d7115a5fa9096639d30146893bf799a28252fa93552caff3c98a327a09eb2098

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57c4f1c4c4d0ababa893a9fab28a0c94.html
Size

895B
MD5

57c4f1c4c4d0ababa893a9fab28a0c94
SHA1

cde3d658ea1496409284faf86e58ad9a7fdc6f54
SHA256

d7115a5fa9096639d30146893bf799a28252fa93552caff3c98a327a09eb2098
SHA512

8f3163f404172d9154df01035826d14fe89c624bf1b6a627acb963262aafb06a7e6a742f488c84ca855ab666681c1bb9e094ab5d816a9fbbbbcc0568d3656739

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{089A08C1-AC25-11EE-9BAD-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000007449036d1ca999bdb471fe109c0e32931fe26c4ff9bc14ff41425d3a0df77a92000000000e8000000002000020000000ec1ff3cce0ee9235717809bf22cbcf3f56445e40f419f893f89262b84c4c4b222000000063f426837d5ae1b0ddf9b9b99d5414f890c3b026f21aa4c85d9d14b9f00ea67d40000000eaebecb5239a818fe2589e226194c9c840887aed6965fa74a2f128e1beb54c7a03b60b7643d0e3d811b9dab9888c48286aefdc2a770daf1ee922319fec358336	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807823cd3140da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000215ceff7f444300ced50a7231735c612eead2f1160163bded6d89ba12d21f337000000000e80000000020000200000004c9416e96a4daf42255f7d8fbf8e00041c8feac7c788cc001238da2dd8c09256900000008b5ba7855e4c27502d5f9475dae5756d41b278e54b353e7ae1f7377950fcd53e0ab04da1ef1a2921cb5446317ae64b6b8322c68a5ad7d07b27a6e952b9ee345f1645a3be407105d6c2542c37e1e1b30a552ffe046b468f348884b696000512d9a796cb9a9b288a5d84e64f5215bdef896478c5543a9b9167b3789b57cad40a39d5a0002643155d44f7d3879652a11721400000006e013f560c499cc77c7c3f3305bbee2808460325a6dbf9b38b1e123d0a74991860837a6d72a59fea4c7e02db540f09487575c6d6765906acdf9c60ccfe9ad1a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410660427"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
1160	IEXPLORE.EXE
1160	IEXPLORE.EXE
1160	IEXPLORE.EXE
1160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1160	2248	iexplore.exe	15
PID 2248 wrote to memory of 1160	2248	iexplore.exe	15
PID 2248 wrote to memory of 1160	2248	iexplore.exe	15
PID 2248 wrote to memory of 1160	2248	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\57c4f1c4c4d0ababa893a9fab28a0c94.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d16bf8548f541e3d4d1cbac81d2bd037

SHA1
b10d5398c2ec67bbfdcc02c764c96b3bc7cd4ef0

SHA256
22f992f9336bfb3ec60ef033fee26fd76465e6610fb16d2ed6a04f1a04568e2b

SHA512
b15b3f907fd5f5e4650c3659b43d6dca1e24d1bf72365c952394cf21fb83cda2d2a35812dd69def96aa9d33295efa7d6d52093a012ddfe5a6658d53199d6c2b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4383e1e60715dcefec0559d7f542afe

SHA1
82d44ab07610f3cf705b56619a5e793284529f2a

SHA256
a6d40a458f91912f3bf4471156137466fffe7ca7aae1c6e1352b23071a471618

SHA512
66a5f552f63a2b004437ec7e65c4e3c70291ef97b4f75fac7cb13e657e7e3976c16ca6a81a6050e795593ef3610b091bb9b42b2f11668fff2ad28a5ae8c90daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
509991c36803a379f45712fb66886fcc

SHA1
81dc9bc1a700323ced61fc440a140d1bfe438b53

SHA256
2e6e8094377d4969a1a0bf2046578118bbdb8b284c39704ec94717016db1f70e

SHA512
8fbc485de25e5e6b533b5ab6f60fed73dc2f97b45adbb382e0767a87ae2cd61fab39dac286eb6cb6f8d0a7c038d36dc2285f4c8932aec5f6de9b927a1bfe3463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e51f4c3e60fe9b811f5e05ce22f3b96a

SHA1
fdad5d94b07d4f97b3d2a2368471aae3709c0e32

SHA256
0712dbe46f84e49dbc2c5aa4804a7c9adafb132e8e6c0ad934a88bd1d188978f

SHA512
e46a359caffdbbe7ffce48eedad0b265faee7d2b104b81a444ef993983d3771496791deb9671bbfae1e4aafd366d20f8a93d3d191833e85d4fda6c0a3bd1612d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0918ff67952e0c116d6197222fb57dc2

SHA1
67dc484b454743785a239769bc2a2e84e6066b4c

SHA256
f62689a3882da516f918c7aa7513e7d0e8843e7d0096aabc2de74a11221cc1fb

SHA512
839b02b4cbcbcf298be51280c166414411dcd4e3778f5855566d3c829784b10de02de534aa42f50e5db64efa3a173acda5cf17debaff776d10cb16a1d17307a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2078063dd42f0e25026468ce79532c

SHA1
4ddc575f9a7b8e3ff1949c9156ef9093ebb64949

SHA256
9db3b024645a0f9ede004d3a9307c90778bb15f3086149f0b02b48e14f64a70e

SHA512
954b28ce28175937f65cca1001985e4c29e9828b866c3cbcfc199e5de461a99816ccf6890537793cd815c39004a05df7e3703048b90d2670f288c94e5061a380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad96a8d276ff55c00b9290af05f7812

SHA1
0616578052516c6e85535d599fa06b10278ca537

SHA256
667abc82531acc6dfe32e558e34268bcda5d99c1c0281127ed3de93f7e758e00

SHA512
3414f7808dd786d2def25a0c3f59bc4c230c05ed7968669b4dfebaf3c9cfd4b8fb840e6d518c33696f6f39b020b4cd739f6247544d74cbda9321c20a0a79c08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c15aac143e02336eed13ed1d04b8cdec

SHA1
defd3e678d5893d3d52a64d03bfe60af513e567f

SHA256
0cf9023acb52a60fd9a3099ff0d3a08ba2c5b25080340dc977ea4ad8efffdfaf

SHA512
79c308d8211592b62a929d2044d95a29e4c9697e59b50e848afaba39b7de45544a44b1b93c5e82a3d0e8db81fea9619f94de79ea774da33634c6af75a2bf64a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d14b0d410917fc1f68ca3f631d1c5ade

SHA1
d602c99e64074c4e41df2e21fcc1a4f426ce67b6

SHA256
29add6782dbe458d1e29e8f6329b171774f4cff7f4fe72d577865f63cb3f7e81

SHA512
99953f3e55a3351c91d9b2440ae231231ea6ea0833f6379ae177490c42269c2b226251848a30952ed926ac76a737f02c9696dfb449442344c6c03c9ddf6a93be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82377a0b58bfac1e0b67c82be8321780

SHA1
76f6d19f3047969fba01fd55317a3ca322c58da0

SHA256
a272449c1d8057b2d004104b46452fff4e6107e58aee861e5e2b2388e97df00f

SHA512
4762c32252a7f9cf4a3b34e5174032988e470d120d50c3d2e08ab7fd1777dc993ac2dd7d4cad4141120aa33bc8b7177d2236ac09cb6c0b6423f49f5c94b58fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4c1709d6362153159a5d1a057900447

SHA1
98e3ceda36eca1a866a231962f6c446dae8f5800

SHA256
a750b8c445d607e58397216d444df5a16846d5192015b3e6b68deea63d28cea1

SHA512
54337396635e0afa6a415e9559b78f0baa15aff1fbe5aea94443878b9bd5c2d4a0dd0a9ebb8fe888966e590fe0f30fa301216f315ed8df3f13d5b0238a6ac2e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae31021270da550a78da267a4100ee4

SHA1
7f180533d3e41fd34ec831fdd8d34fd6758f703a

SHA256
e1b123365167b0fe9684a0a52a0559a253d68073959d78a7b7a3b75356165e50

SHA512
95e6c3be48af07c9f085a9545bfca4d49c21a68fef5983b024927109fad311cb64dad6ea33c5d8668e39e49f392ce6ebd8dd9b07cc1df76cf839339f7bd4d505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d05fb3c4fc7f6a682e7c1b4c9adf71f9

SHA1
3b0201de57cd526b0b5a2ecc4a06126e080bd84e

SHA256
a026fc83ea13d678e4d247d038a8f4d52bdb0042e431859624def6ad96e89ee8

SHA512
a0095602f362f51ada19813701069458d52c9b2db2e2409c5d42cc7ac8eab7a50f4e5161252d35c24556e25192bc80b1e754cf3eee5afd03f8f1c73bf9592a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
007be697c19ece669fd9657f48e0fd06

SHA1
5d1e6769ca2616fdb4d018fe50df50a8e3a3d917

SHA256
6caf38ec0a5e083375efc8734fe12c62867a4aeba34fa0be8e3b6109b0447a5d

SHA512
6357edaac1f3aa7a51a06a83dd7c4af0a3059532e0836837c5b58f243e3f595360213ab2eef41b7af5c0efad3742e26c0bfa352c6b42e86dff4aca6df6d4a50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19da4231bb4be376e6965bd055a1c82b

SHA1
59b0004246071956042d8aa059129a70e5635371

SHA256
6830c56837602320070bf2f606e141a15687e8c7836188fdaa157614a9facb8a

SHA512
3f144bc540273058872b425f4402d2e081ffe4774aa5395300852d09f602066dad2c96cca345dc6264a6209ceb6edab708465e495388606c2518ba93f2db957c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f6e3e1bdda6e686f38d512821a5a0af

SHA1
8d5871918a6938651575f20108984b5a82d7eede

SHA256
864deaac7520098aa7f8f69721cf960c3f11cd9271b39e428a1ce29ae43343d2

SHA512
83544045a8e48cdc6f794082cb0e14484c4173ad62508481e51f238cb5d71b09a7d9bfe9fdf99c73930bd8e7cef79e6c89ee9c067b900813322ecd6879ddd3ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae89d4728d2d8455852a9737cb7839f7

SHA1
97e01b13e0218ed39b7a285b22d645e930adcc6f

SHA256
af9e3ac356c237cbc24504bbd5ecab8d41de02d0735e0cbefe985bb61ae54933

SHA512
c8755ff0a7aff1d2c5dc952904737d0334b0417ca3963dfcbca547a69967591ac23bcb2dc7bd0041bb9e2c8c0b1f8ccc337c976ec8d7601e5331143d29b4f5d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1344.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit