c84aa47e571ec82483a37b99cd865c35fb7475e845920c89a01d8e79d02b71a1

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d72c5617fb609fcbb73fc2eb0d947f0.html
Size

21KB
MD5

4d72c5617fb609fcbb73fc2eb0d947f0
SHA1

362e62495be6d0ccc1c393942bde6e4389b28f8f
SHA256

c84aa47e571ec82483a37b99cd865c35fb7475e845920c89a01d8e79d02b71a1
SHA512

ef555a5e111455feebbeb1e0829afba5b52ada1852e8d71ee9467177b62fc758d3ff466907beb6f5b8391a8071b1efb0c745feb0a4b5ebe53eb59f24e15cf0a7
SSDEEP

384:nL6wpyzxUzcJxZHSaHHjoICA8NJJuW7qJkkHmv9dXocdxnLkfTmTtn9LjoICA8NG:nL6qGxEoxSa84W7ckImv91ZdaTmTtish

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A5FA191-A473-11EE-9E63-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000af1cd6f6f4587333af5ae96dd973db433e6fd12b843496175e38d615af3e8b10000000000e8000000002000020000000f54862160c17a5da4e8984c6a704d66201c1731200563a0bc4e4f369fb2b0292900000000dce92a8487382677dd54cdce48cd6d2e3b93ded3019aad0b91dfa8fc5b17291e7bf8cd5bd590ec634808e51f0907ebe41259ea9e3cb4541887f3c91654c04645f604d811207f4278acb6af0b0ebfaa7fad80398c68e233692d55ef7fd34a1897aeb4e66a4275c2439f0a94d43d278fd4b0905798494791476b53f6b93afea30364f19b9fa2e6c1239df6af1192b75f040000000f8ab880bf3d5185759ea0b883ca02f79d528d2903cc30ca66fe7567e1bd9c11625ca620acd4aac5ddc3f97f1af01baa355d5ae359451b0364993cb86f7bda84f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e75e618038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409814526"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000003593506110d83c6eb7d1c29e7096ae1bad3f34b6122058c0bd04f452c3e54896000000000e80000000020000200000008d5f4494370b6cc3c82ad74a0dff8bedc6c4bbb60d7788252c5467099c6d280820000000f1d614eb53173fae6f96fe3b55634817abc1f8615bffe50190ee06cffc9da4e640000000dd8cb405f88994356434f47d3cc12babcc4372903645468795022cda10145a3a0e80b3c38bd73f1d577854c3352bbc7af63e12771015e57116f5d4cd56b6f485	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1780	3040	iexplore.exe	28
PID 3040 wrote to memory of 1780	3040	iexplore.exe	28
PID 3040 wrote to memory of 1780	3040	iexplore.exe	28
PID 3040 wrote to memory of 1780	3040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d72c5617fb609fcbb73fc2eb0d947f0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae2603a6e24b0458fd1b1d99974b21cd

SHA1
dab4c7aec6848620cee7d380705b705cebdb22c7

SHA256
9292754613022d12bff0ce57fcc7a650ee006741b5acfaade37cb9c5224aaa06

SHA512
790acc901d82e295be38b08188bfafc67230264123a27e2fadf571a0ac7d2f4a97bad5dede3b643383cd0b94935c672a876642998d37092c5e9f68981b8c1107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c51478588a37785b8c3d87295364d7a

SHA1
846f119e5f4df0d30969caf5619f23cd24823a5d

SHA256
f1dfb769e1148a6961bb557ae9c0682334cb5d44f7c291a12bd6dda7f99fff3a

SHA512
e1812fc2c4384084e3cc28ef8b67566a100d55988c59eee8e92faee48ba3e2b8c54b95dd74997212d70880795fce08ccd45104965cac94ced4401d9484308823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6fcd74d87d2d7333a45b6ce063915aa

SHA1
cfb7d9b83b6d5f3ce5db471fc3ba1198b56b5243

SHA256
992dcf3e1f94237c2758368824a11e2d90010e9d6e75b6c1ac5cc5bcbb08e723

SHA512
ec7cb617f48f5a2e8b91c66ccff9d36352ba8c15457ac35f257a6f7426f7a54dc5904b4c2b725113c5314da87f4797ca1f23b26fb963b5e4b4ea455c6ca3a076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1a63ede7db76810288e32d715ae4a26

SHA1
f8597bba0471ff224a4db01022785ffcf849296f

SHA256
56250828c41d2409dc26df84e14a5fcc00b2f8d6ffd88571698397d6a3ee23c6

SHA512
b8c91577a82a2bd3dcb6bb475f2685bbc382aa958d473798d7ca6106651dfc3f8be28e55e92faec7003f00c8e2ebc69ed77c8667fa2549c1035b626c005a267e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7de63398db6697cbdb00caf219f54b9

SHA1
5677fa0a6126556574d535a243774129c1c1218b

SHA256
45115e0cf03ad2c6fd5243cf07221d2242f9e6b66cf36859e5b8171e0d1518e0

SHA512
7ae4cfc1256f5ea0052daa874989c482650291dc46eca4619afa110e8e3756730cebdae9066b18de152afb91216f16eb572244dc40d9b5d9daa5b75ad2cbe2b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a49fb7749ad42959e58e6a1e2452d80

SHA1
cb402980a0a05658fa33838e47e296bb0ea72b9b

SHA256
0fc12449d7de32e65fef04f28004809e9041b37725a13f1be4ce1587ba9854fd

SHA512
3d094fd065c2c7660e94bb0842473539d5cc84acb39b2b7e5615903fafe5d06b4c7f9f9219f61876f7241548a4f46bfa7b216f5c455403d9e023464d8ed76300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7c138dced8eaec6180c13f16ab8d1e

SHA1
d6bb876cabc3ede9b98900ff4da117e9b4a43bdc

SHA256
e50fec630dffe157af61d645e83c680cf69af659c4aa1aa70e0f8962a582fb14

SHA512
05d4ae20005c430711cc95375a7a4307d5bbb84c25bf3c650e12ac436a48ce9b43a75049a09b5443a39e3f1a135cf3d0f4b0e37bd43152f4a73ba7e3b0f51d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ead2ec23d201ad3dd19d86b3994dcebd

SHA1
5a0e27d0224ba13c07148d82d5d6cd93cf326b42

SHA256
59f9c6aa03d1bd2bd004ed64249784439e16d0ffd308c9b97da31364e8812f51

SHA512
52421a79585ffb1246d3b236a7cb1519d70608d27edfc7a4f1311eede13b8a107510a84d83cb758c6f9d3d90bd370067259a366d05128371a35ab9ae32b7f179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b3a210280046cee3c627a2a9fadc4e

SHA1
340d5aacdd93f40ffc1f202b97e3ebeb3c02dadd

SHA256
317e26d2bdd2ebe3207f29fd66efccb2196d05f404b478f11f03b49e74e3f91f

SHA512
ab9155d8ea3aa5ee007d151fe1563a57b8f6d8d42d6db6d1399000e16fd43cf373c42655ddae6772c53602f8eb3ea8c8f7d4fb53adbaa94259d703cd3c83a66c

Download Submit