db7331f1f0ffcd3a0fd0c9c7ab57c15449309e0a93965ba2d5339fa7d4f61707

Analysis

max time kernel
117s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

604a11cd97031fa94523b4983e9f5102.html
Size

22KB
MD5

604a11cd97031fa94523b4983e9f5102
SHA1

a7f0151a7a1f75d2fc83875e8b02a3557963e794
SHA256

db7331f1f0ffcd3a0fd0c9c7ab57c15449309e0a93965ba2d5339fa7d4f61707
SHA512

b89eceea7ff3a0df218da73fcb39a2aeda0874ccbe641296eecf2082bd8fa74b4f2b0f97c4683c16cbeaad0a5426fd376cdec32f7e357d0baa88ee8bbaa1ab7f
SSDEEP

384:QvRl1JZ+n9zbA7BREl2+v1P1kDlTy0gbAx57heyOTrSSCqdhFEpgzZ:QvRn7BRGlv1cmcx57hsJC6l

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001c97319e18e3db23357de6de6ac17323a69a03b5f61ccbe1ad6500023b962c75000000000e800000000200002000000035e77d6b7a43763487b5991ffeae18103c4d957e498b82daee7a6b4216e43e3f900000001f9d8236dcd930d966750787690ce23057749e375765f09b172278ef8ce9cab361ea14f30ee6e075605ba83805eba331b9829e681abfe7af7a80be05f9b93f62d4ec185d3dfe35cc08d585f3c1370f06b6348778cef5ef49bb082fb63ad52849623df0f7a44613af10a6cf293557cdfcd5dcea900e4eb9774a804813515c494a79409952e7c34a5d0580b85d0350cf7d40000000ba25ca949c22dd5ab2a5f666dc8566dc7e2c1fad1dd703e55f066aec904ea917010f6acc0e77da260e4f7307bee17af31a1a7275f921f59be2f148b73db07c2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10C78D21-A4C2-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000045c5b7b9bffce2875abd99cfc31f63aecade471b30795bc4473ddaec8e2c2247000000000e8000000002000020000000e68c7153bf470649ffce05a2af34110dea2c70a61fcf4739566bc7b4ba1f8fe1200000007d89836f0edf713112fbaac9b2a2ebeb86c5a4a16d8cbeeef0a428b31f27e45640000000f78a14ecaf3fe6a12f4e25e82a076c67e4a122bb9374a358b2a26ad13da7a7f3fbb8af066763333b846cd66b48286ae1096089cc0ed5ea1914614460d86dfda8	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409848267"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f025aad4ce38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1404	2984	iexplore.exe	28
PID 2984 wrote to memory of 1404	2984	iexplore.exe	28
PID 2984 wrote to memory of 1404	2984	iexplore.exe	28
PID 2984 wrote to memory of 1404	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\604a11cd97031fa94523b4983e9f5102.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a21080f6290b2ffdbbe47fd216fa0e

SHA1
5fd32684f0763665a6fab65e3db77e3d3c5f7603

SHA256
9dc31a19defa38e035b46e1fcfd2e6df753ff3310654edbeb72a34c82ae18088

SHA512
399424ff20eae9dbb06262638bf4190e2358d31ed852241bea0d865e91db2732d334542adaa13c5328fa2ae2ea0a8c9354180244ca8ae55eb874d43b88b728b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57715490451b3bce5242442377472bfd

SHA1
1d8260561a64ca75f6f709cbcd4b48b9394a1c43

SHA256
d58e9a81899ef09541dd2fe4eca3dbdba02e2fd60f70e1ccc6c3229c66d94037

SHA512
7e4bbd425ebe8f83ddfc873b9b2c3918a30b8bb2a4ae12e34119b9a19344420194ba95bb942f4d4879954afc79489a7581773a2d30fcfb4b68dae1d821afb772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c510d47cc70c054069955778119f66d

SHA1
98d88e4e2b54034e19f8b2a287669813a2361b11

SHA256
88c5d80200d44e1f5f96feedbe55efce913e06cb33d1c9787345ae2ac6c083ff

SHA512
14962384e66af2b350871e481a4517fd1d7d9d76ebccc6c5def14bd5ce37a73fc3c5d412c43a3fde2f0d739a4a723296732929d39418563a507e6d8892959e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1811791152dd5f01b861063f13ae1e4f

SHA1
9456f241c4a6ad9c98d8e077e9014a3e21dd8b0c

SHA256
c4b01e767922e2b6fe0666b79622842b918a276517ecdf7afde416961daf607c

SHA512
fac50f48dec868c0c01cd94140f90c0564b4708fab1a1889200d8fda7b1eaf6f967de0e8045863cac8af5d1e75996462b13fe8200675c942b3ec2ad62159561e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb58ca91862a0bb1392518693d71949f

SHA1
85e0603e0aa1eb6f43898f7bdc6dbfa134250d9b

SHA256
150508775f9d68e03d621ffb3b292992ee5be4189fbab3467e94d04381c1a0f0

SHA512
e84fb194d234e3d7999873190df68060375d0ecf3d73c6058645404e5808ef2ae945f0bcff99b0026f2cf4e8252e570542c844b0732c1e44e779e648abb8d6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea4c33799dfbd1be44fcd0dc86d978d

SHA1
b5030c68d0f3bb88cdbb86f3e6c49d27fb1176f7

SHA256
6e4aecc0892b2a7c8a9d96e0d284025b85da4c5ffbb50d0167f9f9b227cdc00e

SHA512
04724f052dd5a7a0c9a860ec05d2ab3ff74f139d4c815e9a1946548cb77a3a5a0da6d81972f7a4bab2407a5c6825912f09e8c3e9884b786c8948460700387d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b87fcffe14b7cd2615d7d3257a454f1

SHA1
9b1642c2cedd5959ebd2f4234517ff5d77bf190e

SHA256
ee3cbd4b335b411886237b9e7429aeb3d37d318e96123403f3d0fa5e74ca282e

SHA512
2359eef8aa68d3264d29dd17b68c827898b31764d2fc0b5555b01ca9c32313c859f2918d904a34220cf2de7dd4fac32a8962a6cb30755ec1ecdb36136cc8c643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bca573cab413897a9ef261352400966f

SHA1
47cfc8482a385da241175dbcfa2872c75c751435

SHA256
11762faccb317c9c4be0e5282f6e45b9af6917d175fd569b62d57d49c97258a5

SHA512
fc97d81316302486907a50b19eaf70ba0e3694aac21273a8ff452a082026da6556d054c1de90df17fc3e67c7179ad5726b8bfb4ab842deb530ea565fb74befe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a68604f57ebef5239afdb73b85288429

SHA1
63f9cd63614f5bdc800485710a6c9c4619248299

SHA256
8d475cd6e45e7ecf061c5bd7ec4f08c590c5c45425e4e4e898fcebe8236d6fc5

SHA512
b9753614bcf80f0718d68cf03caabc66e91b29d8be1205243880911a843bd61b3c900debc84866dfe02e228172dfec695051d86b49bb0aa6e4abc52787294b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d02524945b40256e466e3ab312e7465

SHA1
5279854bb16a8f9a738e6fd2ab163399419b849a

SHA256
2e0be8e6cf8aaae68ce8af9dee84245352eecd3d1965b3593eb52565a6823904

SHA512
d1cfde448765fd65ab4f94cd6d9a1b927cac3550b6808ca93103b113bac327939ea39661c65f3291689b81e6165e975417dae6bbf2dfb620b6d2df035d71e264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e0d6e8747e74df9106ec6c8fb09d425

SHA1
0af0b7430a2400c021ef8038eac49cccd9347747

SHA256
b8a4c796370ed655a1290b36d3f09828375cab56d0a69f080d99dbf3e719ec7b

SHA512
ce4fd947a0150cf1c6e183f4ef0d3a2af54493ceb3c33c374a528dced1ac2a8481b497dbb5525a11c0b6547c67a873c28997858ee0f7a66e66db86c063fd5297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c2d4d43295988295ac4acf18524b124

SHA1
5330e6c473a8d60d7c5d649b989cee015695b6ed

SHA256
0ab60740b847263befc3471887a6c750d8e938964a1da962520dcb2a38788059

SHA512
fd93517c449f62fe0a983aa96f183a915006df83d33ec0ab48e41ac3c0b2b91ad05414147328cccc5a14c1f2089044ec8931487c070ab839b9bc98b3feddc434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c12b8aac910aba46bfb51f9b3c6b7222

SHA1
37853cf7feefea28320e0c34f58a7284b58fcb82

SHA256
7380ab1d8da65eaddb65abd8419fd8df61bb3bc42043d7c0e1b4d8b71e3cdfd9

SHA512
cdb6ba12b7ce93ca03c9e19fd21c905b660bf005d10ea1afc6bb55990819fe4c4dd9659937c6fff9110155b6f370e77d90869dc863a1566058125e813b6afe0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7ED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB87C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit