97042468285e43d11f6798b4fbe7559fc0c44456c806d6f57d5534aa63ad8398

Analysis

max time kernel
144s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b75139cdb7fe2a027585cf68db9c274.html
Size

26KB
MD5

2b75139cdb7fe2a027585cf68db9c274
SHA1

cbfa264ddc44f8006637d1d88022be0123d2c049
SHA256

97042468285e43d11f6798b4fbe7559fc0c44456c806d6f57d5534aa63ad8398
SHA512

2493eaffc1749579a1b4d529f100709b9e992c141b2238dae3d114ae6166c7e39aad33d9e28abf8e2cef9c740e7618592c3e4bb934d911fea864bdfb69861d50
SSDEEP

384:t2flKS/Wck435Zly/5HIoQcIo0qTbNICEB7lC4/ENDoxtDqIlIpm/QS3lD:y7/WcPpK5o00qTbO5HX1D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09E20D21-A3DF-11EE-B494-6A1079A24C90} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000093ce169ce6bf95ec5516131846139b5abbc9d5e634c181c46b29e29f2a968359000000000e80000000020000200000000e6198cdfb8d6f5cb063955215d39e1fdddbd7de6cd6fa89caf7f1924e3badbb200000006fad86f47295522c4c7789a0188657ca8a0e623a546b6c0ad2a1d423ab3e31144000000047507b2e82015adc335eebbe5be999f03944b36faf457d7c952d6f57ec13119a0e9fa94baf35ade987aef96fcedcd6e3002dcd8daf9178bc45bb9baeba681ecd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c038eeeb37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ec39e7dd995eedd95af2db8bed85378609751dd6bb81ca6904377f588279a622000000000e8000000002000020000000a40c4dbd901f448e123f9869e5a9382f9395c7ead8b8ed20dfdfa0196618519f90000000e165c465d71f759bfe9f9a6d7a6cb42a894040982755815bcc23316974f2e10eda9d431bc27581566c6ee5007f75b392ea2a30e05956011639207f2be9f774904f4f7263c0e0fd969152714b33172cba836e0afe168ae417e7c8d72adedaab863b2049c732dca711520e7781b3566dc8107c08096ddcf5019af07d41ff6518a91be481099567f1ae6446583121907a50400000007b5e5302e4691cb44a9307d0cdea7c94412bb2db6c904e8f019be119d3b1d7df041375dabfdf306852f65c5c8f93358fd23fb2b2719aed6b1195e61a4ea3da86	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409750753"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2428	2404	iexplore.exe	28
PID 2404 wrote to memory of 2428	2404	iexplore.exe	28
PID 2404 wrote to memory of 2428	2404	iexplore.exe	28
PID 2404 wrote to memory of 2428	2404	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b75139cdb7fe2a027585cf68db9c274.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
312bf7683a37f8d41d2a0753da4efda9

SHA1
222532ccf74c8151e8c94ebe447d864c367e0156

SHA256
106377cb8a354867fae481457c2fdd1abe49fe80b57ba2aab8b0bbef8a40d300

SHA512
7cd4e961123a50d03de5a47802a1fe1744c9bd9667c8e954049f5588ae8e5dc940c94d7286b61bd493362e6b127b7394760f04f425e96e2dbf49a62fe22e8fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc47b80915a1d3aebe4f187dc126369

SHA1
55f30ca69441907bcc87b696171c617fcd0fbde0

SHA256
9559a0107c138c8a898c5b1f649623786a43503b9bb6cd81bf6dfc3cd0633b0f

SHA512
f914c6ea3ab03001272780fbe81de46ce70945970e4d67959b74754be019da61de57b47e5ef89dbbde3c0857f562f1389984f3c08833750e8f7a779bd3095510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e57d34695d4163bb1d94f62d099e13c

SHA1
78aabb499291f945ddc4682338e6021c0d76f1c4

SHA256
5534eb0723a2fa0cd71bcdee7936226c71f77ab119064fbbb7fc2dffd1434699

SHA512
ba9153db7d471b6988ef644b372f62374be2b47024b8a5763f37b29308750ed1eb661edbf1202099438ece1fa5534fbc5bb479d123c380c2bd98a27a8d60c3d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
520547619a4be468fde4dbe8acc2d19d

SHA1
22e9142b465f1058bccf832e529ca3a0d78e1f65

SHA256
2201d92eb9a8399943bfe514f8fab0e347f3c1586f8729ad6dc07bf9aecac5ab

SHA512
104e1039f72bf26fd3883188580f0aa4cf858b3dce5c3375186067000af2f81f5870a8b1938270cceaff7197ef06e5d34af85c5744a0b7e46edbb05ad055c7c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0029b1eb465d47f1e41459656e25f2d5

SHA1
21e701214ae43afe8662eda67c84ccffab704985

SHA256
3887722550a35086d75918c73a40683399b6091eca7d099f658e271304269f17

SHA512
4c3150665effcf3f270c0ab0dc1a1498f80d7029328db02912c04d03bfde1ff6d306d67e111f030e542610e86dd85b7799e4213c3d1a25a9f35d5c75fe346e20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2bd7fad2f8c459867a44c60e1b4e002

SHA1
1b137502927efed3356dd1e8094ead322dcd9c05

SHA256
243f71f23a9a61f96190b5b3dffc54dc654ea08b2b8602091a7309fd25de27b8

SHA512
86a4de6cd520fb2b610962a9ec9e03fafebc8720c854d35a1604e6b757c9f1b6d68b8c28f6a84660c7fd9dbfa12df00ee31af1e69f80122943ab89ba1b35f96e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a84765d338b266ca432c3dcba7ebe00d

SHA1
a8b861d6dbc39de9b9cbfb0c59cdc2c34dcd3a4e

SHA256
c3db8b77a4051d3bb1c4522f967f09880f7776442f563cd2d327a53515a42c4a

SHA512
d3aca6a1b6e22a37e4a32a11634f92974c63531a95ef08775a819f85c4db35c94085b5d187622f5e05ac0b7873903a928a07791953833468254cbdeb8403f08c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e86b312711ac08bddc36fc096f2bd2e6

SHA1
e617131935e1b743f8927ae062a188439b586445

SHA256
e3e784acdb549d806ec6b7bb6441bb7abec56e390afed73594916ade46b01a6e

SHA512
de779dc8599589e18f78e31977997476587ee9fee1f5269cf35d823df7d721b5fd243eba4a5268bd0fc90396cc6afce7f34000006769f730ce5d1a347a7f3068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82f5090fb5a185ffd0e4abada37c21e7

SHA1
912efcbf2638270f3344d94bc239df06a0ea34db

SHA256
cf9f43c3bfc8dfd0869b11d4f8c1dbba75718e10155415c85a93d7639a1807a2

SHA512
d5d43f7600f59c882cd947d39ccebb06705ca2c5a4c07f1bdc6b72d2bc656b44b1047bc8ebe9993f5d80994a5e6e45def9d45cc4051c5e161e0d221d892d9d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3d607f7227aea45d4a8916bab702297

SHA1
a4cc8830d0539d163e55de05b9576bf287694487

SHA256
08840e146c63e652b4534af6ef3d3ed8e238162f8c8ca8872571eeaa1fe34778

SHA512
bb77e1ac4f40e21d491b32a213c6c0f99c0d5727ea5279deeda5f76dcee25422fa5da8e4afd882c0ae735cddad20c673b9e051dc2e2622971fb7427d089c2671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99b89641550185ad1acdbeddf1d2611

SHA1
770fcb80738cfbe32f62c65398597a7ab5c6a43a

SHA256
a885937b274b81d8eb7d3e2454a53c5d5d391e9c4ca9fed91dcb2b6de5afb72d

SHA512
4a4f9ad534e097961fcc6c9197293823b46358c866e7b944269aa7ba96af7d7596aca593b3cb7f32a4c9d540e5b90197733e4b1802261f02dbd983d5e2c3b3e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f181053d41b6e2d658299c1d7250cafd

SHA1
7f2ef0e40a4d8b7485371a705b2054259eb46532

SHA256
61cceb5d9f2751bd9056b6fb31c0e17795fcd7e374a590135d6f54ac5d4af003

SHA512
dd8153f127ab63f1475a7093c2441d4bf83c296cb40496ad2ef2480a3941d27b208e7b3aa08d230e44258e67ca09954c03c426381e1aace89677b9848673c9a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76801034de88be67ef16ced7a19f69c1

SHA1
3e70de706914a137bfd2084cc368b5ed6ea0a71f

SHA256
21a6c0c07266aa460fa47323a4fdd8ff2343a93e8baf67b4f252224cb8b125dd

SHA512
b6fe3f869d37af6451d5547d14bdf84238e6d7af58942f4bb5d58eea77e06b0c547db08e99a206f0b15230049716a21c511f889379b8022b47f74b5f0387fd85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e6106c4569f4d2c724b7d178c001ae

SHA1
884d72228173e333557ada331adf3e86ad7e593a

SHA256
261f385bb4cd3bb830ff4331c08773f86621627f65e042c028d3fa26c0fdcc65

SHA512
681463f35f6d1ec7096fdd6a3b62302df4dc2f86a9de0f5458742a6b6e58f2d5370a342d8183cc7ad918aa2dc2ee6f461e4328cd2648df7963765ad624bffe4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f3c7d3331cd6ae999e0381e17e6a2af

SHA1
a5cdfda69939b0a52acfd9d3a200ff13a045eeac

SHA256
cf568d3b59572a19bbc922f9b2b408f5d6b8c80560c29a6396db4d00c5fe227e

SHA512
ab8e656e579015b1336628d4230da58e1df2f338391a264f7f9e9fb3a50ccf41e7bd5f89854d43704f64f99afff8d4099325c84f23a5f09cd029cf22956b62ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f57d9774a1443c8ba997cedbabed5eff

SHA1
3306340d10726a8f25a592da1ce88c3e66c3dac2

SHA256
58fa71cd89bf03320621422d4f8b7dd72d3b7bd3263923c5cc51454acb3c7759

SHA512
7ea4c20fa39261e3cd6d98fb30da8f4b5c6d1c9e4b24f6e48dcc7fb44f54abbb20ea96a9a1f824466d1829eca7ab4889fdd867c2d6a231752b1df7e61cf91350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f833a60e0497a6c77bfcfe42c899afdc

SHA1
a8c91f0ecfa08b0ea19092757f3fd01bd1ef47fd

SHA256
0cf3284b2c91fe0308b411f737d618985e196dc5b3d93645b33feed025df5320

SHA512
f6d8b8b5896d5be4111c885dfe0bf56c354e41c8412cd0ff58574eccf3f20f7643def17cbe3d9197f15ba7935acfdfd42a39833e18165155ef2078a36ba4420d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab592A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59D8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit