ae3a3cc39f628e21e10fa3c297196abf2bbdf72ea7133364a1700d3c540b021d

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22646a15fc1da75a4ef0b79d3043053e.html
Size

33KB
MD5

22646a15fc1da75a4ef0b79d3043053e
SHA1

2cb482645793fb483c2244d3f65026657addb7c1
SHA256

ae3a3cc39f628e21e10fa3c297196abf2bbdf72ea7133364a1700d3c540b021d
SHA512

cf462714d27860aceeb68e718b867739df9ca0f2e0bd389addcfda41820f5c834a2a508334cfa988331e2bc0e3d8195b3ede2557e26bc93fba8010d7cd8965bf
SSDEEP

768:fYOkATFEsgTCkpTJjYolwILJ+r10EFRuJrOHerqjIzz:fYOkATFEsgTCkpTJjYolwIorCEFRu9Oe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF9326F1-A574-11EE-868E-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006627d9a593d46a07f0e9c6fb56435548f030e980f0df55ac573e130e19cb1326000000000e8000000002000020000000aef35ceb611222dd074972a932bf53ae0bac3a7a71e8b43c3ff2f78d245d7b9890000000c1fe5538a2e9e1139dbac756f1388a8ad23717d56827910fedc2b9cbb92ac8efe09118c8b24a4b619009909492b48a1f158d4c263debdca1fdad64b565cc8c7e911ea208344c33b3be4bd195d7ba0076e7fa399e8daf44e49cb1eaba88ecf48372f967e25270e76d01d1d6e9889e3a1b71702594d24425f44ed2145787452cc2f80dd8360dca0f6a74649e5608b8b00840000000492066b70e192dcc6d4b2dff8488c04f017d7926a0bd32d10e28439a345e967b2665df223319687218e00240326a7cbc87f9eb3d6628be1f564bacd98bfe122c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409924980"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d91d9b8139da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006925aae4004faad12b0f284c72d0950ed730b9f89fa75fa7ed339776a8cc7e3a000000000e8000000002000020000000515cf505fdb5c1b3387f6cabecdc4c751c14b563ba17ccd36c50f26826e84af0200000008e2758fe88a6644ac05235050c0d2225cec12569a562aae600ba581db0974d5e400000001790699b6bca154ab71288e58949bde068ca851a0b4e2d91c810b2e9162fde4918d7d9ed633e472ed6200d09f8a605ea6862d0c1819a5eda4be96a942eb320b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3060	2080	iexplore.exe	28
PID 2080 wrote to memory of 3060	2080	iexplore.exe	28
PID 2080 wrote to memory of 3060	2080	iexplore.exe	28
PID 2080 wrote to memory of 3060	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22646a15fc1da75a4ef0b79d3043053e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa36111d1153c2ff831c6b0affbbdd38

SHA1
d6668acf4595c5c8ac5f5f343cea67ffc63ee699

SHA256
f40f30e4e265def1f82dd5b5824e93ef6f2991908c8479f970eaa9fb1071aa3f

SHA512
7fb64c0ce7f1ec62fe2b0ccf1cd13c12d29563494705d54df9f3ea853032c32a0548d88f6cfcbeef46980a401034a686ff9b1818eda9aa187747106f27c79cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3dc8ef291d31a2f2db39f43d38cbbae

SHA1
3e3fa295526166ee579bbe32bac43cc408d75b78

SHA256
db2fc5c5be46264d38a075a8d612b6ded8b6e32d22f15e159868acf18ea0304c

SHA512
a66fe14d6c2dfaa02d08d4739617d3b7bc57bce1d48092991eb3e60f91af5006462afd05f033ba795c68d6b731f5320ea6ad671606bc618b8eef9d846c629f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e436dffc9ab1a1042af51d0838b4b219

SHA1
de1193dd93b993b6ee147d2c0700acc7c6cf8f21

SHA256
e03a444a2637e874dbc38a1054c81795c8750e2752d89af04b8243e399d8381a

SHA512
9f48c5947c96ad311b4e755622d8c0434c7aae801394f10f00581bfcaad98958dd3adb193c146af03fef8975164b64b901b940e969c0d7e5659309cc3f0b97b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
920ebe05c880d9d7785b4aa344b68d9a

SHA1
c06b2cfe8427f38e5a80c2ef027c771887ba4c1d

SHA256
9c1551ea6535b43a8dc7e85ac606e6d11a7646717bdd8d15fe4b8fee75cb6474

SHA512
bf9156652f7837cbe856322426a3d968048ee51104975451d9b36b74d9ae14bc4eeabb869d1c3e8f471cbdd5c9e73ed58a4843408ee44a522976226b6e87f5f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
382760588424a85ea29ae58bd71a0e1c

SHA1
06980f99b03414f1d62ec64db1d27e195fa02a8c

SHA256
f5ad0b443abd8aa09b50f24b8174e4cbd785e6f20527671cd9e16bb68ba10a73

SHA512
b768f7355c2e8ca9f588b83d2e9a1a4af15a0f386387d0fd6b52449e5175c986064da0c98cccf8baa2ee848bf66d84ef4542756251864261b179b961e3bf65a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bad18b820a3f039839f89653a05826a

SHA1
5915635856841bc6f64fb97bf95011c4d0c1780a

SHA256
5772a86e1fb3f6834d199084ef2411bd0726ef41f8a2e62e3e23a72ac41706b4

SHA512
2cfdfae8ba14ed9dd8f54bb34076028c14a35e8edeeda3a1082ac9b5f6d9a44e9fa52570146e200fc8f6432a8fc5841b5c10085ecf91eb44318438069903c1cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcba20131299165792267d0a90eefada

SHA1
fdd6fc47ed2a3d3ddccb2465990c27f458e34b4d

SHA256
5694c861a4f3046a22046324c27dac174b36b77efed6f1b661d783f791aa3fe5

SHA512
3891602e549f178e8db091edd48ffc4f313c3aebcc2e3cccacb398e6726e07c42a91b67df810dfdb1297dfa307b4c12d0b023a2f84febab29c079ddce672ba56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3001c929d21edea74af06b41dac13a

SHA1
63fcd5604fbe1627a8a9afd0e28de24ff923a28b

SHA256
b56fb44e6f9725b0feaa0dd01791ca9c1819735c9d050903864180c6bbb53b5d

SHA512
7e1f835a39e011bdb5b46d0bbae1580a984ac3511a4b1e7ee1939e4d04550cb44fe32a4f46991e64829f710519d68f092e6f9bf44f0549cd1f5c3a0a37fb62db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f016ad3f07d4a2ff114d2385c9a66a1

SHA1
2837ec41990620a76bdbe08de5e40b39c6164a1d

SHA256
02e03afe76ee084154c5089b4dfc1cda4d10c02321900bb050b7004e9e63c4d3

SHA512
ed91eb34acb3ae5f4bcde34a304beb40bd8234939896e77551986949187b3145b2a31c79a982e527f0494e81461b85faf0a25a60fd7a4bdcb76f14ed150e27c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
957b630352b7fa3d7854e66014418c02

SHA1
0b716e18d7d6d7b8216df9c4eee8398d6beca27f

SHA256
b95ce41a87bbb4615be7f479efc95bbcb6c60a2b8edc655c7449610aacb85deb

SHA512
36bd4c0347aa554fd515ab44e393a4a7ff0847a65233ec3da7136edd8328da841495cf9348eda03b47bc27db59c6ea70107261c6b604dbe237fa700c8fd29c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cef09edaf309ebecb99c66198b7fc1a4

SHA1
b78abd91a5cfc790e4f3f562a0a20f587acb8804

SHA256
f428820272f13f61703b71de6506553895aa1f799046c01ab6c1f8d04fb6d5f8

SHA512
db7f5669bd9390ee74ad4680b2f2a73f27d2a4af6289ac341f66beeea331eadbf2e99b260e80ddad714db27bec75de0d691fa7a24fca4e43ae548c6e2e0e3a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96ca54fd88c7b3214bf7345c38c1857e

SHA1
5c0114106ff41bd68e27097caa1b8da4ddf26dc4

SHA256
4262d5512d8e7d801e1f6e24e73085eda003ce5c82641104a0179265a47f28a3

SHA512
16f28685ecfc6041d4964ca73d42950c7614c8b3677eae6d7a65b7a8475b5542bde78dbdd0906067c8ff85bc1bab8bc286203dafffcc36fd610e03e95b2ec36f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c139dd674fbfde91a6510d7ebada06c5

SHA1
b7560dc97dde612103611dc05788663defb81745

SHA256
ca7b2f63e279108c557141ed9d62c56ae79ad45351352b847ce6f1ba3efdf5d6

SHA512
b7ea2333a6ca886c44339b3ea8aa784ebc27f2b6b1c2bb10b27f59045ea21a7b4bd018c07d5f8a4a7399f85e2daced312521e1ad436c50a42d1ca697de383046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\3[1].jpg

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C48.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DD1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit