d14f1ebb3e9e5f840dd8ed9a8b054840940dc47486b4ed4f842165af6adeb3f3

Analysis

max time kernel
112s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b8964615a7864bc0da2d5cf475f4769.html
Size

133KB
MD5

1b8964615a7864bc0da2d5cf475f4769
SHA1

3a9b118f3f761c294b39174f3beb809684055374
SHA256

d14f1ebb3e9e5f840dd8ed9a8b054840940dc47486b4ed4f842165af6adeb3f3
SHA512

a35b949adf0de08490b6388911af8b060a4574c92da4d6f3e6957f528c58e7bf47a554481fd355f9ff16b83e59c213865182aab36b2e55dc1783323d04303156
SSDEEP

1536:6Ol5c/KyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:HgKyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409721121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BCAB871-A39A-11EE-8383-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1056	iexplore.exe
1056	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2684	1056	iexplore.exe	28
PID 1056 wrote to memory of 2684	1056	iexplore.exe	28
PID 1056 wrote to memory of 2684	1056	iexplore.exe	28
PID 1056 wrote to memory of 2684	1056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b8964615a7864bc0da2d5cf475f4769.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
264f66fc97c2fa55822df4991f28a6f6

SHA1
06b181ca02c9eca6e3928bae2dfecdc20087847c

SHA256
54ebfc3840fd212948693076e4f9ae02108eb0a673274feae7da06098b283182

SHA512
f590ac3e71681edb329515bdd100e9b9c89b22d16fca1b5f19d89de761ea944f30cd9a200c3087e7347d7393562a6f97f4b3c5ebdb8fd957327b577afe92756c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c5ba6cd69f7e48a97fb079a38f050e0

SHA1
052511fc424d0d508021867e0c227a52ce960426

SHA256
b4530e065f6e104e17628199731d8bda7d625f2d47b29057fe37d45f29b324c4

SHA512
52617ac8bc27fbfde0871cd4129ab8d21ac6c67a1872e13a4341ffb97dfbcdbd5b7e8afbb3c13297376470efefeb93357fce23f63ca121954085fdbe8b4ca1b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e3c9d6caa8e1988d9d59d7a8cf9952a

SHA1
2011778c420b47b66cf90ab3c0c5d1abd9e36e26

SHA256
8a21752461404ba38f2541c6ec78348808d53cc370b3fb2af158cc906a888a52

SHA512
b9aefc299cac9293e68e1e958b5f0a4af1e3036778dd130e2a1a3a61fdd48aadda572be628b98949faf68947042856825d6afb76ebdd172de60be72b777c7f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1fa8dd8e457b172192a0f95e7c7a379

SHA1
a549134363a8541d7c5a5e26495e09df965a759f

SHA256
9f613330383e8e99126cd588db61b41cefb63326d3b9ad29a959270a8eb7ce30

SHA512
bf1851506efa41ea020f25a133067d1d2b0defb60659683a67d6d62b79cbaef30e659dd2889ddb00691741bd7298b45ca67875f4589373bbef1bec5c7d221f17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eb41c133d8c8dda95f2fe1d99e26bb7

SHA1
3c72a571207bfe6600d05d6d8057c2194d1ab523

SHA256
bd4d740b16cb3bca737ed87edc8c0af059a330d625ed31dab00d3a33786976fd

SHA512
dd17825b9b40f4862e772284fc423898d579fa3cdcad5d2fea5ca825410544053946988e599de41a3c3e0e708697b2657cafa0aa3c1f9c39df02db8af135dbbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f50f3978fd6793fb1a9139f8f68e972

SHA1
a5de29ada2ac1bb9619017032045279f5d5b81f0

SHA256
c21622cbc7ac08f586b0713475a50dfa877df4e712cc30838b4b20f93b602898

SHA512
dda63bf60f47b547a43e9de3659bea12699c5bc2184834bb033a65759193a2a826a0c066d987149d59ac234f656afa07154916b0666639e4acc56c3fb6e71de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e23e18ff6dd73581b42888185bff1b04

SHA1
4738703426ad4faa97a46c8c600690edd3881131

SHA256
4ed0bd17f581764e6d96cf2f97c7a233e863706b82503796ec24977e8d3d59da

SHA512
62437a616f817bd6cb022e7424bc2848e9f1895cee77571568146861d303afc1e9e31fcf7f8ef21fcdead86af42d63ef96566dfb08e28b776510b3d03a75b14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0ef34d2faaef32b46432a4555c6b1de

SHA1
d9f2d35e26ffc8d31c3742842f4e02ed986c6ae2

SHA256
3638d644c6a9b8de841db78455b161ed33c93d3f8ab185c1d606a2469e14f72c

SHA512
8033236a8833d18b343551cefbd632fe496f061dcc3f787c1bfd1b13fde9a0df23fa741d20199c7dd57fae620d5101b6c1f635995174cab9e1417509ecfd389e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1eac4179da187d7ccd4f41e10d264b4

SHA1
500ac783957bda5504cd2ba6ab484ded1fb5bfb3

SHA256
c16bbeb6aa9c4059fb54ec499ebae7d901107abaa56d40935c6e2188e2140276

SHA512
980588845b33c90c5e98377de2a127fff6a021c07c7e9a1ff4549d8dd31ec0292d0415f4a05d29a2b0e4db24073fff09e5d68bf11ff78724a6859fd8680444a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad8f3f8bc5ef211e684f84e53f397c2c

SHA1
658cb9c284db29476483a5bdc8246e6a9aa16965

SHA256
3ed9bf2f83e899155e2e6dfc007044f2ee84bff1e691ef8219361805b1018735

SHA512
15dd3aeb4acd2fce6fe502be16256ea0d2704ce5fc2e50cd5c53db93107fc5586d8b6a85bcbed03664796cb8ed271e1f135ad6e22b333b6dce99fe36ff582649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
552d9a9dbf7122c58dfaabc0c55628d6

SHA1
913b3c6e2b52b1c44bda151318c6ede3de031287

SHA256
c6baa78afaf150f7f174c2d95495720461fa30f8ce4d0645e6707f5602e94e81

SHA512
68bd6fad0033496a9b817ed4dbfdacb03a8160c41d77730d7ec477a87fdb65cd37163516e496f6d5ac21d35eb4ef3bc8fc5815b166828566f760cd19d490c6b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6822d1ff724a78f3e61bd487bd8dac9f

SHA1
a2d6b66f628258d49cc65605c24aa1b3e11d245c

SHA256
74c1fd913815a176de5f73b1cda54107c3e63360377d3c2d68c737c376b2915b

SHA512
8a7f0160ce1b4481b9df788ef85e3d08c637b11d020b1d622cf33c46a34ca8e09c84d2faf98c62f921029a1223b17d28e8ad77ccf51bd61672388195efd3d60b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f34c51d3ae3900855742566cd29763af

SHA1
474e1dd256c20e8e452a6decbd50debe6787a44b

SHA256
ab95c6f1385273b6a106b549d4bfb553c355666f320477c48860bbda07e22cc2

SHA512
57f140e75fbc6b60f8ed4ad1ef08889004c3e05fe58033952de3f578cf78b160d2e5ad3969d9031941f0a69d45c5904a846f71e41269bb713b57eb414772183e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cc86ccc1312640212b050305f2b84e3

SHA1
aa2eaa0aebb619dde57dd4eb73c4cae4d2fd840e

SHA256
7b6231159b97aa1361ea3d16c2dfe57bf51c025951ed4ca5b59c7700bb1b4790

SHA512
e48fedc8b96c3c026e3d6ebf710db1f8bc61e4d0ce5dc24af43307d53c4c9ffddacabf7b55cdabf0ca416e114f6df46a87c69cd09cdbf40a5f45d74ea81d1d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c43c21a9711eb38cecdfc3a06fca69d2

SHA1
02f3618ddcb4f49e95661ab23009ab4d8ab30a10

SHA256
cdeba7a0061bf8a150a3fe0d5e0a89b6f8e43486fa821937ec5cc9a4ad4391c5

SHA512
cb9c96a7518d89c68cec0bd37456ed91b1c919f0ba50c4573f1c7fc731e91313d97aa65089879ff6af6f3ad28e5227aea0d0b5387649335618e42facd004629f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b841d29fb52c6a143f036d08dc1f4b5a

SHA1
80ffbd021136d36e97df67e31d8897be639eb02b

SHA256
ede753fb8556c197e9d5c14a06caa6d440374ca818cb55d8f38fe1b8298f0635

SHA512
c76e53db3d35ad93d648960780da8d83fdb4b9d7d4362d5dbeaca6a593842e1d0251e7be0829065ca771fd021f2979a3a1396f3200d6b536ea5a8104709588af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1ee21763b1efc96210ae53502209708

SHA1
bcf9ffbd3a3002639eaccc2e30c5c0124e46e1d1

SHA256
cea0074629766eb6ad904c6b5b6dea7f5f54138d98d56cd10410ffee3c0c3972

SHA512
1b49eaecb1fb1c5c8619dfeb952c51a98a77ab0215698c2cbfc7231cc0afceea3883ef0132d77167e4ed6b360c127c974700e0091ae401262fc6e055603a3a57

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit