2725bfa699c84735e2a56964f3be6955aef0ab5d3ecb5c14e607cb9c916d1a01

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e979ff5903010bb297098d47b249704.html
Size

254B
MD5

1e979ff5903010bb297098d47b249704
SHA1

d78fd3260abe0cd960a98aad3f2ecafa6c18a7d6
SHA256

2725bfa699c84735e2a56964f3be6955aef0ab5d3ecb5c14e607cb9c916d1a01
SHA512

d97450ebda15991b5ed2fc87c54f3fa64322ca7a8870cef398b0cc1d54cb03e915072519b5e755bf1bb36f04bc0bad2dc0a074b08659dcde0e9bf517e7c0b9f0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409726863"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000bf90409765c442723f9644bfb6affc3cc2a3a4439c1c99fa36d2a70269d74efa000000000e800000000200002000000042d892517e264862536bd194cdd6e88bd5c6cdaf1a27e1e6b985f6914bd0566a9000000036e75f130ea67f38cbfcc32b6099adc7a36a2d51c4f65f065edd9aa06121f8a6f5915c486f828d5c53a70d94f1411befb16afd514de6e80d1a94ad686bd7ce9b819541852c1c16104e516a1365e90d87b550dce07bafcdbd79a8117a62df05adfed45c1be5ceefad4c73623ff8cc71c186fc557793a7c778c366afd7d3ad709b2e415c9e8a6e707c3ea9e64e56abe9c340000000b7f9f5d236a970a92f7147e898d5c501dba21ef05faeab9bc1b785cd8173d7503446a990297f76028df94bf006e5800f77896859724f6341b914bcc88cfface9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c0b73bb437da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6747BA61-A3A7-11EE-B49B-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000025c7f25ac7d10d44cefbd34985fb5ff7c22681c362bc8994d8321f66fad8265c000000000e8000000002000020000000aca7c80c15fedfedf958cd32c0a89df8a0fd6e336cb0e8ad705aa464ee3f489020000000a40ec565ed7d42a148ac2a8d886e3855b68ac2d380c7c15097e8b38fb532579b4000000092fda7d04d03d4848340d8d05d8d374506efec64f1df018009ed982ccb260e499289451652b034e3397ff73c057cefe5626a1bb575eb048fe725b1f7960d6497	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
1220	IEXPLORE.EXE
1220	IEXPLORE.EXE
1220	IEXPLORE.EXE
1220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1220	3068	iexplore.exe	28
PID 3068 wrote to memory of 1220	3068	iexplore.exe	28
PID 3068 wrote to memory of 1220	3068	iexplore.exe	28
PID 3068 wrote to memory of 1220	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e979ff5903010bb297098d47b249704.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
761638e3bc0d862fdf417d3c10e19b95

SHA1
541addfab2748f7dc45aa9fbd6b0fb9e45d2afdd

SHA256
0794171daf8367f0f6bbd48037d509b8d435cd6162dbb16bf597e369b3e346e9

SHA512
80a5e5ee9b9320376ea29329f6813c912c2085bbcba60183e98fee04553ac2e9f3480f687eca44534dcd5a39a4dd0cddbd8c48c4bad9b25ea950391600c93385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a11645f3e233b659fc87c152f94be40b

SHA1
9f88eb46979b734581903b72f7ac589955535816

SHA256
94981cbc8e81c655be945288776c0c43f350c53471bcf8fe5d32a72b02530d99

SHA512
017c6764a8c0d77e2ca02428e885011522f8e7a628a7fc267982f8a6e029b93f904de1dfea7ef152e026a72f2dc14fe8b84df852cd8e6578fecd4e9f38f5e33c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b4263ce5ecc6b6d5c3a0a9b4acd071a

SHA1
09abf554fa7789df4f8949ac07397ca832a0b7aa

SHA256
fa38f238f5b72f53fa9ffeb2bf29351f49f6fbb291ac2c98bc9ea88076606a2f

SHA512
647f5c29cb8cdacddc5966b0dd60544ad0727a7ed45f1e71976d0348a64a8a0ae4c9d51d071de05cb0f7e43bd87cab04aa5d7aa6ed5f8c1c546befdcaafb9d36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aefb7a4f46510106a44deac0d9c23ba8

SHA1
71e1e3c451568fbbf2918bc12cf2db9eb1cda8e1

SHA256
382b246560e442fcdd4bd42fa639cb0e400984406bf4d835ffe8087828d89a2f

SHA512
6be6bddd2c79804e4c511bbac67decbc809445b6ba7516f8c08b0c87c2e77809190d012eb5ff5c08e809441b6e43cc5823552b3eb456ffdf8911d60167f665e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c594d56b9ddf855f5fc8528eb7647f29

SHA1
36750d1532418ef5a997306a4501295b14611f2e

SHA256
e3fb00d22b606678c35b97d55c41b19ba125e5f4f16792fa4bcf2cb0f486635b

SHA512
c8dee5bb269878406b2b73ed53b714952a2968efb32ccafa32c06b28e82ec193979748b4b49f53e8f82b8510be1b0feab46b94c89681c5bebe65b0407f337dd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2705d40f79bcff3855986bf27b87e5

SHA1
b1f4b1bdcb89cf04cff51289f9545197b1c39345

SHA256
0af7ca1d18e7cb6e4817e57f689b10a25c60379024f09e8a70c51982dee688df

SHA512
f1af1bd71098b6a13fa626faf013bf0c0d667ac1b2f86e01d100303ef85c84d7416d9b8db374f89d47110dec06bfaa4b1420d9ad31b7e14ab85891f7e2ec0382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8b60402780df3df3f82ed1e2eb75595

SHA1
e293ac75ab7de3441a8281cd575c9b7f8128cfe1

SHA256
ca395a55ff588788df83b15b93595d7657834487aa9bc21b82977686a1b68feb

SHA512
5666ffad16b7134590b3a6933eedaabe73e3be7430275c41a46be52968d6bcb1f3dcdd363a0bcae6c69b59ffbd5253656070e663c5b56c692709c990602850b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1f57861e1440371a068c7027df52b02

SHA1
a5531604c618ff29b48ce320f34e9f9ae41a9ce5

SHA256
8fb3a63c2278ef7c507e2a184033d74328d9bf38103af47cc89e420c550cde15

SHA512
948a7d1484917e297561a2b12ecdad04b844596dde8f8d623c4873cb5a3398d4a5678af5e4297baa83d56df5b96158a5cf9edbf24cbe17ef38e454bf1420d557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
853c4d1df8be98d005132853e08acc82

SHA1
23d84b9d94fc460599b4ad022d84b739dcdedb3b

SHA256
eb0b2ae6fa7e66f31dd57ffc1cacbfedb0459ebacc9a1d2a98668dfe7ed033c1

SHA512
ef410f7146b9c02656c7afe710741e03eca008974f71ba5283dd12b649f4430be3bf4097704a783a219f3972caea0e313d076492ed1b934e72c5373d148cd15d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98ef8897c323a9a5eb06ffc1bc90eb1a

SHA1
65138ea269d738ef66f375bedff52d2e24d04ffb

SHA256
703fdb9934d156f5d2b2e4e328ea0faff177e1cecf0fa94e67b1760a7138d509

SHA512
138c90667292e07ccbcb581702e6c4a24f23239382ad55b3b4dabae099a5794bf03e1d93a920df7b22459691a7aab832ab467b54934d9e379193bf60702c8d37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aec9b25d96e179622ba19967669977a

SHA1
43f512a1b3b398386ea5765f1426f05d3c65f0c5

SHA256
fb6843ab054cdce76bc2c046c22d775475bb8be217c21dd1405a0d5ba58920ae

SHA512
c1c2d34195206137d956377382b281097d50b122842ecc5deebe859af343bafee2d4758e65faf338a79771b07d4b8f7322c6ac077632b92a581752a38e725a1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b6bf1b802d0801a3660debcebac33a

SHA1
18ef50e5dafe7460ffc3947eca0a75814aa71312

SHA256
b992b5eb3565bbe9fb64dca6a8cbeb8fbbbb6a3d03ff0a000183a6d4bbffa9e1

SHA512
89f8dd5baf61c02fbfb9fd7df6c46046447cb74f1368ef0eb84ddc0525c02858ff84c4b0722e2df0e30611284c81979c6bfd13061feacba88d680d1243e28fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab340E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar348E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit