dcd6f3f7890ac726cd86fb2122df2e11ef23edf3681e42e29644d2c37ad48838

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d292d9fd587dd142d662693f217ce46.html
Size

9KB
MD5

1d292d9fd587dd142d662693f217ce46
SHA1

f9a274ea297ca4fec76c8ca322dbdb481b5ffc9d
SHA256

dcd6f3f7890ac726cd86fb2122df2e11ef23edf3681e42e29644d2c37ad48838
SHA512

f7b37e14671da0db1a4daff3902e7de9e9a0efc7cf824031051741ca2b59fd2e1325bde0c9a67ca1cd9ca4487ded66e83cbccce2f08f86e6215747bdbea329cc
SSDEEP

96:uzVs+ux7cFLLY1k9o84d12ef7CSTUHzfzx57FBcM/Nd/QeuupJxv+yUGyY+eCxYp:csz7cFAYS/tkjYFTXb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D43A4B1-A3A1-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003787b534f6c3d4b3f9bed7a48ccd6588c74be1b629a50652effecb98b71ceefc000000000e8000000002000020000000d395806b6f3e7a160474af07f32bb4749bf9544154b9270ce14e55bac91a04142000000008dbaaa414f4fad55eb7e2a60193b600e0b95d7ee2cbb8ad201934cd17e3fdab400000007b6d08d0a5225fea5d6ec6f23182b9a7cfea60e76b8b5dba8298fdd6fe253478c32a91aee27e3dc8cb8509b51d40240d31f3211149ef23a5c8085972fefad8b9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409724185"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30657803ae37da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000eeec703453aa241d158bfbc47f0003a875205d4d5c7459c538f75e8cc936d90000000000e80000000020000200000007d77f319505e104e76c223aded5eb53610a945766dfb01cb4ba34dff54cca40a900000009eb978ecde415afb349f25cea9229d145bf9a88c544ee4f94fc039d47a1753b119a9dfa9ebd1c41fa456adbe927a8334acedca2bd9dcc837f52e944d123837fe049c6f07ef9c2428b65ac391603c16f4663e9b882d9e443376dceb7f6aac8db3b49b667f2556535cfa8891297a4b55d3d3c64f982b243f890801252137be441aafa3d2f0c6c5e0c8c7b3fe642aa12e8740000000db5e484a231c24ea2f79e328487037ae0d6f0c0562f161df58eee7c5e1d543b43c1c85e8cad6f7253086f5c0cc9f28181547165a4a23d8d891b7dba2eabd817d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1428	2288	iexplore.exe	28
PID 2288 wrote to memory of 1428	2288	iexplore.exe	28
PID 2288 wrote to memory of 1428	2288	iexplore.exe	28
PID 2288 wrote to memory of 1428	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d292d9fd587dd142d662693f217ce46.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986a6634d0882d7b6909b1dc93026f49

SHA1
6d1d20b3764574708096cf7c6b0b6f8129de0c90

SHA256
deaa1f26b59ace7ef0dd95e0d83af26538718e61a3d9976472b02f7acaed2c4f

SHA512
b3462e374ccb8befc9cafec9a2a0d2d6ee59ba7604bd649dd79dc5ac21aa63787eb2e7a39acfc86031fc8d02f9b3d7f66970c1c44993c96d495a252ef488431a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e984b6a37d710a88a08885385841277b

SHA1
c0422cb8ccf1929ab288fe1a016412d349466311

SHA256
ce18f96c574bb079a1ad78a29f42dadd1aa46ebfba8cf6df54a838f69cd073b4

SHA512
08b0391922d7261506e5ccce21031a0e6c0b3e72b6ec8f978010e66f498c47457b00dec8e1e48a0bf4a985dc3b3c5f8e1c5904beeead4c8b7b12422feaf0a141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
288be27363e917ae0a1a73ee15b3b8cb

SHA1
61bed9deb7e574629e8a9b82abd729f5a8ef4a37

SHA256
1e3f326a14ba7b34cfbe91694f76b16d486c0dc95e2fa830d453bac5f16d5641

SHA512
fb20d8369431dea7656312fd38a11fe4c75c27c00272f28ea837806738ccc1b9542404f9338275e008901b323d7113e11b5aac1b5d2ab8d6e3d62b63fc9c6dae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02e6109bacd3110c531c3d53b6d67ba4

SHA1
e2a28d98efe24e71828d239b494694e4e7d5059d

SHA256
67eb67c9a792a74b26e0e6fa5f733c96828ed4891a174ef0d89fcc7851d9a627

SHA512
0056e38f73d0b45d3d41de91de23a43dc73978796e7c6daf4bcde62a711d6dbf49b2bb51c58257261be25e3337850323a1da23d69a8fb3137aa5700497227df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7d44a36dd983378a001647badf1fb29

SHA1
4c52999bf87dc3d7087839553f565e0fc9300076

SHA256
6c26bf7c3a8592e60725fc08f3877dd4caad1ca6383cdee13f961658e1670cdb

SHA512
69953b90954059acd162121cbb583f9e58faf1afa0972945ba9cffcc4992bc5205c968a447bfb0d3ff21a72d72fd304722a28d043e0ace1c687c52bf2bbba517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91c6a0f2343bdbd209b0387a63e179d0

SHA1
69203b0d272aa808b0bc7403bb747ab16b62d139

SHA256
0e52768ab6ab20954d880ac8d93067c3bd7a113381f15d847000d524dca2be75

SHA512
5c10dd69051bdeab8d5210f7e6a2f88939fd48c475c2063694e6694fdd2dbb5445bda10195017d0f32185a27368062724a8cf512813bf41a9d41066c009a79f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25f105b628ba5514bcc04bcd357e4318

SHA1
3b6c03faf109d88b6b8e6d951e67b74da1d7e26c

SHA256
752e9fac3450721730bf6c9bba4e107250a51f2bfc3d70f8b44c16d18f3ffa7b

SHA512
53cc71ecc65c6704cf3eda012be2007061d69888ddb4a3cce3906031091821a8593aaa2afc933e9341ccbe2e531ae521b7f34d126e344a222e2d0de9178b3f58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4545b72007553d0c83c2944092a4d5

SHA1
251d998e10b892eda799a3245d1ae27c99a73cc7

SHA256
240fc80f6ec11eda740e02e52b7aa6f6f7897eb539ccbd79581c8e87115c7224

SHA512
6e69b428313fd563e24489c228c7f17ae5bb916f210a31e26b4c8b67fa1672d3d313fab7e05f9c01ab9ba6d970d2ee72ea5ee59b7fb1b1742c372677f36f72e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18b05157306c84514e42606a430cd59e

SHA1
6b4bb9b375aed27d5084b410f61f39afb647da19

SHA256
d8c124e319bf38d0adc561b69846252d01113da313df968967b9f55f23f332b4

SHA512
44ec2052ec253a129d0172b5cf9d0605d615cae1029006f8594d5b54bfa82f6d1593ab4ef3347120ea630ce4c9c05b1d6eee006a7dfaa1f689b583869c090f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb311a9b0cc784af15a03e9d41328026

SHA1
89f2de02376661400415137a6d3ff7a235bc6ad7

SHA256
a1e1595a16c1b3d5061f3483d46c1681371c1f643deb50abc246f2fd69a35dd8

SHA512
3754e9e9bc551745b0922b8d03246bcbc17c3ebafb1fc43375ae55333064824ed1ee960086156a36d391790b8777ed7734143172624bcb0699586c295b4c0df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3758b9951d8f5bbddcf7eb48b5e0fe56

SHA1
2eac05fe1d553898030b00e1c0a4820138c80954

SHA256
eb8f67e9614e8580d4fbeb8d3794b38def0131d1d31fa494905daa54561efec7

SHA512
2bc868ca314091010007b20390b53b7f6286ed5d050c14780aac369290efcd3a9d9dddc348b6a2dbb1be5c6e3b3cb437c3c9569caf211388aeb49780d9ef84bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae0ee265d59ba699efcae980e29ec6f

SHA1
6a1433275342b37a37b87a8313663bd24af06405

SHA256
12e51a4b1215588d56519cb866139b04147a224a8a155d2f2bc7fdabcfa31888

SHA512
83336432c9b16cd02dad3c885c82274fa70a464e1e2d594cd7fa998f616f38cb5c918f05527d0421d971e7e1183400be0aa7b57a688f77f489d70425b450e4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95dd80f132685eb3917914c0dae49bb6

SHA1
3f35a89559841ed27ca59f98c29e2216340e673c

SHA256
bfb26ab4b2158101751e16f2f547543e75fe47d64bf38372ae5f090d0c234f44

SHA512
40f27621f9e842e36ebdb5d277cb4e52a228bc480ceb8dd652c0604a9a9307880be87f9929c0e42e5043fa1ad7eff19ffd988c94353c60eace6b973f7b55988b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabACC6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADD2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit