e86703021844628af3874abe031acc7c8a38db75c51b8f0346a3a21f151e91eb

Analysis

max time kernel
141s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

269abf0c796db65effb983674b8adf5d.html
Size

15KB
MD5

269abf0c796db65effb983674b8adf5d
SHA1

fc0c6d3bc657ca0568de122b4de51a8bb05bdba0
SHA256

e86703021844628af3874abe031acc7c8a38db75c51b8f0346a3a21f151e91eb
SHA512

b71f235973921f1f0aa7aa1156c40e3588750b387fe4e758ce21b0e6f9945b70648ca8f17b212bd780eeed64c600cda7520d10036175420d01706f00c5db091a
SSDEEP

384:CKZiLJ9LMduthj3zDUW/8epeBypAw/deC9F:9ZilRMduthDzDoepeBypAwF/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409941501"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000690e0bdedb4406808df275b8240cc34f8ece904eb4ddfd41019b8c1918bf093b000000000e8000000002000020000000a9f897ee80ffd2eb7621cb6b7859c0c1d0016fc10ec04303bf2fb4265dbf2af52000000088ba39b662ac7fab3b36e6285727391e19fe09027f87ee2de891755080b69f454000000029f9e2dc51b2ed598081dd896c0ae94f185c4c2e5686e70913e3e5139b6121efc0294858b36e35e2eaf3dfd97d656d084e5ee69d37a8f3c1c5ca72988494f1b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2618F5E1-A59B-11EE-AD08-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000dcddafca8ca37b214ce641a7bc0ddfaff070a5370b4c879e9b07d2a2cc12da7000000000e8000000002000020000000970fe2977c8c1c3045719bb99cf01d6ece946c8ace42f0e21afadf819344806190000000719252bb3d78a6836f2f998996adec6ed418a52de2a21f281f89c2c6f667ea2fc532da54097c902d59285dfe168ff7c4f59454909f85580cbb417482db081527541b82fc10674ee6798c5dea6b77529ef0329b1e53d30dd8b90372576be3724b73a185bf6e7f6550bd2115546b2c9df3ba8b59aaf52f958e3f160f7b6cbca1e73ec93ef3015089b9a8dcc33afaeda7db400000002d1a33712ba0fe1d1e2d8e1a732936e2f789627d2a97535e6c0885797bd907c700b30b0d212f77f0ec5d3cf7844baeac2c536f239820607520680413cdbf44bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c16e15a839da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2116	2644	iexplore.exe	28
PID 2644 wrote to memory of 2116	2644	iexplore.exe	28
PID 2644 wrote to memory of 2116	2644	iexplore.exe	28
PID 2644 wrote to memory of 2116	2644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\269abf0c796db65effb983674b8adf5d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e842a297942208f13d8901292fd77cb

SHA1
6769770b1ce043d8694fea93df9a6f137557298a

SHA256
844d25dbf565409852733d75b95754223df1a05402f09b0b893b3ee13825b44a

SHA512
bb2b0f87c4c33090aa44aeb2e60a37642a49b19f57fd38e5df8155d4d6858568fc755c878fabfa78afe94f31ebc8809722b2cdfc74417e1d35d5dad8f9a8d462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79867faf0b79c35e9bd103e1110c82ea

SHA1
296b71a58a20ef3f9fdec02f5dd3afb0c6c73704

SHA256
3a310a4cf42b86ec8279fa3a02cf405449fed3068faa70c5c1620cf52b93a76f

SHA512
2eef78c2a5322a1733ab154476941a89f2e1c69ee5c81bd988c7f70696bafad184dcdba43787784f1b31ac67cb301f9a2599e6a68b314d6d671ad948f5c31971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edb6f2e96d14dce426333070e5e08c1c

SHA1
c5b7e6514c726c1e26f610bb38dcf9ade065d8b4

SHA256
63c2a2434edd3dab2545ee787d15181db77f402d35cf92422a5d58c041b6744d

SHA512
41eb3afaa9f75acfc4579fdf48b212b987021e5dfeec99ee014f87fe2edf94349116a88c63c6cc1b0384a17c830ae19fe692e9cc4f86f0805e1740aae2782358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e96745bf5af64609fe0f23e38673357

SHA1
9818058ea7fb4eca2ce9ae89eb18a2e27505cd11

SHA256
7322867bc4ffbf53e655d87df562d9cc5883b41bae1446dfcb65f63454dfab86

SHA512
1f3d6d4d322d4fe342f95c5a45c11e4e40ee66277dc967f62dd6ce9770b0d772cc1ca445bd6103de552389c04a797d86fcbf4eb0ceee7e7e24db80b49bc2c325

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90058b8b8e4d2e15c6f885001adf4e05

SHA1
cd00d816582b375ea8c1e0044a55b808c62467e7

SHA256
eb7b2dacc754c48f1c81a281a391db7fa8f82cf9388c8beb2c6ffc4805c95437

SHA512
63a2cd00278bc8192dc3489b017547738dfecd57c168feca9fcd77ef1b47bf0a7c80c14e6c367ad84bd0d170772e97066a0fce76aba7242db7a1e66fc3d3f793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df8dab3d33f39950a180bba530c7e436

SHA1
f83c7ccf17d5879e161cc641739397411fa4c265

SHA256
6522ba62f389e8348d00231db9fef40782b0ed36e65ac13e50f3051ae1298640

SHA512
ba621ab133e257130aa4cf8471b9d1d223f2f40f1ae32bdff5beb093b4674c6e5413efdf8d143922ba81d910a2cdfe87fce1aa73f11d7c48aab5314a11328fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
573fef19da341b20972dabc066970eab

SHA1
8ba2474e796fb87f342ddfe0a6f3b15e903a6bf2

SHA256
62cd306a674d6520c37b2e2632cf809a16cea57e910dbcf9c00f5c8dc928801f

SHA512
7abdc4a90d8b88a695028dc4199eba1030ab94a3f407a4bd3f97c47bb57ba60fc41685f527754fc7df91ba2dde2fda39344e225237e3924a702ab604b32bd26c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dc51f7dd7c3904abb40fcccf4d583a9

SHA1
258079f0fae782bd106003d0777818de99423d71

SHA256
30043c6a0a388aa14872dd08b1e118721e62def5d8c5b1c440a75c6cbf2c8d21

SHA512
dd0a14e4d115769898189b90389ac4f51eb32cafb61599017587699d99036d80c5103b7e79ed0e810b77f60f3bc354de8a9c627ddff5aaccf79c7be290f34a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c1c599b3599d015a2e2391c022e015b

SHA1
0d507ed66e51a033d737159850184aa4f9791d35

SHA256
f044a1361f4295d00a1984d38106727868d69018d17fbc898e23cc90fa5fde1e

SHA512
5229402a43e65135ceb9c0c8e53bfc29b3bb888cfa24e57a2736cea900845a729c8cdf9585cd35d86e3c99c9fd5cb119ca64578bcf81a921a1f7763345cc60f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3f993b1a550d46391f124616d4a2e41

SHA1
e32346874b7f165bfe1a6a8c25c0f9d061ee59af

SHA256
badcdea5edffec63dada1f2afc184022b412f8ef5ce851b75ec35d34db26e41d

SHA512
dbee20d4927730f4eca69d930168f105cabd604e5fa5b4736259762ed6a2a7bebd08ff453b69c0972e9082152ae0fafc3cf2550b312b10f28826d981428e07ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1553bf79e11617358f297d7ca66279f5

SHA1
523a4f40e5cb38084a46798ed617963f416789ad

SHA256
2a0ec8c2991150a555950174471da36bec01bcca7d9f09b075bb71b74e23965b

SHA512
3d9593e9a813153194d5d8c0680a67a64d4b817b9f82fbf42b2caf5e75cdc2bf7d3d19561af1b056d6b38917caee1a23bdd1753945b446514b7b1481af475ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22c4aa3c496802094bc9045aa1726863

SHA1
01e9ea094b00a764472805d349aec2b2a53db9d2

SHA256
0fb3305fbb74cf7c6179793193c7c4aff1931fa3307891cf16793cff402cbb6f

SHA512
1579f968ed01d65e428e11ceb2d956a81a4a839526a49a2a73bb1c1454b0abeff40513a87791819c2470e7cdad32e74d671fc007a692e839615cacddc275cf53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7ed0cd51b6d1a06cc0477450d94c592

SHA1
f242630b304d6ceb257a327b362322cb627898a6

SHA256
444e1a36ecb881314f1b7bb52025ea5e0a44eb621078e926543a1be111492948

SHA512
adbc0df8baf5b765ba94cfa20b2e32f53c2fb08198f4a515c18d505ba64ef3df57236af017b51adb579ff8afc7e1ebeba4affde217dc02dbd5302582f14e9358

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4695.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar571B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit