05c1

SHA512
17e8172cd13f02fdc1afb734abcae5e1f64e5eb8a2173aa1c9dc38bdcd058c7acac21bad4511c89de0f21c72e43d11433c5f112b6c492ddd68e5bbb2dbba52f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81492d4ebb6a9af35dab062b3dccdc31

SHA1
25b49ac5575e69ce4a1a48df47a24b13d2ca300a

SHA256
a10b2b7744978369036d99480bf46d62264351d656793e2888240f1ed4bdfa4f

SHA512
d607de99969c54a89f4dfb3034ddb13740bea63c13a179d4474ed5382f69d1ef08747b4f9465ecaf07a4a3a904c758b47c65cefb8c1ca9e9c49b772738ebf93e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b40e64b87dc5f7ba81b53e6df855bdfa

SHA1
00b5453ad012c4312d697fe00f4166428ac14e4b

SHA256
23ea3835e7f2300b34595853c0733e4429af39f1639a7732e87f2a4857ae871e

SHA512
fce35ab6ebe51c8481ec5a115206d938598c94f129d9652688ec37b44447a1d822027a039bced7efed212a75da8c81ea63e4d275d955af53ae091625f6ab1e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3219d609acaba9b04e0d28b3004e39fc

SHA1
08accce639c2286a80c0d38c96fc66766a6e3beb

SHA256
88a9e12d1344682292510d141bbcc6a631be7cfeed0f5cf9f07050403ba06b90

SHA512
5d7443a4976d393b703a0ffb2ea784a632dbadc39b1aa4edec883d3137fc76760638f167addade0f89ea6201ca78b6d896d6ed2a1046646479d409a2385efd56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4065c6f9cd257d92422c3f09b56b38f0

SHA1
73f0b4c026dd50b04a75fb78bc56a9e2bcc7a05e

SHA256
eb9aaf5c754e1fd5883dc1eea005d4806e5f2c88c35e4b4bdfdc79a47028860f

SHA512
e5851b82cdb5318a13540a4cfee1b58963f20a7190104fe58574797c2644c090d591afd5d67733c2df766a453612ba6337dd18fe04673c076aace1b8ab85f712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c28107c3269fc759111e5e6e092f368c

SHA1
3db9b837a81fa871b46c291cac333ed2fda9b00a

SHA256
24a8107a89c4116f5c270f5b020e25db4a7fd036e9f569f6d1d7e9bd32a221d9

SHA512
b03e7955b660f279c8892bd839ac65f9f84ce64b96ffbcf5f9151c3a22f4c07991915c81f2620d2f5a53a3b9e225d3be2d25406a4a6506deedd1180b39ec5b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0af47463a538ce5339e5221ec1883db6

SHA1
2894f38deb3d11a33da035e9c818667387a83033

SHA256
953ec1f34d08a68057c15a46e59ebc852368253c008e9ecf0b6ebbead45a4893

SHA512
a7cc16bd926e1919e54a73c44e256b7248b9568f1d95ba1dfcc803bb956d7a86ae7c0a15ee287701e563ff6f811af1415df7b6f8012459f54f70cfc7a2b3df43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C88.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D77.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit