b674f0fb3d5f5c0754a5c8b7383e5884afebdf3092042ba12adf6e6fe0d71c64

Analysis

max time kernel
142s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

361c127c4d6cca9ae2e1c702331c0b24.html
Size

25KB
MD5

361c127c4d6cca9ae2e1c702331c0b24
SHA1

e1478891f20a910d710b2bf1aae412f0e165c2b6
SHA256

b674f0fb3d5f5c0754a5c8b7383e5884afebdf3092042ba12adf6e6fe0d71c64
SHA512

1d54005b1f6d4a8c97caa2c0a5989ce4726e83f98b3483f963885abec4e03566d726d705c5549da9565d964b6ad29c1b69eccff6ba2c73df07f05915500af814
SSDEEP

384:Kdg2H8oY5GwuI5WOUtxKTeBfKTpc31lQhboLgWQQ/U4yhoy7jfIWrYc51IlSAuVS:Eg2HlYZ0ltITe06l+2NG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000002474359aacd032bf55541fd7562e9eb6a5e558ada90767c4f2cac1c8ae0f6dd9000000000e8000000002000020000000cd45fd096f8f2fc2d0ed858789f678e534a0ea17a31ed23a1b2866059a0bd64b90000000180d7b361658151f40160544e7f643072c32776d9b6c0a2b6783da42fef32d2b4c180e2310355e467a162572c6653496a3d96f7d52ae629411685394eaf3d1d54e695a1b6dce94088a6b3658cdd76d70ce9942d69276160684c547cc32740cd10372005b9310c776e34a7c8ffa2a8df96499e2bef7ea65b60dbf1c18a4e7a1dbd57d507a8be586b36577d15c8dea737440000000b7bed736c996a7b3e7ec1c5a779fa49940592694cadbac96a5e3c686932d305578dea407da5118867b60be575cc32439bfc26e59b2ad92ab4c285c70cb3ae819	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1C038E1-A40E-11EE-A628-46FAA8558A22} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401aaac61b38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409771332"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a1e7e18a2decf6bda6b4cdb3cd07ad18c5be1cda145c90391bac539bf5371cc5000000000e8000000002000020000000471d135e62d058bda575137b2fbd0db3b69768bf0c79676433e58eb6d2d845b0200000006b2c9ab1134572e85c60936685fce964693b4ef4034e0a7e6d5022e08819d5ff40000000774b717d4e03d837b8e0657ba657cdc929979f72b1d7d039658ae28090bee2d70ccb417c9f193fd36b088ca0baee19b851dc20b73e8ff50faefad06a8e06450a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2316	2320	iexplore.exe	17
PID 2320 wrote to memory of 2316	2320	iexplore.exe	17
PID 2320 wrote to memory of 2316	2320	iexplore.exe	17
PID 2320 wrote to memory of 2316	2320	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\361c127c4d6cca9ae2e1c702331c0b24.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d08c2596a806f19f44977dfdb60b9b1e

SHA1
7fe80b6a166bcdae1d41b0592fea7fa842b88ff1

SHA256
f32d057b9d1059b9a3e96d0d8ac0adf67c182405a286facb74df424602d9c088

SHA512
b92f2eaa07f75145c1741c32883a049204c6af54faa618fe9ae7c5271a258d94572d030e1de58383e0b8aa800b16e89529534baf0285bcc04c0ed5c202f89b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7450d676f6019503fccb51068442959

SHA1
c94ccc5d00c22cd55fa0f9fb94046c0ce4795719

SHA256
4ae76f4f53f5f94ea279909c53022704b31115810f313b1e1147df3c55e1edf5

SHA512
ce4e5182ef0e8f400abfc9a7cef4b6c5109b914fca02e456cbc5c158b03a22c70cdab136f5767dc5869e895f8a3a92fdd5b6be5e27389837f0b46af5005d77d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e2d42689d1b9c5470cf35bd9972599

SHA1
01589800ad8cad0a290806adb4310a8959c0692b

SHA256
1188c9d38da3a3068348210ae32c2fd16b7f994ef8f4921799544e3e40160c16

SHA512
98f1a99e3668477cb0c2575aef1be4933d017e1530ddccf001929b3d8a8ad5a8a91dc6044c4f0d0ddee2f65b8b2fa34305465199deb1524f49e2d70f6d66cbf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e8df01fdb03423e5b805b41f93af328

SHA1
db0b65b78d8a4f38faf444b1f81bb457985d404d

SHA256
ad18584135302136842af93ddc22a6e653cdaef147eb89db31b7b7d739fb1761

SHA512
710f1320b3eaebb87c4a78a16c44ee3c0ad0317bbf48eca1318f8b727eaedb936c6ada988b70f9b7e2b940993d2e63c7eef232215a2faff553a2c0e4d0fe9ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eac1d750297ab5421c0aa080834a0bbf

SHA1
62f4ebea03d4d53924fd2058bebc4c8ebdb8b785

SHA256
f48a56b2a1c4deb4f6cdc273ecd753b80edb0a70ff708f9c41fa7b557ce0fc66

SHA512
002c8464620dc74a60688446228fa00b1eb0abd3f49ccf55bd4f166e89c2c00724852dbb2cbc56a6f059ad96f81adec0513f059312a866d5076e003907f4c5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ad2354674671bc96c86a0e072c34a3c

SHA1
e07f95cfc92d31fac6f23fb5da83da6ba2fc8a03

SHA256
f3e0269d7d9442339f0e67a9db9c0434f58fceb51b9f5f383b48db2f1fe81973

SHA512
49bbb15ae26a9162d34597472a0c597135ee038f4cd1fded1ff80266b9b940a17043df733cfbb5ce41e8c0cc52135746e3243749df1c018d87087c6f4cbb20b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dbc5a9daad11c80a88879c7ddde0311

SHA1
0cd87e1ae57ef6287c28cf0c86452cf73e059f1b

SHA256
44f88881650eecd62465831f0eba78e521e0b9e9d84660662f3db19a81dbc07d

SHA512
f19bd2541743395cd09ecf8fe5caa82fd1c2c8fe9862a4c1a34c68ae7b9c932a0f5d0864cd00787b970161fb2d4949e0dc3a84c84d5736a0878210afdcc11dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
828abd08c9954ba92208b2522f668299

SHA1
aaa4716119fd353f897e60ad2f2fe708bc853fbb

SHA256
aed33319ae36fa138a4537a5b6f15cd852965153bb5eeb6640b7a52551f0cd99

SHA512
8758d493c5d36c8bfa4f8f735057eb621252846d191dbafade86ff52ed102f9e831ab2002ce30263f7dcf4832d45f4f72098f6c20621e918b06303c18bb1f39b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3375a9a24de9c647aaed1a320cf4dd08

SHA1
41121ff0bdc88649cbc1125ab4065f13bc366254

SHA256
3bc92719a1a3b6897d6adeebcf6f29a3eb22793947a19d68021d3f6ca63b3f8d

SHA512
821cab190ff76bc816805fa3329b32679048535a4558a905aa4fb5f04f3e6230aea4d85c70bbfc48b121a98de51600d16be82fbc78510eb1aeb44fa8da13baa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8f5e3201b6aed3cb2f8cbe1a8d8e717

SHA1
b6c587f50410ea06c8e42aae90a885ba5f1477e8

SHA256
c28357edb9328a243604099776231e1c4c32d0fc1e1e22e5ca27513add2d043b

SHA512
e4c90544f26a118531bbb57e5e4bf7c866cbe01e961dfac8637ef617e1fea076f99c7df71cbe5c088b38d54adcc7b3a4f393b230ff539545aa37861dcf047721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1cf8f6c4b70535598de1c1ed6c5a7a9

SHA1
4a6f7bfadb5d386fb34450387c7da9f41bf5904f

SHA256
8c26ffa954d9b555559898ef448f8985b003a6c2b6118715e08aa5401af162ee

SHA512
3bdc8700db2fb1781656fc3c24c5db6d09430c2d155df5158921efb5fa6508cf69c2d9d04003f73c876ca673503f337f9d7228a0b069b9cb718ce6918464a44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3231a7e1b8d204dd343002795fd92915

SHA1
864ca61b9c531f24c2c118363cde314f4c3dadfb

SHA256
097440b0f6be5ab19ea524f9a2f905a1913cdd0018868d9b6fa9ccd0971462ce

SHA512
1ebac910c8e0489b147a94192608261e1621eea141f4dc815ca9469c7056f8efde89f2a8e25516cb02b495d3cec721d024df085c5f4ca8efd7274252ead53ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4063aeb10674422fb007b38b4aececb

SHA1
9d601d68c852b073b4c7c2f1f451ae0bbec6d8d5

SHA256
b55a690a99c1c4dfde182c81a08c7da2f15998b4fcf725990c3750175f0a8f47

SHA512
b88872b97f4e30edf60e9ab33566b7c93146dd28c366371ee71774cdc819036b60e4d867eeb90bdc190a055dfd089ef0d5a717bca1b2fa660ce50da5568ba85c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0d187c180f2af650a4889ab5cb20594

SHA1
d85d9a965c17a5e52a41530bcef00b495123c79e

SHA256
fecdb7bd84af1605aa433979ed30cef2f3c114093d812685ec571270894a40e2

SHA512
e68ca488023f53f770bbcc5d75945d4d7cb899b0c940d7fce6fe3890d409f8b77a259c38d7bd6f03437a8aed2af1e985289a07e38e986e8fb51b2cfc9f3ee787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f5b0cdd2fb9b575fcfa4522ef083bfa

SHA1
06a447d7f7014a0c2289198a5c97c70531908be3

SHA256
58e1e7b09475ffea804668000556d6f2dc8e7e182900004576c5ce910aaa9c90

SHA512
d72b0c3baf89d99280700b3285130ce8933cb605116c6321c1b313de4548536c169f9b36ceae541e84d37ca4d76ed24f7ed3f351e23836974173fce0b9b90635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5214eec9d235f9ebdc7c6beb464dab2d

SHA1
ad8a542ea8b0f4345eb320d7d285b404da46754f

SHA256
df4192f6220fc897294016cecc85b54cce8fd8a05305d30ccd6891077bd5c3cf

SHA512
64391b9ab160ae0095dc43ffbedfec6b48766b47f8eb0f699686b0dc89cedb123a9edfd10f243bc7bf29a71515174b9c35ad6c2bda18e16f1c88381eeb9c9b54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab895E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8961.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit