a219ff5da4e733184c7ef17a8a52fc6717d1bb69fd25197381aa4dfc8b329e57

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

34f8a47ef316daed06a0999d8c6e2f90.html
Size

3KB
MD5

34f8a47ef316daed06a0999d8c6e2f90
SHA1

7618f87f743eb6cd8014f3c3cf06b66d66e43cdf
SHA256

a219ff5da4e733184c7ef17a8a52fc6717d1bb69fd25197381aa4dfc8b329e57
SHA512

8c6032378baa945d95661961e62dadf2e68c96b68d181708eed8b7160f6eae4cade7edc1bc301d9adb6742d3b05504ba370f2f910c558203536fff2650557541

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000009300ff7589d3890b6b70007bbaf8a054adf5c1c5d93d133c6c0cbff02f8d70a7000000000e80000000020000200000007aca1647582cbafc272f2caafbb36d4e09242c8bbb207b38e3f8d23cbfbbdb1820000000be54c1f3b9cef5cf1934048b31602f5760472c1f328fb498ebcb6c6958c5985240000000f205398be0180f044d1cfbedd5dead479480ada8dc192767e432de2d759b8e9b8ecc01bf86335ff8aee1f33191ffccc4b3195dd2c03330f35210a75e89b91697	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3017b5191a3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000fc6da7b5b6431c6e0c96b7ae2f748bb2dea6c1bd672e9cfb5b0030e675f7a317000000000e80000000020000200000003094a46258afc3119c28cee337b93e864759766d1209df92d35762c2302c1bca9000000058191c3217d1bb7db27513b47a68fa192ee995ede1108c5cfc0ba5f9141369a77a776fb4fb0da4a6776ad198a5958c3e2a126c9ffb449640777f6f182cea5e4eecebd7a6549c672b9c9a0fef179b77473bbf0e6fdfa5949b55d0d5f32676f0c6edca13b4b36522cf4aa45865f65ba857c1b382ff723835f83b1c5c0ffb9689adaa558740384788cd946ac06443b812ee40000000aaf8d7695eac042ee3794598b9fe7446cdef0a9033efac0eabe1c90c065102a1010c3d17ed6817e52110c53d55ec78c934ad081183a41ebdb26abc356850cf6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409990512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41C36C41-A60D-11EE-930F-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\Total = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1332	2028	iexplore.exe	14
PID 2028 wrote to memory of 1332	2028	iexplore.exe	14
PID 2028 wrote to memory of 1332	2028	iexplore.exe	14
PID 2028 wrote to memory of 1332	2028	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1332

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34f8a47ef316daed06a0999d8c6e2f90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68f6a8019c9ea90d580215c1e166f2db

SHA1
0eecbeaa10370e2d011e7793c1d248af4945f487

SHA256
f67d527b9c76ff3a9a634ffedda9805ff2de338117a923fc295b7c081f0de767

SHA512
b3370e30b61c66291407357774521dd9e1c0e0986fecbc85ff32afff7973f56d6606ab9b2c7d3e7ec677404b9dbc9b6ed13a98783ab3427babeba476e8992234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a964371b2319552b5010515efe8b4b2f

SHA1
ce058996e9bc729ca1f3da395faa98a8e0b31909

SHA256
96f6302a91405cc8883b86591f8c193888cc096575427564d8ed7872e711316e

SHA512
28770ec13cf96aca2f33325a3c14c0e947e8eedaa4cd2e8f644745a033c3e0ef519e32a67d8b2370dc02fb6fcc298080355a86e00104c9973e8ee04c53c07b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d326754246eb60c663e5e5d369d9b7f7

SHA1
badb43795845e43a519fee5cb63f0f9956a10129

SHA256
8f32799c570f44c4c7600ff3d6bb998e0928628a601a4e6072f9d47abc0a1f3b

SHA512
5084cedcca87b7b627a9394000256444de16e680cc743427358d4a298390d3285a18c4d50a5026d3cfd7c4f2ba93b96690f9214e636a3a8ffd4801e50a9870c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebec713414822779b18b196483ef62c3

SHA1
b6b0f96b5c08bc126142796f793a5a92fdf656dc

SHA256
eae5137b0d490a369677977de0688c2f7331ce8490551c94efa7ac4126c1469f

SHA512
1e60eba6d6241aa16fdbf0436680d93cf2816f4778bf604bfebbdf83fcb1b86c2bb63b5a9e57e48fa1faaa1d33c73119ceb45e19594aa5b3ca26016f7bec4764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bff50f8968137d595d2250d5385104ab

SHA1
0f4f92853338d2c5715a0fe1a62c40b86c52f82e

SHA256
b9014a934d6f09d6639a7c03861bf9d070bd305f42e87737c08ca77530ac8c3d

SHA512
ed0fbc1bc92f9d88288780d9d7a2e6706cd241c5f85e5f6bc0c7c37e4eee82f833e7b3767c06f0bf0307add6711755e0c5b47746783e6cbe2ba78a2c9f38a61d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec3d400aae32d90beaed358412df4859

SHA1
4691c387f7298795763e4a3f785532ea513a00e6

SHA256
cfce58f09aed35fdd2fa26801d81331a646e14842fabfae8e8a0f52ab6f8c860

SHA512
5d0e7f2d520082207849e9da61353cc9649b816088360124b7f2b07590bec46280c6c4632cd8222c92fcc3e5ea4f47e0c5d856e4052665045de408004115fd40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3edab5f3ac3effb57d0d1cecc1259a49

SHA1
5dd0e6fa424c3c6c1154ca65f68b0610b66a5d1e

SHA256
558af6b8aac171937068cb2e74b69c3bd14f15d811fad1e7a8e853b411410fe0

SHA512
df10b97545af1c733e5756076a8847302db68e0c9c65c2f39f5ace687bceadd9fd297f365d0ac8325bdeb43bd97291dcb226484e250796e01aef912f60073421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4baca924c22385538c124f201d95a9c1

SHA1
f4fc6d81a31b64ad4b981e7adb5b751f34747391

SHA256
50de084b72eeb773d77695b71d8a4eb1a48f12c404dc36f5dc46079da4b1419e

SHA512
5aa7cb7c87aadb4d714e415ce24b260d53e68fb725358a935887117158106efc60dfc48deab34c592bc1e87199d3350becdf24dd3037179d4cac2ed0ba27daec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc4d5adf68cc409b06be3a3472d0a16c

SHA1
6c01c2b81391c04437a82636d2543c5207de104b

SHA256
c968cf60dc7f760ac373f0b2afae376075953b414c7c6734ce7007e586d19753

SHA512
896b981fe578f24728941aa204f19249966fa6a49cc4bcf5da0d90b54e7bd040a48a138236a2a76aa4bd8efa0fb07ee5dc1a52ede3ba21842d34ff11c72c3f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1087c90e0acf3cff021d3748e7599f13

SHA1
875dcb0813c0b1e85ffb0505778b9ec3dd61f6cf

SHA256
ea41b84df1a2f760eeda8959a1dccd5320b93e04fd2615504053a27107eb1f40

SHA512
b5bbb64643350f613ae65d925dc2ecee04caf55621634f5de2cb7426d82dd552fed7f4fe7531c29d77944ecbcf1398e52fb27d5ecfe2636aa124d2283c6883a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3a313567175c9b2acd32e1b6015920

SHA1
7392117e553fb55ed9bd6b438594090a24257718

SHA256
93be7a7d8e0d5c80a99b53a9510bc57c957503c396f1b2d81155d704ca30b429

SHA512
421de436887567e875da29ce9b7ba128d91b688fff4a9fd43f0651effc8a57df014feda7b534289f18b09d3a3d650bd2cbb806ca714f9197e2d27887e33d3628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\recaptcha__en[1].js

Filesize
502KB

MD5
37c6af40dd48a63fcc1be84eaaf44f05

SHA1
1d708ace806d9e78a21f2a5f89424372e249f718

SHA256
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24

SHA512
a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1892.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1921.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit