2a2e05f12465b116738583f47a549695d18b5ea1b64f132535e8acb4d3a2d7e8

Analysis

max time kernel
121s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30308db3484392f138f9f1e826469dbe.html
Size

24KB
MD5

30308db3484392f138f9f1e826469dbe
SHA1

77d27767e1a94bdf014f5b010e73ac959412641c
SHA256

2a2e05f12465b116738583f47a549695d18b5ea1b64f132535e8acb4d3a2d7e8
SHA512

739515acb48778de3596777821b5f02e4cc9cc1b345ae7f889f950c792ef1ce9b7d6b3433ea5f4b7a37449f51ff668c63c857cea66535c0bdd7a7b792b45c96f
SSDEEP

192:Gl6MfbCKpRjeGjY2dkLZhVlOgFXDe8MFcladLPxq38pAmPqvGCqwdaQ1/+OiO/Do:85rRjeGA1m4y8OO/7h6utBEIybSi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409759588"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9025E0F1-A3F3-11EE-8B00-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000af364badb3b6692a4a0b597bb55872366e68aaa0e48ae6b6920eac824dec0119000000000e8000000002000020000000d28f753def59a2c3725f997345d10050f3db66d898a89650af93f3dc38a4ee0b90000000874114627563e354019872936ceac2729c28b3cc0730133220c72d6da00fe5260c4d6c6a13ccc69b13a65682c108a0fcc43a3e5f19a31cd84a03f92c807b0f427e9b49ef29ee05d3cd874fcd941003e1aed3f55ced50d5575c9da4b6f523341bc2d203fbb509f42d186ce309440878e851907b2f157c052d67f0c8ffeb1670d25ee6c5978d64e402557ac97e36df476040000000679cd43be8cd10721fe43cc37bfe4d8e20796308c02ba254ce9302740ee63ae18c667736234711b07e74fb8c03b8d431ff8a529f02415c39d391e5d0428652cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000c764795e6d563573168046d8dec6d69a36e6b534e3069a49eddda1404e7cac9c000000000e8000000002000020000000deb3ab09080336690edb20b76284eda613c151610ccfe792786b094eeeb0035b200000002fadb553ac5ab61473588d50220f3da9f37affc32dd6d8d3881097c1371e4c7d400000007e39efada7c64b05ca782bad33ca25cd5c6f1e48850a7d1daad34d18fa13b53a7465d76da03947bb236d4ba1b2e785367cf4d5d1bb398b1528f7291b8547e956	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04673650038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1548	iexplore.exe
1548	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2716	1548	iexplore.exe	28
PID 1548 wrote to memory of 2716	1548	iexplore.exe	28
PID 1548 wrote to memory of 2716	1548	iexplore.exe	28
PID 1548 wrote to memory of 2716	1548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30308db3484392f138f9f1e826469dbe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2657315244bb93dc149f87300cc2dd4c

SHA1
f5ec8323a2990bb90769f8a44ec0cebffaa0498c

SHA256
ee354848fd2c45b9b8de53be60439cdb01a47944e53f6fc767dafb981511daad

SHA512
15385efc9ea9744e2c74673097aaefa65946d3fb944122ee5766ceaafd2937401a01f0be1430f4b50dbccf44324d5f85fbdce9d32022eafa9c9f6a74ed5c30cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ef7223315a27c2f64e3e570667a74e

SHA1
0a3321caa24c0c539a4424fd57c1fcc063dc4ffe

SHA256
8fa8c3f2897abe41856dca9becb642bf99266b7b094144d638f94c6003710c4e

SHA512
fdc4440408372b44753b9269c0a26316174b261770fad60e40ee455f9e52e00db9197e98eb1ed40aeb3145be87ee6a3f553069091fc003d72ded0a443423e213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e7bf566b89ae2beaef511b613386bc2

SHA1
0b23c43cca55ab42b06492490e1bbabc93081e56

SHA256
ed4af0bc9a85a503a5a03b964e40867f9cab44ea22f1e37a3ce4348e6d41959b

SHA512
74cf095ba3de0514d663e2daabe4d521b41c19e8a8900ab4453cf0f51697b692729b41abeb8998a57dc167cf1ae91f8651c0dc8c2631240e0db79e53fa8c9c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce9486e78f30f9345f5fa1f7cb6a877a

SHA1
f0fbdcfa6a21bd5732a0e20e37608eeea333cac0

SHA256
5ac88d7d4d017a6147d24292015709d97bd73a44d1545e95468b5c7a41bef525

SHA512
66cadc521403466bfb5389670d1eed85fc4d35f6c666d2c01d98e943d2c7bea42a51b903c9967f334417f0de2fc5f4d45838fe9150de3a8911602104b517932f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8037b48167d79bf850cb3efea24c1d0e

SHA1
32c1e05e96e89eee00bc0210059233603a568fcb

SHA256
b5113148b98eeb4d7e53170d583db111c5c0b15f14e7731dc147ca962bfa3b28

SHA512
9468bf22af99566bbd0584d37c63e13f8e11f8f41d2787e373595434accea8930779a39d7bad6c22e05adb4fba0dc99344628ee76cf043900c9e5320cb54be3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4624e5b4cd36ce4c7f25b5a2367654f8

SHA1
f065849feeee01f56517fb7dd11a7675d5a2ab25

SHA256
b6538aa963b1c7015acdba81db4a0be00f7e6e88d51d9ae7efcad1ff280397cc

SHA512
371a3d849ece658e7ac9393c53b625c6fed27f7c879dd3d228d2f7a727808c07cb50a8c28d43e21eca3b1c5599f45557c1c3f8777eb36c94fa7480380673025e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2ad625b31dc1409c5a0f566f352518

SHA1
57e707b80d9798c9c8e153b49c366b9d54382261

SHA256
0d173968a7f032dc3d0521bc4a1654ba40e2be1e3eebae32f14a85351a82c838

SHA512
d307396e7c34b1487bf8402ebcf8be32db4d05e30830c8336d03a576da960d05af4e82cc70bc1a15bb867b82eb63e4d9f6f355da0bdea9e3db54c716e6e23603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df0a026abb5f463b55181f29c973786f

SHA1
e42642be6f2f684bfe94678534291e0655f68569

SHA256
0085ba84f4e872869b1e98e64eda73b6098f391219de0881d564e48b1a720daf

SHA512
bf960ab19cdb0d805711597c901557ce7b039b5f8cc1f19c32a4fea3f009dddd104729c400de009608dde791cb4b8e555bbc5f23d4630527c5c8e14300011b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b68218e7e1639976398d695f3c00d12

SHA1
f5e8db1fa841be4686ccaef040d62d909378daf7

SHA256
ed4fa2baf26e923ca03770e9e8ba035068c3c362964725f112057930f2860f86

SHA512
58b34a782dc04f980b34489f5ab31b89ac6d4fde97e70287a63214881e9a95dd1de61ab4a6c42fd88bfd8e77a950f3815f07818b1df72f407f04e62a5a5d8aae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4df9d1e0d81bce95a6338593be2b00

SHA1
b2c59f53a85c05a2e18584d4862cbd29e95e9c02

SHA256
7755439d05641ec08db8da52aa2551728e0fad73c4bec4249d8055a284404c8d

SHA512
17d5668b584ab1d82385d194ba931dfbf846ead0049b6d172259e1567085e8173c0280b4e31c3973af1d261dc024e256c66ef555c8d3ffbaf03805d316cc1545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e018d8a88a5587d085153d8bd4e7a669

SHA1
bbf9d9210a37e3378d81cdae0b09aa3172cbe213

SHA256
7346962bdaa55ace76e22789d297a6c8af36b476c8d05487296a7a3ecdc694ed

SHA512
3932462d6a35669c2bc2a73fe4e9db828eae10da0fd63f92dd83c731a9cd94ac1214602aef875d675e574f0f2f77203ddf5614706453624d97841bedbb190121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbeb8f61e61e5332d73cbd1bd24dd283

SHA1
a834961782aaba9d865ed7445a6cff2ac0242bb9

SHA256
0e2d2d637e978eaa8b1887758270d43afc9137c6183114518c1be66d76cb8869

SHA512
f83d083fda23c6a49c50f1d661c5804e827309270b297663d77633c97530ee7775563b8af8303f43c8d7007393295e0b205fcc2adfc7555c89e3b14213902c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8310cbc30800b4925b28665fd00b583

SHA1
75755030ea7576924d6fd92dc48508b8e0236e34

SHA256
b8fa48f6a23b7a57494e6259701c5070578d2cad599a2587d65f847194f0615c

SHA512
172663b9d8361bfe79ad4c1ee9de6c52b8762c7e0a7edd0efa05a61328d8eadf9c70c01a9197fd632627d70d14ad99e52a8e303d34be1f34e4f6ce5562c15e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6329212c309ce82b9e8954e5da33166

SHA1
5497d8d71fbf22b226ff9f4df5657db2ab10b049

SHA256
bf134ff4b6d8d7c409cc52530d726ea642c6a3c1fabce39bb2b3bab6ec8e9823

SHA512
d7c1676a6b8a4e9bb58594efcf821fb1f5bd42391a2c2b6b7eba7b60786b3be95c6f8420d24f40e46521d656d47e54e5ad8e30010de4b53371b48db69175b9aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00b978f2e232850ba91ca0593e21603f

SHA1
aa5ca62f09b3cb4622771f508a8b1bed13de1971

SHA256
a0b5924d4885af4af9d55fc95d3ca90b1d54275b65cdbdacfddb7172971ccfb0

SHA512
4c09362db54e34d6054d044c4d7664c0e91d4763e966928b059e6b54d22d507b8ea775386ec083e1a588560f9ca3d22acc0ac6bee72707d7603d7b47a91ffa96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
274f12580b14a5c9a09bebd4ef636108

SHA1
84253995231e0e184800972bd61be3c0ffe7f23c

SHA256
2c6112c555b3b0b25b6e9ce50afc45ceb4166838d1409e712a540d0d3ac4bfdd

SHA512
0735275ba71aa266ad14f7beba099fd8386e42210ff069431a795a0270b140dd18b2056dc6a783123816ff409fd2b717d741ff58d981e3cac400f3dff20b3a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30dec40f3d0fff11e131b6e6f893a577

SHA1
e72e756ddd8885a909452534652992c94165266f

SHA256
37ffc019fd6a360f737519950c5041cb09044c2430dce81b683e55caa83c5b0e

SHA512
a3140536a77347d214b0e617bbfc1a4c1365186ffd5f2b3e26291856826da630e5ef3ce39fd2e7709798a463d95cd5a7fbb704ad1820197e25794704d00e13a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E37.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F26.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit