a23caa8ffb1c01096b2d77908d922b1ee31326fbf55a877da01c1cb4397dfd7a

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

274222bfc7b0e13a2510ffc88b040c4b.html
Size

28KB
MD5

274222bfc7b0e13a2510ffc88b040c4b
SHA1

0c51a24ab612b5bb1c5e939bb75d48cd599d1d26
SHA256

a23caa8ffb1c01096b2d77908d922b1ee31326fbf55a877da01c1cb4397dfd7a
SHA512

244d7795cd73fc25224e9e78063f0a84874b03c9061b024ae0b7384f3aa3296ae191ca17aa9fbf6470d6db6b9a7129145c43c5b5f8042910270266bc08c5de71
SSDEEP

768:S+RM9Wz3s0VpaiN0keB2U18IueB2U18IF:SBW/fzIYIF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200cf3d4d937da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA287F71-A3CC-11EE-BC40-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409742996"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000047124e30481d6ac9e981f557b62e04a4c85290bd708ff455029eeecf774c4027000000000e8000000002000020000000f862b59a7ce317a136d77ae9ea8f9911fb87d153abf2db5574ed9052c58f4aaf9000000048cf5a2d3d5bd75682fae7b0e15b3c679c8c57b2068f1dfe72124fa945b44f69a56f560ddea552d06f4cd627fa77f348aa9aefacd8ac2b09940ff6c433eccdc45eef866379b3acd4b29b4488eadc67096a994175c6054c7e1709ab88a7d8e11640f61f576038e7b6380b41dc6702c3a815bcb41168f890c24fd8d04ab40e83ffb1c3858717b1c64242d15a3feb88f32040000000075d43410be98b55bdc6b97de32dfbeb07b6ebbc1252b427ea64b057ea632574a71261f0f8151fe4d13944970288ce6923ac6b3104b6d5dbccc1f0f84399e425	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007e3f3e1bfacbef4dacee608d21f5089a8ec812c4010c86dd01f6a4c72a4ade1f000000000e8000000002000020000000c466ac0a60b35469b3a49ccd3772765bad36c599b6bee103b23e7bc58dd787ff200000008af2d4eaf80524b97a10693a302e8bdd25039c84f2f67b88f3dd9a50ad0ec9af4000000078ad3cf77e889661332533f8b883b488d95eedd9df9d5ba1733a8ce9bb9aef53294c86a4ef9073e9707cbde31051e2e035f57cbc21b9c0c1ae3964e4c68bc37f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1472	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1472	iexplore.exe
1472	iexplore.exe
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1260	1472	iexplore.exe	28
PID 1472 wrote to memory of 1260	1472	iexplore.exe	28
PID 1472 wrote to memory of 1260	1472	iexplore.exe	28
PID 1472 wrote to memory of 1260	1472	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\274222bfc7b0e13a2510ffc88b040c4b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1472 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c537e8a56779acd4eb140e230a65cf8b

SHA1
ee8fde9b8e3df7bd8a874a991d4f3625dbf8d6a4

SHA256
e808d06cb4cb801cf52d2e34e37458820f1b14646b094809d94847f4a004faa6

SHA512
1716a857764656548c266b99cca0fd3e530d7327b64e4b30d9409c9ffdc30ea05d954d23c386864542689a9a8f766494c55922e998851f11871511f871c6c01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
771c31903a05f0b36b935fbc06ed2ee2

SHA1
51d3c50213f0ddd2df16ca32ec5735d897898cef

SHA256
052361020083df34fdeaeadaf7bf41ea738f3dde498d5fff600e9f42aac0d7be

SHA512
5ba5849fc6e89905970e7b90c6e36b76d343a3aee802143a0713e9bad67a66633bc7d43bb2be3e65e40772ae9be0f8359e476eb9e279514d6523dd6dbe5ac29d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
324e77479a3f000a8341406f433dc488

SHA1
559622e53626c3a2db8e6ec7d9b943c584e4a238

SHA256
d8f7a24a1ccf11a0a8b91ac8605bd9544d78d92d429e8af67f076070e7fa99b1

SHA512
d263bff2d5480b3249401a726203920441bb45cda0f7bb95869009977849edd7bc9a711defdf5c20369248614c83653116d246991ee588c1a296a55ee6e014fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbb140c82de50998aedd1bac5350a355

SHA1
d57f6142df1cb7e8c7bb9a19d40557a1014100b4

SHA256
9b0868d491d47cfb0da77ff5b1b98110c01027a31cdd333c26c09fe9ed7e7a0b

SHA512
f09900acbb7ca9dd841497a91ae8ecc5039862811e52ea19ba154b52cbf912f9373f62f3b9ca75f8c78e57b96d5287d73e383198ca780b721740e2f20c3474c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1f0c536288fe0d5729891e6813e2e01

SHA1
f076aa10d422e7c3c28033c1623d5d92936a1700

SHA256
ea1bcdccbcf2ae7ac099f9ff234ed553dcfbdda67a91adfcd25b60393abcc837

SHA512
e5321212ed83bc2451a062a78fe2e72d44d96132342d3415813bf07655f70915e568c93140b8230b616eb55f07f7f55abe50eca37c1cde749871f237adc95482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da33a0d675ff70b417f8def149d1e0a6

SHA1
b445be7521b3f9a268238815680bf65bd8cf2387

SHA256
1c98538347bee119d7c4c66d9a7f8e61ead06249cc3e1661d0d0efe44711cf5b

SHA512
c44e1132287790443946c8c3048c2c3cbc2a7470b084ed69090007effce3fa311967031141f8f8d2eefda12a8307e93321a4866ee0db4f03cc2d1176639ccce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
380f838d7423e3b255e36811e70445af

SHA1
4177b35fed0e9afc14e74c1dc52a96648c65d909

SHA256
f00c26f3ddc1a5ab60fbd1be17c49dd2c8c3e79ea12ff23a585a5ad24c97cfce

SHA512
135500a3083f211a17697655202bc9b01dd0fd28e80a4eba7ec3dc1e2b4b40bcc1be774d1b9a4b8af7feafea29fb1ecf48b8786d60d94018a7328c83224d0fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4216ba9d8b51f98b3ef5e7efe7c497aa

SHA1
a9d0082753acf933289c99c806394cdcaf276eb9

SHA256
a8c68f1cf9b8ff89bda6f5a744b5cedb507f458f77c88208eb657d81226a85e2

SHA512
e56ad5071c1cafbe948423760b9472c4ea1b6d121224ea4bc78b7ae6991d05b17a40cab5896286636df53b5e521767e65bc2eaf0d5642f61463501f2f3f57a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a218292a301f283f5715a4ee8bc8b878

SHA1
2abe452e34cb2caf6fd8b7ce7eec226423d13cc9

SHA256
6a8009c68584acba562348c8fe78508a5fa701407a5f11cd033b048176a94a25

SHA512
ea8f369f3cbf6aa295e2d6eb03ce8cf3e956d4ed04a4ecf67551f9402ac9bc736d5c3c6ab12d04e3f8cdca8edb71e2bfb03ed459dcf91100b33b6814a98a6dcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e7b7dd8d9f9abaa94d0a087f3745f3f

SHA1
b14dbd610f14e7dc300fd5426ab88b6e13e8737c

SHA256
f4a22f5e03d47a82c00cb37cb084b0e9162d1f2a2c0fdc8373716f8c62192d73

SHA512
3d46ecf9fc8c611409e6bb78347721c6fcb960e86553cd79348c01d581a15c402626e7915b166cfb4f5ee0382879233fad8f1335584994c3df77a4d1fa4c0c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9878668b42662a93eb85a83cabf0a3b4

SHA1
e64835599eedbfff4e1b4d3da2b57e35d2ca0384

SHA256
a877034e890d22eaf4eade6a8281382eb8cd83e06a435d0f8a368360374ede2a

SHA512
2dcb2c384a093211d266738bea2868f35d2f85e20259d31f4cef7d5af66948d70bf6a55c912337b80c1aa2b7fae79ed4df6cd15aac38951a3980889d283ae1a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d69e9f58b565ac935b159b034386f8c7

SHA1
846788ddd39f924f1f54091ea31d8c9acebcb08b

SHA256
7e823519a571730c46d5acbdc9f8a967efcf21fa361a314a22b833c6206feabc

SHA512
a75417010e58a713ce0589b3da33d0b720ffd78113907cca742d56c0ffb62ace0ac962c8e642257cdef497ca094716ee73b0c4309493dc3e239aff5ba33d53c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4d544fcb585ce405f317feb0f2af31

SHA1
a5d3721394e543b231c6009cb1f1d3cd7a739c1b

SHA256
b62e26d80f1d087c9bec91dbeb3ee29c3f86640dd22d2b396c09289303be08d6

SHA512
70b99fe8e118916e1f3e5e2507a398dc75b4f7907b3429dd31e75776be1355b364263afb8721d5afa037d6f14a468f1e890a21426d8a5f17bc5ce135934f116c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2738435499225136c7e6f0f7d7f0aa6

SHA1
e8dfe97623bd1a75f02fb61bc4ff42212c1db2e9

SHA256
b5e001e9e187befcfb82e43efacac7362c64b3a445d82e758bda8e45726d552d

SHA512
3f2cb7b97401256899919fda3c916b5f6b8d6ecfdead1f9016941bb82cd240348049e7baf8e077a3ab62069c219c369359eb995969af8c8eade85aa942eb07b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f131fd92321642199179eb13f3484a19

SHA1
d0a492de54dc6a91f6d39693813bbba43c7929a9

SHA256
d3e85123308e109cb63dbb27e183cb6084e19b3750d5e49785d249c1dc9ee435

SHA512
78bd707e2563dec4c26699746eae19ca97cb546c68151defce6ac8c0b7cc7834816e2660b04b226a500016b7d231a95509fdc3076b84a2343155119ae1d08a46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19535ac0d5d9681494975d4d017e6a49

SHA1
9c32781c2bef21d8e26a21f286d8219e9a8d8075

SHA256
e4fe8210ebf49276091a9a597381f553f9a1eb7ab244e1a59bc24102e1720f2f

SHA512
f728b7dc882d2784f8328d61a71ab2b40685b4f5cae5a159710bd627bc9aebdfe72ba149c68d036edddb77ec0809e17a678c3a81d7ba5391d5ad34fe2252753d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\domain_profile[1].htm

Filesize
6KB

MD5
46a29214152ee0601f7bb5369f1261c6

SHA1
6357918d8ded328e4d6f4adbc0047500516360de

SHA256
3c6eeeefd2f744c71b349f1402bf195c7f7f84b3c03da209a0e088e6eb122aab

SHA512
c50c9fd7bbf0d6e80961fb267568c4b82947507e026b1d14dbfa4ad368ee85faf1c5a0233ebc96d7ba10b786a5383e8d4504f8b176153171a1215afe8f7e5a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC504.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC9E9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit