99639e05b75350b03c9d89b8b428c718c3611553145da122354364c1f5c8fc46

Analysis

max time kernel
140s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b2efa641c248deda1a3b7403dbfd298.html
Size

430B
MD5

1b2efa641c248deda1a3b7403dbfd298
SHA1

106db4973989a739bd41b9958f974a7ccd694239
SHA256

99639e05b75350b03c9d89b8b428c718c3611553145da122354364c1f5c8fc46
SHA512

00c6f00a850cc7425791401bf6d0f3e2fe555f0a774c9b5dd28519daa81cd999f0cd9398018ecb247dedf95c17a74a047260ed4734b795b907660fa3334eee34

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409720549"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5187721-A398-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e008c58ea537da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002bea2230e743ebfb333f75e9062b494fb252aaa1ba7bfb43636d784d82e76aea000000000e8000000002000020000000416f1106e1923afce80365bfaebe9690a3ccf959fd36f5c1d36d4b1109af71d690000000532dcab1378a6dac9ab5fba2d5544dedbf8b859bc24aa72630dde90cba10d4634ce3c3bcfe9b08450b1e9eb4d61d833516af6f85502e9219a923a63da8485f07bfaaef3b2f4c87c04471f1e6e2f50ed88f8d580947b717fef995b0661237173b6d3c1d9c9f73e102948ecc826de7a59c10bc45711ff8a63f9b843dee12fb25c8d614d97bdae1642d96275c125ec4be4540000000ae453ba92cb68dce7a663b0e68b887a1577048c2d5df4d0010fc3974849b44f3b50588796e7985880f4a50d3c69d5653eb4193ee1be06dedb04a503c7b55359c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005cd328ccb6ef35c17b97d092cae43e553bb8298a664defd474778a7b0abd3b47000000000e8000000002000020000000c52135de3f9b61b7e4077086026a33739ca90eabeeb524b2678a6e38c71684012000000005aadb92cec17a4db722d3536524ed9bce2ca493345f1aa2d0c45a50d496c4ea400000006a32c3708cc16c6291c40b81ff28a4586ec311a348d2a0b192aa56e3de2d1c53b031212ea518a02036e2f9e468b472b663aa41267e68c822160eb52444143e48	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2080	2164	iexplore.exe	28
PID 2164 wrote to memory of 2080	2164	iexplore.exe	28
PID 2164 wrote to memory of 2080	2164	iexplore.exe	28
PID 2164 wrote to memory of 2080	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b2efa641c248deda1a3b7403dbfd298.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0ca5be6a958bc6216707b83b87c1877

SHA1
8de42e74e6fef3215eea11e2a4111400b070fc74

SHA256
3059f21731d0933885708fb16efd0d6d90bf9dabf9787a565cd3a5b65e9d3a20

SHA512
f3cb72e1f5c71314e320b9f6175313f733280b51dc53c261b39e71bfba723c47d48643ee9af018c7ed7745a3562ecde1b5388dbc901c88a5c1c41c6f277a90bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e04b79c1da513aaead6d6e1be38fe18

SHA1
817220c50408747bc173a59aa9a4b1a7feac3884

SHA256
5cd4c437b1af8d7879869b7493c7ea0dfabe8a68a4debdacbbd3e21fd8d1d085

SHA512
17a637c636a6b484c0f8b1b26aae64022b14a11da9fb51b71fba875220012eb928485c619341d6522398106dd4e3460e1347d6130df13d312a5e0dd07f3868a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bad5e5bc913f981527dbdad192fe7312

SHA1
e5fb7fa15f8c987d348102afffefdd15df7d5da6

SHA256
2bb1ad481f75607b3d2f309e16af1863fa8b9ddc5e7ea2d8ec095d98669837ff

SHA512
88a14a0e04d849cd688307f6ed08b71f919e59b2b288fa22018779216175a2b22a21ba4774baa9c68814315f3198a4ff9c0d09dfd246a3c6c056a61816e838f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17792d475b1e621c303ffa2d019e2c92

SHA1
3b432d2b9b52ae6210842f93a6706d1480e8317d

SHA256
420e935ab059b7bc85fd248015c52aa48caa614c21bd88cdc6333eeba60dacba

SHA512
59875283e1f03d0551a88ef0aab23b500aa5aca67c596192bdca050c3b3dae2e8e5a01bf952e78993a0fe867fc34ee4d7c48cc9eecc99d79bd11069b621f8a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcc476f1dbe181facacf2feb432502a0

SHA1
6202ff56cb716a368d4ab4fda704cdbf69c0de1a

SHA256
9ca104c63bb25392300005868b2e24264be5f3386081693e7f09746709e2dd19

SHA512
392a4e2cb9f4588cdbef5f98403618a90bbcff072d1a0698675f52b745eb1d848ef56ab4b0e1d1c8312bae84adb8597770b9672f14075a5c93db6e3571beae6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ebf2548bb064d6666a7bda364de9009

SHA1
555fad6feb4e697a95e15629d12c5fb19bd7a8d5

SHA256
bbcf2de6fbbdefaaca48393ddf0d1f36cbf498837f5a381e54e253507b8008c6

SHA512
9e7eb9bd007a2eb574c55df8052cd34d94604978207ed8ed1feb1de0560d39d80a2071056af318a7d98a2d24c3ac6f7dda410da2c7ee1bb48d945bab348c38db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29e1b09d18219c4f8cf062e6411f28a7

SHA1
209314387553a4bb4595141aa0bf8737e056a962

SHA256
1db646a94857bb5fe020bd54fdfeb42951654e8998d1bd610480e7077e103324

SHA512
a855a0bcf974720b35b6c0d6e4cd271cfd0a30063aead399bcfcf91521e605adcbf4b0d39f72be31d5d6644756bd622a4579efb69b099886123dea7c057622ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1744cd4cd0f3b60a270578894b30fe4

SHA1
d34f099dc9576d27e01d8c2f6663f87833839de1

SHA256
bf6cf95c76ded9cea3fd4c0fe43c6bc55169f2a37b38e91e1297a68d108a63c7

SHA512
eed71c2696fd50d96750811becd04b9c2a246b97d594a0d2e59526178c99d9751fdd33169f6c3b6999ceb87baf6681d5bbc58aac84eaef9bcc78a4ba4634c90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f82d2c3c24ffdf77b8153461b3638ee8

SHA1
013c10d4902b00e8aa143900db2abf541ba38520

SHA256
f8c9be09df5042a10edf3aafbbdea280876ae89899b4b728398ec33b9168b136

SHA512
0251e73b92a41ed8a8dce7420c0caeef24c7f12e8f212370486e6bcf8a2a02a6a9e3539a478fbf0e280539dde65df74260018d7720c6d0f2d66d083b986f4533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2b562af70f414b759a21a524a2b7b7d

SHA1
fabbb666ffb6ca64e17250d784e823c6d3c7383b

SHA256
ad6c165a61c331c00f630694a4d52b1e2f06d30720219024fa1cd7bee7345a2a

SHA512
8c07865a4434e0b741830d739091c6986b2c774ec19e14c04bc09a35c8e6454188312b4fa9c7fdec6658cb2d4db9d730e17a40b04606d6fdee0f7ee550498599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3bb5585d92f14a15303bfa87aadd78f

SHA1
2c4aed278efc36cb274fa1bb6bbf878f85044c57

SHA256
0328d315f314d6e67de9b3cc0a89328f718155ae0a1fe0a9544872ad0900ec79

SHA512
502956f88cf580096173a4665e697d3c74b580ab97d6999371d87fc6732eac0baa017492decb92db19222ab3a35b047ac1b4222854b1271a45c8c879baea4bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
357bf4c89dfde0e05c1aeae297b37f37

SHA1
18808fc7e0f5530df3f2a14e56fc2acd79e97b23

SHA256
72ddf73e7790a52b64bf3a6206e2435a59fb161bb72f8ad7937223e3b4452b8b

SHA512
95b87ebe59d2c8db6f6ed6b5f34bc68a37b0fa98969f803cfeec37573eb922d8b6dff7a604f3871d8a266c39ae39cff386a5e9146391c95fda020e04421b0893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab3bb8a7aa081a264403584113e392e0

SHA1
3293e8f0e2d6ac37cc0e972abe7a1502bb376846

SHA256
9187f19db513ee1b0af5401874f04e694b5fd499e7b4ebb4413acb9c3f35a0dd

SHA512
b3ede2def443ee613830fdf37b02f14effd55dddd86b33e46ff920ae8b84eb8dba408f2c409b51e99ff73d05c2cecbac6ce31ff8684ff12b195a982cafc0c590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c678e1d6afaeef46e06ad4b508f41201

SHA1
b05dc21bdb79802ed64e51b7e97a96e7bfb05247

SHA256
26ef0406796532ca2c263193c700dcfeedf8f55e73c469cc2c6cb98d5612d497

SHA512
52c94b77b7160c05d80226622a855ae6bac2f262064f7d35cd705cf39bfad5cef4a1f9ef4a0926e1bd5758c9351d8fa0b4da682fc5bfd1fb64241296bcdbf8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab85cdbd683087740abfb97b1a20ef9

SHA1
d776c31895f8d9d08e2f9e41a1abc9d2d8a7d7bd

SHA256
978c03d9745ab58f41f87609b3a6f5a5af593f6013df15ef752134a8e118f7c6

SHA512
7c23bac5ce868ece64a0e5c5b520f224922dab1ddd51888983c12e9af28c3875b7ae4a31b789ecef40e1726a2e5331ec520c9fb19fc1be4a618d275113ac452f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e761aeb79e0918780a8daa2a76913d7

SHA1
a4bb1a95884f2bdfb7e3fa38cbb234b3719afc15

SHA256
18b01d617578d926fa23373b662d5de01f740fb4430448caf9107365157f6be6

SHA512
b86927c39abd765b497d08e5353849046ef18593a1e4815e62e6202bfd553bc29f8c94a10d7b392632d3e0d061939ee679bfc86600def3d009d7285fd28c3604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f039d335ddb6475c8e825ba03cf42d8

SHA1
7fa778add61d5dd56ef066958f17484aba4c02a3

SHA256
5f7833d4ebf77fdc23aaffca578a107249cc23a42e55ef361722868c1e539d9b

SHA512
94137a6804ab7760acb48d1c380fd3c756304121135a489cb6101ebc3e0944838e4a0eb0a70a3685113624d757dee546f5223582b60d53ffa5e35a9550b80235

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE2C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE7D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit