c3208e5a042f1f3389635c0ca484b423de7804aded31eea0e6b3229e55b2f107

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

329ed391e7483f45f8d726a956442ee0.html
Size

13KB
MD5

329ed391e7483f45f8d726a956442ee0
SHA1

d367a32ce9a4d1ec3934777c21b2c07b94ea4c74
SHA256

c3208e5a042f1f3389635c0ca484b423de7804aded31eea0e6b3229e55b2f107
SHA512

0826bf0d1b29d3589f59c0e444173e14b25f85232c891844d8040b37bd83da6bdc7f94ca88de47aa08b5016d41b2a96aa78e130e8245dc82b6381360edce50d1
SSDEEP

192:F1CyTW7U2RA9bHhoSl+ud2OG+Y2g56htDtDtJn6pbyjLoddW4QpQJQixIAspQn:F1iRwaudw+Y/dfcexxup4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000c90efde2737a49e2971823a1178191ece9579739bbd63e9dfb37158532e41b5d000000000e80000000020000200000007dcd041f187945f50e591cc8546c7039e963f5b3f2f2fb39ecfefaf0a3d06c7d20000000bf670f6879d2f2db5eda51ca98c28f570c587b3f590216482eae493a19a5f7e940000000b581ee2484ecf82e0f086e24eb1c94a2e0ca773f509f55c21ac9eb6eb6349ce07c348cab1af9b31e01a385afd0ebbaea5ede2fdf985c787a4de96fd7b4c3bb94	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409983579"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000e36c0a2da525d7c2adcd568bb947aa4122d74804c846e31463dbd83f5124bbe0000000000e8000000002000020000000e90e0e400c3b88ca0fb5d05bd431089d0853b7d58b9bf982ff24a2409b580827900000006f6a82c4f13c91a166aca3eab35f9302676d568316257a6e44f78b6ef932891d9cd0e9bdf179ca4e31f5f4ff5a6c0452df946903eef6b951e296cce819ca7da9c159b48bb682069961e82cc043e3e1a78758d7af713ef5ca47dc698090bd57e160e9666ad63fd59ba3e8be8ec04bab5d9e59d8c03c46d054d6b8cec65fb78b0b73d0ca53569ae400bbb9c92105ba594640000000f8b6e83418cd2cb72ea0e0f01dcb6bf383f285e2c517bb8e50979ebde26633d7d33105f2ce54182286fcf15363a8c978f8dedb60581f603377cf400e878e6976	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a7690e0a3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20EEEC71-A5FD-11EE-9066-F6F8CE09FCD4} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2192	1680	iexplore.exe	16
PID 1680 wrote to memory of 2192	1680	iexplore.exe	16
PID 1680 wrote to memory of 2192	1680	iexplore.exe	16
PID 1680 wrote to memory of 2192	1680	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\329ed391e7483f45f8d726a956442ee0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2c68c596dc930be8f055a27b23448c3f

SHA1
8390490bcc67188142f76d689da184f68e33813e

SHA256
dbf30517371d3daa5bca8d147844a4a2a677466a29adeb6b9b90326a0afd46ac

SHA512
0a51022943bdfb8035201620d45d26721879a3b38bdf0e59e497a7bff97ddc57c913094207a291dd589c40f13a0b4bde24ab74d771e2353ff339a9f8ab78d397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5995d27ab57e5b937333eb430d562f6

SHA1
08fc92edc193311221cc38ec726bca1e6110f399

SHA256
0e9583771223e36e75e1fe5c7a5492ff46a0414c3000b8b9ed7ed08b26a27bd0

SHA512
b21359283cb5a2b21349819d1b974ce7b3b7df7d0fe817772b177b444cca9358b95386e025b20410d25017d5ac1a3ea483fcc33a5378dca8218d13ff306739fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2fbf6a799861e0d5bcdba9dc1b7cf2f

SHA1
432216b544a008e16822d3f46424102f7077a069

SHA256
b85c2f52058312e6361dd20303708c44e1f242a755e5d1dca98d41e8d78c16ca

SHA512
2f5650d97b786d65d08da0b0d634eae2deb8c5e98d84920da1279121269b7ef02a06152fe397595f2d5062c0bde935ed04735cb5b4e828fb8c2f8fc83d71075b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a797813f2e2aebea6405b34c7b609e6a

SHA1
42e3b1762906262a50cf9657edc08f8295015fe2

SHA256
87d0a67631cd3e1440b38335b90dc306d454b1ab97c9d4da29b7548e0e034a6d

SHA512
4008894d8ed8e488249f96d63b6e43cdb1102e594dd36d203d92443e8ea84b06a2cb01e35df73221f83d5f37abafdf3ddcf726bca2e1d713b45e38fa2cb2593e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d71ec13c5f0d888cc0dae6453f29a5d

SHA1
5bb051dca595eb2dee1f79e93f93b47936a63aa1

SHA256
1cedb805a400e235a985524b022734043abf2134af9e0cf15a0d868177dd1ff9

SHA512
20facdd748630ef95a7c804a36446ad5ffb984e60e9ac14871b59597ed9649260873b18c06e60320cc8e6960bbff7f83b55ca8328af940614487e88374ebd5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad5cd81a9935073cd76270b8534774bb

SHA1
3289942a101c72549bb183974574cacefd07a208

SHA256
eb01b4780273cf46fad48556f1d9ff42e924c97e9b3a1a55ad04f15f430fa904

SHA512
8bd41f4d36450b9b35f82492f6f8d615c4b317c6e01318b0471aca1a8f35f6f2f44480298d3379bada4ec8770d91f3adcca8486cafc1de800d443a0c1f7a9d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44adc1aa1115b742695ef3f8479cb907

SHA1
bb8b49274a1992a2bebbaad88116afa1d716782b

SHA256
f86b0e0089b20313e765b55beed9fadfc86507a6449659354ac9afd58ec39a88

SHA512
80db24207c26f306771eb96fdd38a33a3d434cb96ad90eaa4d833f48afbf87471b85734a3569898ceba2db273a7df1a86819acfe9f75d7c446c81385bb48b043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de77c43d93b832823127cdb220b12888

SHA1
884df1dc2eab15973a1b4694a37f0549d774ef43

SHA256
b5abb12c64fb074e12c6788604de53961e9269b950e5a56fdba945f8c3e32f00

SHA512
6ad531b2dba87e3e87cdd78b8a8ba53534dd30272d28fc211012925836160d6cf1f608538da8a7b6e896657f2aa9361486f2efbe533c65a55ba57e49674f3329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74546deda5c8ff9f5a66923cdc772727

SHA1
3c14325f460874b294bdad41b39cd3aa21ee50f7

SHA256
f43b1e86e8210af2c8835e32bbfb9d7a5eb710d5a84f087bcbb183446665f8c9

SHA512
9c6eec5f86608d3c853a2d5e37f0657512d3d665fadf19f7cf38c53747b5325cc1c469dfb6682fc3f4fb3ef4c8f2a37d543fde913c9a5bf37727ec61a0b6486e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
035b59d9bf51db3d933c9bf178f4d00e

SHA1
0057e7b2c7d258d9b6fb09b75dbe5b9e7bf80132

SHA256
d308641dd05b2d9818580a7df1573dcdcc08b935ed20d6eb138a89d06f1f37a1

SHA512
0232ec7834630a6101614d1513557c6000b2b4b0ed6b2f80c9733431ab8d165d102dc23ed150fd037d38b0d7dbb02a3432cb52a44eadfb2c03a93fd90b00075c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe086cc83b30394e2b95cb7bb5cf933a

SHA1
81e53633765f41a2fbe482a7f0b41795b33d5caf

SHA256
5c1adfe0ec1cbf39b2f3a5a621f3ab3ce5f35be65134cb87d92657463c6c89f6

SHA512
edc1fef059975edcfa0436088efc07703bd0016e376c26064574fab118bfa34b58100e8b7dc8280cd8612a48738992b4ac2d823ec8cdc6519d3b030085447fcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d35f4f00852ff83f2293f910457fc07

SHA1
75dd877772d7b39c1b64faee2c8b758ff0ac9a24

SHA256
f8780e2358737f1b3a60ba196f707bbd95fa6dce0ed46427fd236e635459d8f8

SHA512
6c93834c2141bc15c199090daa260170120f4bc87cd50d6ef770425740069ba35c85b4ca4751faf9da2e55e9255e0aaed486b653ca18d9f639c8b8bc85ac9c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4de406a29911f1f71caaca70a22f00b4

SHA1
4ca4cb66851835bdc64d5a44c13a2b50fb4e9dc7

SHA256
302e892c3bf4fc2a18631b1d09e558cf17267bb84854192e9d805a78df3d468b

SHA512
4cc41c0ddc2075803b42cca7ea06938e811053ec65f688e1d4d67259beed6c3f3815a8f9c436975e9a3e9e15156262bd452e93947c3237f783aef517e86dcd33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit