dfed715c939e36b99f497104d209a36535b0f89f8d68b743e9bee3042438ecdd

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d71eef3903f2f55dfb2282108537f90.html
Size

18KB
MD5

1d71eef3903f2f55dfb2282108537f90
SHA1

13e4aad8347b2646ff47f7ec7d129fb24dd7900e
SHA256

dfed715c939e36b99f497104d209a36535b0f89f8d68b743e9bee3042438ecdd
SHA512

22aec700474115fc379d0cdbcf7759b9c364f299ab7c1cbe9d495a7fce868f06b1a50521065b0c16adbdc0b73ff645ffc61dd6cc7b079f835de8a74094e46830
SSDEEP

384:3gwhmLbJahr1AgdGgs8jMaztTLPAuz68MMv07e:wH3JK1AgdGgs8jJO8ts7e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80eb0a53af37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79ABBE41-A3A2-11EE-8A38-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ba9dd75b568b4d3f3d21d414fc52d7c751019533e6ae9784a0f1607dbc9b62f8000000000e80000000020000200000005a5f45036bcb7560a26980adf45f1bbe5c209359f23bd0f60b8bc7e85cf0a935200000007269fbc862ca0f8c4a52ed377db8b16ba37b30715b73dc8369db69f8aca24f784000000049d2c62519a2df9a209acbeb50e5c34607e98910de6503d8b549c514b914522ea49dc870166ecd6eaa9361d0185a0405b1b32d19a56777857b07d64e3e64aa6e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409724745"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002401cc0f23539a3b7b4015ff366ac428fe1efe277b3d10a78f1a9bf9f90723d3000000000e8000000002000020000000e8f678aa78b95ee1730783f3e8a0e1a1db49346b3daa3b55682d70fd227b7c22900000008db0c62dca52648b3374cb0fd14f30bf24b9ad468cc96aede17be8b1e3458c5cfa0a02b54bab7c0be44320876e1ad3fe687e29e73d2b895565b89c6a601b1730f3553bcf13042ce18ae02b182088f721f565383dd9ed1e38b1a429295d85838bb0a88dba38d0f2745479e5ecccbf3b491087d7b6b594adad26307d854f3583050eff0b205f6a99b5c18fd82c086f4b2b40000000368576b81f1b59280244ad3dc53b47c24819fa50fb2598fe821233333148bd4f39e82e0a9cd3dc9a852b0ae76b4ed9b35c085b9d56fc89333b8c7834213dd5e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 3008	2232	iexplore.exe	28
PID 2232 wrote to memory of 3008	2232	iexplore.exe	28
PID 2232 wrote to memory of 3008	2232	iexplore.exe	28
PID 2232 wrote to memory of 3008	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d71eef3903f2f55dfb2282108537f90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf51046a651740b65854cbc945abb00

SHA1
23f8c9e09aceeccc5f34e80a6944d74c32bd9e2e

SHA256
6375c06f060e0f6bf8e0d5dc71e36247ad68d6ef83001e7ee11682cce72aa191

SHA512
4f30499d7b1155578c55ee2a933af5b68093f335baaef4137728d59ca42a0c328619c8acd3797c781604a06cb5f3c0335b69b30bbe7e8bbe444aec727a7d894b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
002ea5d6401f021f912d1493e754235b

SHA1
c271335ab978a1f48bc63e4fe14b0e83eec964c1

SHA256
a9c4509dcea251835ff80a3466bd1541f6b30c6df520e7293b1239a7743ef6cb

SHA512
1057f7b98d07691c54cab405bd1ec4a394974912415afbaf13e2b321f735d1425e05609d737d540726d99237354dd766214d3de510b4aa79d1cfcc10d9cd36f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
978bb83891814ae9d8e758857735c744

SHA1
99d64567d427c20cde39a5e80f8271474ab7186d

SHA256
e3bcf8adec17b98dbd69d214a58a452b215afb8ee40875b6cd32e98e9330adcc

SHA512
500c4ab6560ba181c8f28f5f2853290d72fc40949f625f95b3f2f5b95d2da70a09e8b62ddac2d7e38d62719c63df9d87bf28fa3488b3772b022c011277e5c0bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cedc6c83fa16ed6e041c2ede6ae3911e

SHA1
047f72384036ba42a867a9d77681de407bcf394c

SHA256
d837ba4939e0f968fa17d5ba457eba9408de75fe3dada4941c4db85c88b66f33

SHA512
73975e639d61f896a7a2ac03a6c6a52e865c33ed8c0eed180a56fd4674c70a2f26653c69918d06bb53a4961a2f674a6d1e30b847330527dcf99a03dd0b647e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10a036c1c9d19dbdf4bafee4f229a26d

SHA1
f37ae7ee7f4323174953112f06498e2f6d04cc16

SHA256
7c77b1a81b054e06dfe184cc519959a0bc4f1fea9882f989cbd7f3b3f6861273

SHA512
17116da9f181039df3c6d44124595fab41966275aa24dc9968b8f285a934fad8432bd7ff9c0816d9726e3e057e98b4a869081d4dbb7d53dca7e7f3354d39d8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
598367f6fb691fde6efa7e8e56b2c5ed

SHA1
957be43067946281300bb6693062353f387f982e

SHA256
a870e58110d79eee61b3fce5b412f7464a6a193c18472ae8060295985728b833

SHA512
068d98f3624508009b20de94a262b20a552ba593383fb73c46d2e496b218cd354ca20e3a3a314127950653c0c6e14cf3f6edb0e1f9e8d6924933fb99460e1ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b46064b220d38281f1cc04bfdd3741a

SHA1
d53d6301a9514bfc6848dcb5beb73fef2d49cb54

SHA256
1e697891bf2cdf18d503d7468388aaeeecaa09d85282b0f3d66a1cb24338413e

SHA512
ab59aaa9ab4811de7282f06a3e4eba5f72a670efd40d9327e5b528eb8441dce8fa2a41661e0137e3302e11e024d609aaa9c96d8ec6069ec939997d6db76d5318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
574ba7906d951cdcd1b0c9d8d84c3750

SHA1
d3812a38f6e54259f2743de4858223767e4167db

SHA256
1ad324ae1bc2605def8cf7b9317908e3dafe24a20edb2b52dbecd7833ff9ac15

SHA512
baa015ed0236ab7546f0ba57b0524c71701fda0866e32baa506ccb66d13d7f80990fa8892ca4b9edce4cfc658266b846836a105a536e38d58849309c8dd4c129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15f440d7f52242ba569225dc756c1b85

SHA1
ed23b3eeac9eafbc57c7cbc29912d4c21587bc22

SHA256
ac1404b2b9cf79af8e8c1b52a5d6ef59fbe5042886793da374446b3763aa51aa

SHA512
d5e492ef084424850b775a06fc0d2c34f8022350ae60f8d53b6dd9ebe22e52d7955ebb7fca6841e1d36bcd31970ae090cc2ff06530eaeb7401ee1441b6ff2bfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eea1eb39e338efb12e16b4a54477ee3

SHA1
4facc8d0ce1f4fa3532e284ec54e34b8b616a445

SHA256
5e518e9014a2182275ec9d76c91d45a86eaa071e495f79f0280b05d00f579251

SHA512
9efc9d789bc0fc4932adc3b9e7f18a543eb420666818038e8c2437a36442d596f71bd931a4b926389e125489e3d69980d0e89860b651eaab0b8d0a9af4575862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0444a0ba74feb14cdf4533fbbdd8122

SHA1
80dc5a90c9feacb954485e0278b0a087977c3c50

SHA256
2ad946e5e900b1fc4ad1d4f7c0b43112bd1cfc22a8669939b544b865236057a8

SHA512
994a849f6ca26b963833df1657666e4ffb212e3859aa7a2c0e5e0876bfc9bf27e36a88e6b4fa639a7c0e64238919c267f28f1d09d7d2c6f99e57f2533f4cce37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
451e04326df05520422088542145f5ad

SHA1
39b3e18f5b0e93c388c3aefef533d47c4149182c

SHA256
35919054de325e7ca1a9beba155a0a2ccd41b0c575e815ef4c38085b8cb741ab

SHA512
f353f22f06982b364bbbfb885499458a708d8171028451ec475439fbc651a84dc65ab4c5c4fdde677adc791c17ac4949628abc66bb8bfaaf0c6baf971430daf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6108c0036ea40a448b933b274fa508f3

SHA1
d1c4a88b7f4bd51757f6da9abab0d79efabf56d6

SHA256
ce57f0e85de1fe076cf7b723e66edfd9200a02a7bdd81c7cf8c9527cd97ca5aa

SHA512
3d15abd22d5d5b50fa7a527812208ffa4a48cdc42af953a8e4441d3b08b3a2b8bb3be7842cc4b496832d84bf732db90937c576e7aad11825a2983729c88a18da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
674690f0b743a502b3d6c622d10075cf

SHA1
31f928de9710c6cfdab8ea45fb1fdd379793867e

SHA256
145dd243176dea759ef9b186be4c42062fa281969e48ff2b8bd2830063a6a43a

SHA512
5e42fb531e6b6f14ad0fa4176d6a05323f99f590a22e5430e3e7b5451cba63b4d2e923175d28b47faea5feb3abaa46d9423ff590ecdd5c11b71a21aeddedf5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA121.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA144.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit