c02b8eb8aa472b109b8307aa39d542ca13078534618a5dcf6714df01dec6fa43

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

336f51c0c614a3c0d1019166b810f1bd.html
Size

1KB
MD5

336f51c0c614a3c0d1019166b810f1bd
SHA1

ae1d5804e5d109636db16bb9e25e568412a45752
SHA256

c02b8eb8aa472b109b8307aa39d542ca13078534618a5dcf6714df01dec6fa43
SHA512

9a45254dc329a9de773bdbb5636f13a9fd083bf7e7713da5ad7c24a7be76d4c21f7f0d41d8881afee255c4b5c5faf63799a7e7a321d54103accad0ca28378114

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD5617B1-A602-11EE-A140-5ABF6C2465D5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000554ab00e1cf12e14fe544e6bbcc82c37cd466c348961a7fa116a8bf05fbf2665000000000e8000000002000020000000eb32d9e6311e711e9253002c4c348fa54aa2ebe9dcbcd225906f6064465d374c200000004aada43fbd05d94d1d6ca953c688ad1eee386466438ba9b4c106627267afe82b40000000d689869ac04dc17967eda36bca34a5730cdfa3c61dc3f9b8dd09f5790e2b6dba0577f1a4463596696b1ed5e6a397d7d673795e1a802d60022ba93d62fd420898	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409985968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04880880f3ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000cd6052396459bfbc7fc05b86bdabd6de9ecb5db64789778f9765c86188392643000000000e800000000200002000000024aa36cd77c87992f7c9475e94d1694b4acc7bab7ab5ce1ebd27355d11456e3b90000000d47a94c8801b2c029c712575f01c6cdf35fd6170fd28d6e7bddd17377c6c78271a26da65f9cdaee03f1064b9dd74af8813d21a142c19c5c8df252f7550c689f7ce727bd846c968f8941879c50b22e53d00b0cc694d8a86fe79a7346ed5b25986a7634a9691a46a013f0af2fd564cb5e532c9fb509698c4b690bba94242f341ce73b2b994785bae909184a9c7d972e30e400000007e42d5569031d4468ddccadf364d810d836838ed7fc86af849bf27bf5224c2423df44e83ffc634326bfc640c69963f3cfb44101f38b7fb5081fffc10d9f11cc7	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2216	2352	iexplore.exe	28
PID 2352 wrote to memory of 2216	2352	iexplore.exe	28
PID 2352 wrote to memory of 2216	2352	iexplore.exe	28
PID 2352 wrote to memory of 2216	2352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\336f51c0c614a3c0d1019166b810f1bd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c736a95bcbc7fdfdee04ad4eb1acd57b

SHA1
6532633ef4ce7e1edbf69dffef35e69a3828aae8

SHA256
edb0e1690e753db55d03c5356e14cf5adab406fbc64260de5e2fad61d4de8b96

SHA512
54846037794dc5e7ea47f0c4d11193d6027fc855c5d8d1dedb6ab51970d4fc375d05072e0bae365046053dc6285ed40327049f30be157e823956841bfedfff05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e57db2f5210029c615985673a5c0b51c

SHA1
2b019535618a0e94a0a309ba980c3eb42f990c0a

SHA256
f1281c9723c7fd34b3c2d4bf401f5072910216810397020948cc2e4ec00e1553

SHA512
956b5838a42dc2cb25905a57769996be918ab1cd3bf280a8e56053d4d2a5a1523b9589ddb56e868d12bf4d6d1a2630852b969e32ec413f05d4ffd79e36882291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33788793bcc0adc6ab4970480fcd2f03

SHA1
462e753c4d8fa6bbab6dde6919288d34c3309f19

SHA256
7d829ade6c2f67b546586e986ab4cb73a8293be24ce1139310960631a5870541

SHA512
0b2e58d9627464349835a884a4af6d948fc1a3dfc74b66626925e6287c62bac0211e26c749f33d1f5013db8b8b2d264d03c66451f9ceb2291d9f0d85ccb25def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bafa40ae235d809900b7f76ed5887e55

SHA1
01d47b188118e4e17acfc2e26186f13919da7c65

SHA256
aabd34d5e6420acfec67054e1153f9c86e83ab62b9ce1bd80b70490e304d524b

SHA512
1704fd9cbe49ef069c1f3d0f8c9a07ed863b7cf8cf72c97d15b7c0de0be73e3b69271c26274f66cf94a9d84fca016751a2b355e778f4bc6a5a2fdb2f17fa1592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e78d945f818fca34a6ab53caaf68bd70

SHA1
4c4520c533c6e6d214cbdcaf80f8ffa4639abc36

SHA256
5a361af62090b5378d761b1bf5b3cbe81e7cda03e66d8f3b33e31e9357ff7956

SHA512
78ca11f456fb9217606e66d81d9b2c60016a49f342d3c961c9616d116595b8489d7f42ff9bdb9a6880158373410fc4cca314793bb1034520d2e30ebeeccf408f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00f610be43100774e01758f055af14d6

SHA1
988a9c865be7e6e054dd733511bd8f1257e7c6a1

SHA256
d7fd4d7df8408a48e87e7a06ac4c00278888492cd865ed93209eb2fd3b0e2b8b

SHA512
e7095e030386289cfcb6a7e17493cff685019a5d2338cb3acf014ceaa438bbfb202cfd8fc7ee66e3003ac7bbb359cdeb91de4680c835babf6162571b8052b2e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f53168b07ef91bf8b6fe472f8c0da561

SHA1
e86ab31123d6cea31e7fbeb215f7971646be316f

SHA256
f4ad501745f94b8edfae55949df795394fae3671dd59d79a30e6151fc8080c23

SHA512
614567ebbc8b0557b6ed163cb6bdac01b3bcc08afd18d085491825743038b5549f33b74d46fe4b879ed5eb4d1a1e9c88e163ff224062bce57566c80acb43f6fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
591e06e220f05f9a4f3f39694f6e6e79

SHA1
f972d17a663ae1f23ba8dbbc79d5202e345c7fe9

SHA256
53c3d1acde3fa91fec98f1da3999393854ba32e38eea0a304f9565f6d69f9940

SHA512
daaa0482f1d7d35bdac425566c1630ce999220cae21204b242597e97caa6666e97c2b8138578de5b00111a8da450519ea92a1942cc82efb9f52109d83600a1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c85efca259f4c489014e7943c1db1fbe

SHA1
6a54925e8bb83d3cae0ab983d2239de2e692be00

SHA256
535673eb1cb1f672e25ab6680562fa9bcf03aafc67832f445c9beda8faed165c

SHA512
8cb5645e37f0df09bd4f52baff998b198c1419321b6dd4ca3ee1227935d70f8eb0b36c0d65af8fe5a3b3afb327334cc9e639332129a91d8ff814df72ed8b0490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4256d41cd39a33e14f2600ae7c640fb

SHA1
331b827207efaec194d801cbe69a78385c1d0eb7

SHA256
eb460321f123ef882f98b9eb26e05d267bd671eafed1eb06daaebcbcfce934ac

SHA512
913858301b85b9722bd15533bd5854484bcea595025a2b66763b8947b456b2fc718b3f93401a35e0cdcc21353354b05393c6e4ddf16d45bb1ef09c8c6afeb5b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f8ed94899950696db030b8a394df71

SHA1
f51059f23ad0d684cb335183a8bf416c01389311

SHA256
81f8a2e28077f3ff78a414249c8e9478f14e825a3ec09fd7c9eeb6f6b0784af9

SHA512
a94591aad098afdec97c47fe95249e0bb3fe023b7a5a9a1190af748667be40541d1472b80dcd10aa7d2f09b142950adb789f4d5845600e6eea5c5299786b455c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
82aff389f577ee4944ba11bcc082d271

SHA1
d7cc18ce503bfefcc8558270b1965214e5671088

SHA256
87b4e663f55bc26e0f04d99669d0b3998597b13a10f1598bf35acb8f09d1e184

SHA512
f8e981b1b2f50f4fe815ef9f223a206c48ef44178748564d70e8f3d20d33d4a01913fd1324c8c59beb6433657d81f7e00439a172e54198ccb052c97440dd45d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64BD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65EA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit