82264757c77bd299488ccec00b6b8cc70065806d024bd6c411364ae1d1b3dec8

Analysis

max time kernel
121s
max time network
166s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fd71fddf0b72b7418441df11cb21a4d.html
Size

12KB
MD5

1fd71fddf0b72b7418441df11cb21a4d
SHA1

b0417cf628b6e8d8fe6e5bf100b0f07aabd4d20d
SHA256

82264757c77bd299488ccec00b6b8cc70065806d024bd6c411364ae1d1b3dec8
SHA512

33e0200893c25e770796219a192549dee484351cf558172b41ff474485be478ebc21ee1d08c736cbe9a12c0829ac91e0da4c726db3a6a1b4cbe0585e46a45f10
SSDEEP

384:Jz7G1yX5ld6rTyv6Rb+nQKrlibQmYMH/pMF1E:5v5gyvCAdhi8yfpe1E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02cc3a5b937da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409729178"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000fcfc0e06b3d404e4a424db694af729bd8bb979bdd96fcbf8256ac3e38c054433000000000e8000000002000020000000ba51462dfb0ede58c3c59b3d0545029c34fa569b6a796a4e47f727e79bdcf9d4200000003280616285b57e7e006538cdf0c0adac8eeba8c44f0600b8752704b0665180104000000042a962b0302bd958ef39235f627ae7255fed6dfbb3558330831c779dbce0b245e7e2dae6dd21d5c5819ee364e76b5df3b3972c54c7240face1a1434ede82085e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006b40bf85aae27bcf32084f43105d78734908b85255f1d034f19cbdf6c0291676000000000e80000000020000200000005eda02c1b5c8edbf59496be0e5cacdcbb2384c6fa5b79a2f8a8b2f1cd463a4c490000000d8a2354e99bcc5f0e2c6b6c3fe8f43b3149ae8dbdba57b5a85de682179770db74865b615d1e8e0cf0834b82771f86d13aadd77dac1024193d861e7dc0cde56ee43a95ff2885045e22fb72878e9b1cc78955dc3997a232c1eeec5e895b8b4a443f9f94705ef9bc2cd089be1d7a04083e239b226b6e85c709110a9539de991c51924198be704892250f2722ff90eed684340000000cc678b06e5f9968469dc7f80b1074d4aa76fde8dbc44e52b60cde62a384125c28fd006e936847092e094a27d8d6e9da8b23ca5814214eceafa9e2b0cadbdd7fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB957C51-A3AC-11EE-93E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2744	3016	iexplore.exe	28
PID 3016 wrote to memory of 2744	3016	iexplore.exe	28
PID 3016 wrote to memory of 2744	3016	iexplore.exe	28
PID 3016 wrote to memory of 2744	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fd71fddf0b72b7418441df11cb21a4d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27288e7c83612158202fe2700d09ae51

SHA1
e71be628681bd83d483d903ec52e1d090d365960

SHA256
8ae99b64bb181aa860c822a4986ad1ccc049642473daa01ba38bbd451ee89384

SHA512
adc984f14467aef4a8ed5ad20ebec2053f08e80bb72841aeeff3bad8e7bbab5a78bcc56b7017eff851e7230f17894ec79f183d7885962a166a03dfc6f33733f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87be0d6264897c5174fb1cd56f5d5baf

SHA1
d636a32ee855e01dfa8b27e367888842d5bb087f

SHA256
70fd1463df5d93d511148f086ca6864eba08beb4e4d30f628be00fcc10e09cd2

SHA512
07fe2b6ac9357d0af51b05c84bddddf247ec3a5192041f2e5d115bf97e49ee5d24d56bb75b73681e46d3c6d4f34f928d94692b722b9cb34a9323265d28045f4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2540836fff19b6995a01761ef20ae677

SHA1
90548cded067f6701da72d3c1c58cf98cb7773bb

SHA256
7696ceb9ebcf337252e79e0cef67bea084a3da85c98bf4d85f276b1f4d7eb1a3

SHA512
335984d389972425b342cd2772fd2f62fd5a8b42a23434e3d51bbadaf9c99afd62e08c2b98c2532de16012ca0689159897c78c5f34dd954619119d5a1150d3d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b452e73b4df51c4bebd7c1e079d96a1b

SHA1
d0edfbc80dc79d9975ed5403ebb4584c246011ca

SHA256
7dbd30a11fcc75f41283543f9914063ac6051b47a103c09149406dd986c15ea9

SHA512
895c04c7b7c5d5aab08fa91415cde1cc39738ed158b575bc87b85cbeb3f3c16ad0c6827472f646b752c96b46fc25bce4267aa632af67417096983734df8c6b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eae426ddbd5cc69a3f271b6acbe87faf

SHA1
74db3f30f27782d1a6ce8920cef77c84b9a3943c

SHA256
1fd30c327902feb899627afe6feef9d2e81b978545479472aabc195fe6eea0be

SHA512
c2906e32d62e082a4233888a0eaa88aeecacd3b921bdb0280e332f0e3d519938826d9932b2ad3302a80eed3a11edf05b6429794d8a7377ff11712682245780a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69c4a6ebb199d506e552ce0121e6ef62

SHA1
6153835d22a9b2d1c28ce8a4c3e7a7ad379060b7

SHA256
21d302e9eb4df645e88da6d6e71a14b9efac2fb9ae0cedf959410be63b719532

SHA512
266ddcbb346fb6eebfc0735d7aa9c581c951bec0e24f760d8e0103d229933f3062aea50dac7bc89c8df6ac44789dcbcb672d93f295be6c1f0feb824844855ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1774f6cdd776f2aacc1281cccd2fbcb0

SHA1
4e2403b1c83c3aebec55f72aeb5876c674bcbb5d

SHA256
2dbea8edf12820db306eb0625e301d6b6c27a2b20ab72d55cdbfac66ae9cb2c2

SHA512
40ed336e637f83faa60e5ec5636afc6eda788958259faec030c5dbec4e63ca923912b498318e7fbe185ea1ef9b529941c79ef12fac8d89c15c0cb226606349b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3f55856d11b605b6ac36cc91da42341

SHA1
2783e70fadf4056d6b26cac075170d6a7fb298f5

SHA256
269accb5afcbb4d318dde13e2a596c58832e5c8156b74f7df419a78d7a658a56

SHA512
f71be06c0dd1b2edf30c59c401bd9b4586166dd890e7c8288031e5759682c16c24d7b4e07cee9c8ace327a7d9d8e4a1c6180e01bdfa914ce24f09e3f98873c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a13c084d88e9bbfb7e073f9d79060873

SHA1
e6aa5ac796cf2bb94c3267eb8e61ab3ba0b474e3

SHA256
abe7e037097ff97ed4553469a5b99e99c1e90d31dc787fd74fe0d23fe68e3035

SHA512
14d2965f2eb6a314b71a32ccd7599c9f0007bad7a659c0279065024cd41bda9efb40565a994b729c0fe18d408bb9c96313eabba391beef9e6d46adbdc8b6fc6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a919afad0d5ce2cb6a117218c04fb10

SHA1
431003c3b24f2e3a21a26e87ba101b960ad1fd83

SHA256
ae0817d730563fd025c08834d0c051d857a0e47b403db8ff8b57e6f9629d5a93

SHA512
8c4f736a5d044ff780847818bc6e19416266ed5180f28c91ae6a6ad8209344433b3a8d65e3bad686d3fdcedeba88064a511e969617d25cf55f12ffbd18ff990f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb71f62b692a4c576e26b35157939a1

SHA1
216c5798e363689f700ca00c782f4878ea8bb0d1

SHA256
8349d2fcade5ef1f47e4d2921c87a7f2ea4d7979ce774cb62643015f55a1c715

SHA512
e69d846cfc48f9749c029e220d8dca0132ab213efc60d3a615ceb157999305b0d2880bdc99b7c729e1e7bd45a307089ed5732ddc4e69c7c9c2205e35198c807e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar88F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit