7a5b89aae6e231225c7287bfadaedb0408592d3a73de3bc8d82d9bf8d19e3a6a

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

351325c81dd7bfbd609e1dc6054c23af.html
Size

51KB
MD5

351325c81dd7bfbd609e1dc6054c23af
SHA1

10e4d7cddc5b305b273df34560a4137a7c0be544
SHA256

7a5b89aae6e231225c7287bfadaedb0408592d3a73de3bc8d82d9bf8d19e3a6a
SHA512

6a270cc214a6f563056fddc7b108ec745a00152c42a47c0f4776aac51e9facf28758f99845823d036d0443701a01091abfdaf4316dc3534056d0466e8c623ccc
SSDEEP

384:sJXa4kQY7ePWl9XBH5FlpTSy0uuJAjzEoCAu1kJs49ZD3V1C47JzgxB40NCV:yW7iWnnvTQQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000024cbfaed461363a4cf32b96e48702ee306c9162873f69bdd72ccb5e2da407c9f000000000e800000000200002000000008f2d7d9a01465c54617f9d4758a52bbf19a3c43157f39198a9ddc340e474d7b20000000dfd6e2e1c874de258ce786f4865cf5441e2753ce6f794aedaecd15b3de6dc66c400000003397b2fa97905cb14e185e545df19650fad639dd439b0a60427ad03bdd4269647d298b0c3c300833261ca014d8e5711dd64f39fd7f02bb313851044f354362fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F99EC31-A40A-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09932e71638da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000689ad7cff7acf2addaa11962e092102761212398ab5f0ceff3d24bb5408a90a8000000000e8000000002000020000000ecf3f38dc77d89864ac676cb56afdeb9a2e9ea197b4d207378778eaa0fd787b09000000024ef219250de1377019f43ee86e7effd32ed61e411041a67250906b12393ef58a458825e90641762f4290bfc9203ec4e2496e63f54a469c610bdcaa5b5ee5b30b4bd8ecda087a58a25f47cc872883c7e4cdd096b16ca86b637bfdf57d518f6784aeb2ebc95af3fa29f434d425f692469569080548bfc2f40cb1061d3c4e52209166818abe94b789b4f2125812e6eb5b24000000096ff188fef75928b3c0ca00d36bf343a3358246b53bb5367d2af76db8f83d04f5da84ae3dd1fafab9694938b4c9226d96b8eb09e65589df7e3e555fd63e7ffd2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409769243"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2932	2232	iexplore.exe	28
PID 2232 wrote to memory of 2932	2232	iexplore.exe	28
PID 2232 wrote to memory of 2932	2232	iexplore.exe	28
PID 2232 wrote to memory of 2932	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\351325c81dd7bfbd609e1dc6054c23af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c26df59dbb6107458123bf4009293e10

SHA1
ee58edd72cac655eb599dda3b5f3d290950062b0

SHA256
081da36fe2fa365d4e0e4ffc1fd7564097716eb72a8c33261458670b7cba6d11

SHA512
f8d7ee11d131cdec8317d08c6e9b1e04d041ef8fb8695ee6057707037eab80f0454169ea45f979b9dfbc6fa21adec3de8a575d4e63697a8b1210c6422ad30ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15c2f8ed6d078d833b0e789f39584edc

SHA1
e108c435610f2dc8cda3fa0732e366760d3cd4a8

SHA256
8bec93177e2c1d0bc4cea6146568d8630cea80ef8e8dc1265145edaf62b88831

SHA512
a8fd230c5d9586915cd56a65693d8a412c97786b216472430afe5e15762d883a6731071ffcbd309b25928a2df994aee9a23c20d4e4341ac3ae5655f6ac292624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c3bdde9bc1555164eef1d0dba1785d3

SHA1
cd638f7156b367208c75ad5dda11ae61ca5ebf54

SHA256
80a5d369cc15d7e6fc3dbdfd017a0df19ffdcc982b3fc82b497b8f81e0e9538b

SHA512
3afb10e01841a82ef35f7e7c214cd129c2eae2965b24dbf41b10f5c58ae184ac350cf9960b6e2023d0ed02e1108c881762972ad8e2457656a4612e9b21b3b866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b91244826288011dcd014445baab01fe

SHA1
0a27216761293b9d89928a9c969a6ba34cbc82eb

SHA256
be3534927874accc3ec98d919673ad1aea3c5a9392edd250de158c600adb5d3e

SHA512
dec061457b573fd42f653cf8d78606ba7150314572e96be274a2e27c9c951f013668a6a2e70de8b43f33150d13cc207f6f667c861da70d11989bb40c01e13b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c39baf5e3471d0c51bb9f3f33ad7bd5a

SHA1
edbf825e1a0f66098ee060dbc60a85513dccc141

SHA256
cfeae089fdd1bdfc73886a11f380e5bfe2d46ecb65021acb48df1c1b66b1cc59

SHA512
88e092cb4950e7215789a12d29d9b889e354fd65dbf6e5bf0c90c50876591d9b17215879a3369b3f6fceb2cfcac0506055d10b80aa7d9baf887cfc2ef9fcda5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d36248a0e268a97cc9a4db74b5918a99

SHA1
e3dbe82841ac8b7bec1fb5928bf1e95488982955

SHA256
1a348a7ff7e85734056649761a54e37d2b0246f227c464e4e21432be206210fb

SHA512
8649a9a07fdf2dc4fbfe51068e73fcd7cb7ee9c94c44167f8b5e0e2f12d101bd03de2da4adbd4ad21bd56e28ba5cb63aae21786ce12f2de7cbfe0f14718481bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6810a43cbf9592a1a6771645e3d833d

SHA1
facfd96cdf8e2dc1948ddeb434442001cfcebf98

SHA256
a0fc554d281adc4f027d8c562cd9eca82a3fec714aa5710c3d452a30b7822c46

SHA512
fbea21e51edd6694a71efe86b501143fa346da0fdc8d7095c7144f040fdf6ee300dc1f4405e4d0be77ceedaa77ed8d5b168398c4ac80569f57fb35e9c095a1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c97d987f3ea4816eea6e7281c4a9c58d

SHA1
71bfa6f4a61d26333f2559505547f4b0b6ef770d

SHA256
65d0255e4ec7e59c05950348eaf22bf1755b51474ab8bb5fffcdd371af4ad082

SHA512
2cc8c0b3e298fba30d218a13ba42590d56d4faf2ee6939d2484f3e1d3891f4bf4103ae4b5364d1da8f3055c90e0d5d94c2a0be97022dafc78935d0de1315fab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba31c3daecc5b2d1ff7cbeee20e85ae4

SHA1
ac06156347a15675afe3c9dc92d31b4a438a7bb6

SHA256
c3693caf7be039602e6df7dfc472cfba6de74797886af455a7d01667c58ad627

SHA512
8f807d270ee00921d4774a5f9b5a419e95ae54c898ba9d8cf4dd2931874b37ed9a63b4ad4259506195d8c9f0c3012ec1f7323c7c81ffce400491b6e08c57b557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
436579474ad5c976c9bb17ac57618072

SHA1
1f88e4b372288d16e0f109b0ad86762695222d0e

SHA256
6899979d986ea3228edac1c41759fc8cb5e3d43b14c44e8cc91ff65f66304647

SHA512
6ae1913ef27a81f27d229fa1ce6a7f843f86556540ca750bc5fcdca059ac4be27b7c292b2ec17bdb76d1efd1ebb4312e7da3d1e3934e31b01281bb9288e056b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd415c0c5560912664174cd33955b706

SHA1
c722ec21dd3a143024ccb109ba5d1f05c0aeb0ec

SHA256
2a1c7f3a2b607987e16cbb9449cb439fe6ae9a74447e66cabb9b750f0fe80138

SHA512
2594ac4c7451be13456100b239ca7dced70da873f9541dbc6140b60f2e9d7fecd04706a68cdf18a542a083558b352538da74630e2d45983b6157bf32e4d57a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
199b2aeafd7362f5b9af20a719a64038

SHA1
fbfc06bac5676e6f714769b66ebeead996630066

SHA256
42545ab12c149a83cc63c2a076a880d56721a5161cdaa9fc468f27cfc41105db

SHA512
ba88dfb3108a595cc4c6b94a69102bd8ad980669ae44b707846ca4ab4d023da268a0cc0bb034ff0f52d6395ece50845b4f125487fad28e81f7819d091c832b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41B5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41C7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit