e3927f54a313a0790a093e3dbc44bf052095c8856bebb7c08626d48c21267dbc

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4db2539487c6fd605873196e73a996b9.html
Size

6KB
MD5

4db2539487c6fd605873196e73a996b9
SHA1

e7ece3fb81aec9b9a96e6bbeae8063e8b8e3da85
SHA256

e3927f54a313a0790a093e3dbc44bf052095c8856bebb7c08626d48c21267dbc
SHA512

a66fe63f725676047faef9ed590e9a4eb897dcee3ae7423c9d4e8c096fc1c1e62e5231c60ef69aafbd64db120cedd8d3f8d17c5249940cb150421f8558f81b1a
SSDEEP

96:uzVs+ux7MdLLY1k9o84d12ef7CSTUkZcEZ7ru7f:csz7MdAYS/Xb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807f5d87843dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000dcd282e928cccefdcf0da1d0b70282de25052a965c8d65e559b32c8e93f132e1000000000e80000000020000200000001995314387201a91d48bccbf4f207f537249fef7fd5b1290e2890fdc09ff73bc900000006b024243e78f677c082905b127493cb08095a804bc7adad44e2708062036fc3b0e9ebd2892b57cf7c182dd92a836d2fcc9271ba893a5fb718ccfd5417cbbdebec2f6cdf74574e34b18cd5e95117f3b4b1e13a6073225d5b8efbf76a755182a72b6e24d580a7fc8ac5a9700c9a2150c83e3623f071448154f6bc6d2aafd4a8c227a2b118cb22eeffca03ffa41ed454d3f400000006f1c38d19605394490b609ff5510a76df2e9c0c86c5e9da412b4253d37a9d9efe209a4c8d68928fc3043ba20fd295a5c1eb206cc7c3a040784a10ee1f9b73a80	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410366075"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000008c5c4071c75937bea6ff0f010e2a6341ef6a64430e5d8c5efe663380ec129711000000000e8000000002000020000000c66cc5e9ba9ca37c2d914b277fdcd1d216d5a1b94dfc21745ca85210b53d502e20000000a4ee07bd88b6f98285ee36ff95a767011ed37dce3511b3cbd6584ad62c4e357a40000000d6079b3545802d8c2ee806c5b38650d7a1eff6ad4cf931fbcca7c09f221a19fd9597d6b0782315322dc4d1a8b8de4aa99f590327e62a95f34be7a28780ead5df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF0801E1-A977-11EE-A20D-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1804	iexplore.exe
1804	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2828	1804	iexplore.exe	28
PID 1804 wrote to memory of 2828	1804	iexplore.exe	28
PID 1804 wrote to memory of 2828	1804	iexplore.exe	28
PID 1804 wrote to memory of 2828	1804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4db2539487c6fd605873196e73a996b9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39f6a11447be3aaeee8351cfa4d736d7

SHA1
dc2fa8383ce1884474f77cc0850fc397bc67e235

SHA256
9e8e939437238c915232268fffeb7a8e264fb5d803846ffad30a840fb10112e0

SHA512
d046f695568fd09ac430d5e575fe86b8535105bee5626a6cfe1c017dadc550432346ce867be70e2a967bca99d87ef2fa27995fce5ee7cbdfc3e1100c0210d01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e129c7f10422557e34af48ede562fac

SHA1
7f9923feab2d300c7d8503b82fd8cc706a3d2901

SHA256
1b58a9b4fe5ddc240a8d9625297e963886604e0542a436fa72644b63d2c32087

SHA512
c85f541a9c265797428b56b11129a186636a8c85cd18b033f4ba008280cccb186b5246d45d89a01593d54ff93f238609586a52507690a83cee670b18c8e6161f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
585a2e1530f4b3e76ec05b4f47806333

SHA1
cf1fd41495015066959461b59f7bca1eb238a0b5

SHA256
050fc6188ea4716ced7a8d125a188209c3ddd55c051af8437feaf6120d6b6511

SHA512
782bb87d5261a9d2817b5e7085cae2deb9968f2f470883408b9c44286adece239d056c08399a02a4f163a11d6f528652e15ae019c504de9e6ee879e55b82fe6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1326f19c5414b46bed568e7484219c8c

SHA1
46fa1b44793ab1075684c1327a2f4614fc7a9593

SHA256
98013cad37e6ed5dcfafb7b9104b7669b21c13effdd0970e472d4940e6c9664e

SHA512
cea3574faabe82502860132a054cb8258cc7a6751a1c193a3007ebf817c54a02f726e4cb1903776a72224a6daa61280e8d792824e1a60c3ffbc999e1dbe248eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
299061a2cd8fe9a0d40ba0cd6ff0458d

SHA1
33a9e52a59474fd9fa0d56ca02693fc02d71f81e

SHA256
006292160418f1f6240aa0c66e5e74a29b8f8cea13c867bbfd850f90d0fb8eeb

SHA512
9a214050ee535c505a6049f7fb014b53e82faa7a8e4c048ae3a53daf42dfbff892d9e2e605fbf0b46f234b9850cec77d33782f376c390656631805ccc109257d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8bb15e89c3f144d0307a3aab5a059a9

SHA1
f94c21da28549956b4ee12d87e4c13b13ee022d6

SHA256
1e53826d250f6a82d111960cf77267ba2fa1b0659f3fec664756ba4b8e7ea6ec

SHA512
022cb3e10339050e80d9b057f4d9d3b787095bebe3449f351f1f6da99a3db5d42176d568a2740d5fbedfeb9d93d8ac2abcd0ed42d32c7795a67a0ba03bbd9404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf4bef61ab1235e293cd77644ac24c03

SHA1
de65505224ea374520a0e4ab4a9698b79420ea4d

SHA256
078da8c72759c7a82f683878d83a29b4eb16ad8d5bef652ccf24ec56fa554c6b

SHA512
4ebfce2ceff6322674c60bee449b3eeab4001808ebd9d60191ae400469bf9952e4be593b5d3b2b49ea3dc121e6cb91effe2609d58f31749451ebdb4fe31df7af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e97d6453052f3d454a0ccc941119778

SHA1
04839561307727dac46e55b8bf2373dfada6364b

SHA256
0e7cfd557614145f5df29f5108bfd3f64baf1a9c2b247e350011a31e7734d75a

SHA512
68c358f4e950cae54aee442d9fe46941e1347eaca2e2e4430fc5aa08fd353cc3e7fdc4f178bdeef7a1fce1a5979b2cfefb71fe78b4926633803fef55c4a933a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51435d399e96fdff3dc02451f965f960

SHA1
d83243359bf70d8b16b3a23492f125d3ca792811

SHA256
56843d88e01e533d46f349a674255ad8cc30de32bf933e581774d997df7b404b

SHA512
c7f374bea3aee26ab78816d0d6ea775ece70659a4ce1f4f0a95ebf8793c38341f048679439f5e7c860d8a3918ee60b730f16482fdbad907683fb0cd791ff4721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48f055c4d8301271f8ee6fc9d678fee7

SHA1
c4bac1f5eff23ad1e39c96c34dfdf5921dccf642

SHA256
f5f550aeb18a99007f320c1b223ada1ade24daa094b41465b0e45547a0e7cc2c

SHA512
cc597ca170b722604f63c8756a2b677ab1aa70c2cc2aa15d4403d3685134b6be03d8370076bd64c1e430cc118cdba9cb36c668c97ce2859bce2a43a10af6da63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
001b075592f0735993a48aae20bd770d

SHA1
8c7053e4642169c9fa8af2ecf4eda8b039ca4f52

SHA256
18774daa5d8e83edb1bf736a653d99f4bcfbdb0c594f5b6ea20279188c5b696f

SHA512
a7d125247b5fe3fef17b605464fd2d771486e3a60f448a9c9af8221f9f1d8674a3e32a1fd3e30c93cbc4f635d8ab9992b8d58d8242bebc57ec204ad249572214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
480e41b426b83cd3dbf0dbc5197e70a9

SHA1
88891b8ef6210a9fb49bab307cdc7a5aa1514dac

SHA256
23228bf39bf2a437fa1f63507f6aca89ad671a23c3ade0cf7e9c111fabae5112

SHA512
7ba240c4d2b6a2d20188e119ab7b75a78e4700744b2c62b3787e098644cbe3d0a532284400912b67546a5cd2e6419a5fbb3c6acb9011e1b5fba7442dbc476b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7f5778f17bb0628e22a58b0629a1b97

SHA1
d6d39d59c3027fc43a782949bc23bf141bb9e5e3

SHA256
acd93bf7ae841b8aa7b7d77352b3efd6339d48926e9004e7b0c1c47f6be27508

SHA512
1bd5fd2eb37bf493e3dd8c91af981c081bf421b0863c2fb629d5dd14f9a3fd9a2fa9a0cd9e09937c9065579916c1d905d754aa7029f2fabe06acc1d00e39bbd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8102a3a40608e5d107a41b9fb7ac8615

SHA1
2582f361364ae10373a8c4152a615ea7b6c606da

SHA256
662ae4d2437612974b16b101a910cd124b2bbd2dc0439a46b9c52d435a9108c1

SHA512
93195408a82a2f3e0d109bc60c5322cb6c0eccfecdcc619b0f5f02f67fe36942f0feb268950ece0e26a841e9e889fac4fe94e121a123cec684653eafa13d8cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814cd536f1acd71767d786cbabcc86ad

SHA1
07f1c8f96cc6c47a053c297f128e364f0b483ba9

SHA256
98ce29c3d153aa24c26a36b07664a717c344262e8eefcbb46657335a4378c719

SHA512
e45f157a4937f737f76a264cb36ef5240fc0fcf6e61ae34b71a09ef10efd0388830837779ef7790891efb617b166b0f031236bfcf2c58b61e108187977605804

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DF9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E24.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit