199c1ee9e67c63626fe575c20e0a45edd9126a1a32d40e48b79009e4433747fb

Analysis

max time kernel
134s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

477427f467d81e2795f3be454f5e9e0b.html
Size

77KB
MD5

477427f467d81e2795f3be454f5e9e0b
SHA1

5b21c8bd04bbb82b99e3403feb63d53a3be7710e
SHA256

199c1ee9e67c63626fe575c20e0a45edd9126a1a32d40e48b79009e4433747fb
SHA512

313b3e5da6d93c4ab14b6212aa1c8a0425c2890fb4f106ba0761700a9e18acaeb7c476039d34f784692eb083a2a6cded63f76e28e3ae6a3d5d1aba13989cecff
SSDEEP

768:S6yDgAugpXJ1dUFCbXnD8re7YCCUpEqE69IM89KM9RAmfFT4aRCumTLYsfMedVJ:S6yDgA7pBDisOeF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{320B2351-A45B-11EE-9131-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409804077"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f743e1baf063057779a83338a8bcb568ce35c5341264b24131f85b70fffdc633000000000e8000000002000020000000a26e98c0176a5d781e199d3e009c0756535486ad606fcd0ba472f663ba12f8db20000000ce8b49f2c06c9e0c100ed04e0e4fa55ab7a63f9f187d702da9303642373c3d424000000066de82fd92aa431e910b76bfd31b494263b70d08e65a96fad15bc17c1b062bc9a459649553a5833d49635e1ec59db04377d7d9cd7ee18178409cb714ee3083de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000058ea9d4f5a74a21358fbfe5b6d6439dda3efd4d39348d0ee79a6745300196c37000000000e8000000002000020000000c11a470bd5d4e3734103efb5778e57824e93e87e052b8a7e0b6386576da0e9ac900000007e68ac4d96855b1087f978e61b7fcfeb770e534766836c78d569c8dcd51a52a42b57cef7d6b9601de50d266b80b355099ee34c521b00d38647ffe8f765e61108c3b1456c4c9449c25c5c982a6588ecfae0778d2e49db82306d9e6cb60ff01d38b1a5cc57d053b9f32a8b6510e143e9739a4845b826b4a38ff32d3b77f89707765469eace6100e51f94d43ee58e4101a9400000002f530f5408507dda5142fa261a2bc3ba4a4c2a3eefe8c0602a741d63accb7601d35d346e34748efe1d1631bf72915a2684d288612cc1f99e093d368a1423bc95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0efa30e6838da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2024	1972	iexplore.exe	15
PID 1972 wrote to memory of 2024	1972	iexplore.exe	15
PID 1972 wrote to memory of 2024	1972	iexplore.exe	15
PID 1972 wrote to memory of 2024	1972	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\477427f467d81e2795f3be454f5e9e0b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d151e4bab438e20230d0a06f1715a12

SHA1
869bbe2b4b1cdeb3c4419bf10966336724b241b3

SHA256
ffc4bce458d1d833aa5c4394b7bc9bb7a0a484cf1fc412fb1ee527f3dc7c5d63

SHA512
20d27bcdfd1dbc55e452a84d69461aa1aa3a9a1b1847f149d620bc27bbd4df902ef10d82d02480a249b678aaadde48f39cfbb11f22ddb97d6c80bf9c97507c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8cc59f030c89a824feea37fe8eeb41a

SHA1
26e46cf125ad5dc4050c91a6099cb56163b07d86

SHA256
1f3580aaab4baf8e5ea167596187c7f6d8461159d9396e87d0256313945ba913

SHA512
710b2c7a9b5553a30a9bf8085b9ff47511c152844acfbf1a4345a25d4618f0ff4bbb60df342ce70ac2c01613c299f3caa18b66c6b8ae3e7da60c469d41267f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c634b8bb7894d29a565da353c5dce8a

SHA1
e76a809cfa2b0afdc1f74c722be7138491a560f1

SHA256
b3a30383b4996c51d9e38a9cfcb61880e2c16010abd6a1f62a6d4ac656409225

SHA512
39f990b1e39bd2f7b191424c6a45a2196f194bd5da85e8bcaf5e9c936f3fb7fbdaa680dddc238ecb69fa6a4a49d91620572a6ee8ed271edd8526204593021582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6b8b0b84a974e27cf479a37a0e6c4f5

SHA1
2705fced01a0a54ab2774c65f0fa0b161e3f32d2

SHA256
f6de6e08ed584bbf829e324ecbd31d2907fd39e2e0bd3681dc3c9298e06369a7

SHA512
d3d13b43274c6d58df1ec5fa57e3303d7f8656d8fdd969a738da5b0e2c5e6034f2ad6070b2bf55473cfca650238ada3850b1e6c4f33f75a30db254085068bcdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
163b4a8f6a4adda6e74b069f81a5cbca

SHA1
d139d342686c593d566ecbe11d80026bb3350d29

SHA256
bbbb827a39cc8ad64acd11507429ab0dcc7eb130bd5d77e08ec451df93daf25c

SHA512
439d2d4cb7a0e0fdfa991155bb3687fac94af5777169c1f32b59707c3082c516db662785c2fa7509721c3a442e870db497bcef51ebc39335adaa126f370754f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3c93cd83b590b9e7d691372748a85af

SHA1
15a4a6d6f79cbf964c3e62b7e34f206151c37b22

SHA256
2e2fcd21b6912f9e0ed3deb62decfc74520e336e92095a0355cee304458d977e

SHA512
ec140a5340818496591ca2e2cb6111cfc1a5e14314766b7fcf330f11d5e718f60484471eff15081dff2ce0cddfc891a6020617e0afc5d7be2fa3434f3e050eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f984084d985d5772377c1611642715fc

SHA1
1292df7a1665983e7a17cb1f406e75a84c40703c

SHA256
fb260a9ec32106350f4d782c80891c218c46be500ca431d615afdc11c530e36d

SHA512
17510b93801be957ddc2d9e265869f3b1ab11f430663f0dab09206a38615268710a54a6cd994c7cba43c0bbe6c75d34d805fc435a7a192464d6af405d5b69d78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b3dafc45dc1ed6591454bbda907e29b

SHA1
a8ace58e0ba29faaa83ae2362b5bd3c5fd459e8d

SHA256
402cb6deafbf4ab20ac8b576a21a2421cb340484d393e23831018582a034f7c3

SHA512
5bf78efa33fd692133b8812d025430253147a58f13322b9823c52fda39d5ef41fe543a73a94e7ceb83138c2845af5410b68328f6c3a751b499d39f88a57d8640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72f75f4842c31f38f37c79fa434aec75

SHA1
6215a86bfc4aa913a68c5f42278d90a20670fb10

SHA256
80af6d9181af9cc9ddf36efdfa212972e9103022a169b391c990751a1352a01f

SHA512
6d7033a3bafb07c02fef8075508607f6ccb403021892d338370afc6bd91d5ecaf7b1040f71e4f6eb46968bb8f92685db583717b059d5484e46d934c552f9c911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
212f120ee4a2cceee3d4bdbb0b3ccf7f

SHA1
b36eda0cda3daa4789835cc51634dad56fdc518e

SHA256
ab1dda3f0ae9b5cb40de92f5cab127b1faabab81b37f1edc8df8d33468d9bece

SHA512
77688e16cef1a2ce043bfd227e16a0dab3fb0a45aad215947665a4bbc59b0f1e25e8399246f8f3abd734ee2ab215e48e31512246512ebc6f632a39666dfd88f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b77332921f237ade64b2580dde66677f

SHA1
f1ace552f97067b21ad44fc93a596ef1b285c397

SHA256
4e0d30b6afbeb2bdd703f7ccb591723be29b02a2ba2984a9fd5430db81450737

SHA512
c693a84e5ffe0e7a5c9b818b688d7f062a6687cd27640c0c23ea322dfbe3a3e71aae0fe09a57279b100ebe967f61ca5948481c32b2974b265709a15fe107465d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
766f84137a2c1791820c517c3f2a66a9

SHA1
9c8e867afe94e1f63f9120240a20a3f571e92e9e

SHA256
64e57d1c52bb372d4111b744d0177c8c94913f9fa749b1d2485727a75a1f5ff2

SHA512
c7d620ba96c0b234bdd48d5a73c54781b4be9cd7129eced2e21a6550f716a08dd71aeabdc837efbe561b7316739b3b2d01498954b2ab06aa782267c824c8c58e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db3d727c4792ac227a05a6f71ffea90a

SHA1
4f376366862abd7b974039b3c2a2f526cdae75bc

SHA256
b2636423eaaf02e608a3e08ebff51084e6f449529493b5144792714eb9b38fe3

SHA512
f412ec56dafe3f3ad40d745d8fc320e3305748eaae9db45d8be3f064aef3a1eabc919327f450ace80d53f2283f0bf84a1b91c43c7ce2099568e5b7ed1682fcc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4d43796c7cd7dbcba01078233ab2dd0

SHA1
f3b4674159b96920e3a2c4a4135750e8b6922084

SHA256
83d38067475becfc15a5d960bcc40b95f9b093537973467a3e42ad8c4980061a

SHA512
2828c3ecb5cae57d99e3001fee1b961fd75912f9d93876fb02ffb8e9fdb4e447b17dcd6d24abc82bfcbea2cefdedf6011b6cd357f0b0f3cf47c380f852d44664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bd31fdeac101c02843fdc226d9bfee4

SHA1
ff59ae53151bf63f1b794cf594ff633274542684

SHA256
4d5cd385d342c2ab17cfe5fb3140471f633723dc4bc08fcab584eb5333231f89

SHA512
5bae241e04fae64b9ed1b57a69d83352fe25471723a22e82e5ce822122faab06c1e6efa58b7830bf2a45bb0ead02e59020c37bc9af107036ae12dfb979f77e49

Download Submit