a1c9424ca57600e03b4871c30809b64879a4a647dbeadfa9d05af516af66342f

Analysis

max time kernel
152s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62ea141a9d8282c8cb08fa5162da6569.html
Size

1KB
MD5

62ea141a9d8282c8cb08fa5162da6569
SHA1

d54a29dc9a4d88a218a5bd260211844d90e03458
SHA256

a1c9424ca57600e03b4871c30809b64879a4a647dbeadfa9d05af516af66342f
SHA512

5db8b365b22a91df9f9764ecc7ebee28678fe8f0a9c900a95222a7dadaa3eaeaa767eb765f59b559a69c4358ee800138b54a12d4768037d9f8fbd60161044997

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000087b43656c832f7485c4651e4820c3323efa73dbcb565291ddfefb805fa53adde000000000e80000000020000200000009f037deec9fcf6bde6578bfea0fc364c8f0c875e456f9ea7d4a8fd55d15bd80b90000000c31f24736ce3d5f4c608474cf74feaf82283d9237888b4647cd161dba79d59286f9abf1b84170533c9ed98261324090e76468e05b14c7649e07f95eeb6fbb29337a0fde516b5f974ea83b9307a52d8abcd22583227d10ba15abe3a5d7688dcd4cb3cb460840b34110d9f239353d6b7daf7cdada7fd5e15df7268e81ef0506fd3ee9131caff9d35f58563c8cba42a8cf14000000078916ff6c12d1d361eed26d63bb1cc5a7c360342810b956657e869b5358eefe25cc2d6476ff785689ab9348190a291d1a4ac119e9e0522f245d16a991750c88e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f77af257290a7543903806a4a8828774f7c3cbb759ca1af53b9ae1afc7a63062000000000e8000000002000020000000557ab57b453332ed3317b6545014ea2268317dfb32e4e2c38c6de8cd15d5760120000000ab2903aa6e2c7309ebdb10470318e8fb092ab2e76fa6c2fd362825a3139e3c0b4000000063da7717ee47b43507d0cbb7cdbd490ac3152ddda69ba6de27acd9a13998c80aa65156947f1110508e1ca2b1748fe04ae797fc7db2a578f1e5839381edfdf50e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bfc13d7540da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410689354"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{629FDBE1-AC68-11EE-92E9-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2824	3024	iexplore.exe	28
PID 3024 wrote to memory of 2824	3024	iexplore.exe	28
PID 3024 wrote to memory of 2824	3024	iexplore.exe	28
PID 3024 wrote to memory of 2824	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62ea141a9d8282c8cb08fa5162da6569.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c974d8a1324e96faa5e0dcd18115a9e

SHA1
3f70fdb5cf0f6303f378057778dcc74f50918996

SHA256
2b2a32f8114029abdb984b3a456daf9830505edb1b433120e2d40a17b25e90e2

SHA512
b9273b9a6792091fcacf8c3c3e339a820affaf16984bda604e9a30f2cc86de1e18ba74a7382622ee28b057c2faf64e3bb8c42f3c5b7e499ae4a31ab4daf5f271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
699b0320286920178c2273ea29fd638b

SHA1
8e11cc627784606b4b865ffde002050078caa50f

SHA256
8f644a3a93f2af1065a9faa7d1a9e99ae4c51cbf9761d4409004b23526d5af32

SHA512
b4e66f6aa35129a40d4e140cb7880122a392db44f8a9f7c39bb7034fa576fc2f2623f7130370a986eccf5ba507d50878cae012eab08529bc53021274f8d5f0c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8507e09e67f3dcf735ed022a68d3efdd

SHA1
e002ab24d13aa93a4cbd97b3a71fb09ceeef5a8b

SHA256
87334bc226ceaf6aa0fd5b90e2cc35ad66755f5d1099cef1ea1563858a72f615

SHA512
8bad31df7acf7e97935ce8e13289269462c679682ce21ec37eaf482dd161ce47519da4e3adeb56494ad666a3e680620983c5254c8ffb0370df8ed3be28b7f3f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d493f3f870031bb4974cfa3a2d1986b4

SHA1
3cb1b587d117a06897ffd1a641a90a746bb76f21

SHA256
cdc3d7c9219086f650ac02ee5f531524e6986645e0d51d50e93c5ba1f4bbf3fc

SHA512
deb80fe2ac11c3513f5e496cdd285c3c17e29b5673a89c860d7b9a823621ae070aaec99a254e1dfdb1bffd914e656c7ca5fd9af4f4e176cab28a7517328c230c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f81c2867154313e7b4249484919b0ee

SHA1
bf74c4f91ba39b3199d574606ead4e69ea56d09e

SHA256
af88aff2abf7ed317acac13b3eb67c67a31c1f607885dae4526b5ceaa0590d98

SHA512
4121205188e1d01221e395f4dde4664cd8ee9f3c538a2c115c99a41105797066d52912b337932433d4bc2579ee6b9d0962c4050d9199bca5034ded80281c4af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c28cf1ac29618a38c9ef842245f6836

SHA1
ba54d931570c1061393e12ee456be9b8b22326ab

SHA256
4767f227e1411cf1baa932874fddb0f6b5b14a71c70822cb331ada556cef011e

SHA512
90c92a12c5041c37ee7724f353a035521cf9baaf7479f204532d5b543aa29a3d6b8bbd6272a5a92c0771efd5a17d60b744cda52f0c6f928036ce2eedc3fab972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7331c64033211ce3859c718818254c0a

SHA1
12ca5e3a4d931f540163cd8ce4ec8d1120981d33

SHA256
a16b4171c225c170dca232519d124802ee201befc40575867931f39d41e1179e

SHA512
d5c056f5cfad75b34e53052e28982c384eff877d697e701814e6559e9738844c3acc1f147195e4c772dafec512b08f227c43e2fd49a7018343cb84bf3135144c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f84b502853b311e1069ea262148738a1

SHA1
28e61480dce2acc31d40917601ffac502dc92c52

SHA256
b071f74e3c4598cd3d6b124239697905e2aa5d8393522afc3771bf3b8e41db52

SHA512
44dae9aea74a2eb266ec15da7008e62d6fbe1b77e6ffbc8b7164c35a501851d8836c085866ee4f875f9e25fe30b73a300a654da1c113eed3aafcd59a1467e57f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6362032f23a1d6fac3c42b9a47f3aaeb

SHA1
10325462eff0e1b5ff7ea5cc6c10d421107158e8

SHA256
8385781d9ac7950f98ca7a8e466d043a18eb05db4d5c0b62e2c352b11d9e993b

SHA512
28b0ef567d3026d8453a9a13a26a36774887a37032fd4f66aa202ffd4d6da3785bd25e02d980fd1692e15c58ace840d34def8b0da219f93c187dad9cd7f3d494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2083b1da226f69405a0ec78f4ea42897

SHA1
ca332e288a9052c58639233ad8e880625e2521a6

SHA256
ee642cbb1dca5f4ddfd769083f1438bf4a9ab07b6cddb48ce9928cae757b08f4

SHA512
25736590d360a08a20c7bf006cde62f9d6229d37de8bd46a73ac41a5ef89f2d0521eb74f28e850877dd0387cfd160e83c758b14e0ac58abc004e3f02d1b85134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e6056450e68dabfedf2e2b68f3a3d2c

SHA1
9813dcb587552166acf21b2f366db1b7b40f220c

SHA256
e872c1b46464bda0621f3d662338a97cd9f54d8312e072e3752c7e605626ae17

SHA512
f5457de529866782fca17bc11406429c3c07105d91f57811c0aad0ce1992830686c5b95c4652d7b02fc724b08a6d30a1d9f1303f46f18f51651bbd21d1cf96c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f605c0668936d3c049e929f967071efa

SHA1
14182c38e2a01ee54d5ad5305ee5e61b44373d48

SHA256
be5235d2924c9ce5c8198ca49143892c121ff1c745a174951c1184e3c4cfa54f

SHA512
9ed590a8b34d5fc84d4f9df110d308b5d9f80697561777e24641539f402d88639e9ecc7f65980ecd824266014239e09c3ec8509593c0babd65edae3571424df9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73710f6ef85637e66eba338c2a942397

SHA1
7caf53620b0dba61162c6fe0567bd69def200c4b

SHA256
f00399025d760526306558189778a4e880f09a6b5e2b4ed137c591d40c0f24b3

SHA512
bbc559e6575f8f887475ca3224c4a9fe033cabbec31889b22b3751f648d304408cec8cc377ce8d8c0f5ae5c8ca67725d92b66c810a508d2d1d755926408d8c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0450f1c6a5dc800113a02759e0d1378

SHA1
cfc08780cc5498357b8b57f25cac31738a65a93c

SHA256
1b218f737999a490181e55ce5d094060ff31e6dd0a3ec9b4310d9984c57b5f79

SHA512
d1f8f3671e1ccaa96bce91b9fe050f878f43adc1563bf27e20d579b3187c5e2558827ef7231d0751ba93feaadcc21c52e932e81a03f8c8a9136e1c3a4e5a6492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49517a3b20a9263f036644107ee9f5bd

SHA1
3cc8c31f49c15d5d29c0bd8562d6255be38a9983

SHA256
d7b215d63f71a65b8b6614156e47d6a15fb88bcec57d9657d62aa07803f18a7b

SHA512
6adae05213900772503867cf5cdc35e35913612afabccc4cbf8a5aa439e349d2e3a004b679961f431d6ec1ac116ae8df0fd4edf02fee5cd234fb85d8a024e525

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD653.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD80F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit