e760a8a80e1a6ec65de5bf180b19a370e40872a219c0db3e9ec355d3db162d53

Analysis

max time kernel
121s
max time network
187s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c2675c62d08a57f9a23762e8bf11cb.html
Size

73KB
MD5

65c2675c62d08a57f9a23762e8bf11cb
SHA1

6272bab825328fc8899fcebbd502d8fa373611d5
SHA256

e760a8a80e1a6ec65de5bf180b19a370e40872a219c0db3e9ec355d3db162d53
SHA512

e897a6af4a484992c8b5df6c47fbd70c5fb0339c98a21496375db939438e8cd77683cf134098cb377b4bb194cdb69b2e4624a83081efeb58ab3aa56d053dc862
SSDEEP

1536:gxVGwamT9rnOeQfkOisBAQjjjz1vVwwBXlDKrVjbx88Ua5V8Hp:gX/RCkahPlNmD88kHp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f7a9288040da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000016424e9ccb21d760ec9c9785f2bf5018cab70bca0eb87ad18ba8417215b1f4bd000000000e80000000020000200000004ec4ed7fec4a99b51cbee915bbe554986f661d5b3492e3e63d396befb2d23aa9200000009c1abdce519f85e994c7c7437f62b910c0ab894f671fae455e37835b3bd97c044000000092f5845af54113c665f972993e65b59e2039306d8713856805ab2e672a46c21bfb00626bdc7f09eab851e88409865303e7d0118b775eef06454dcde53acfe99f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410694053"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F811C31-AC73-11EE-8F35-76D8C56D161B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b415bddf8ec62d5a813cd56568928959297fdbcd6018d2895496a44ab318305f000000000e80000000020000200000003ef6c53020210a3e367bb33b6ad4d2865d4d6d1c8765bdc64118baf673204cae90000000a3814d5c806626f6aa1bf82e87463d1aee36a5bda1553e227a9b611234d66085dec09212e83f3f8f74e7f81ba532f3f983f428b9dae23ade9831f4eb127cc47e00919931ec76703884502b1ee359d88059408304357d1bde87c70c50063e10c874f62e0b16a23fe3c4e7879e7b54e8b0b91b2662cf4e921d4e1b5d54689085d5e9d95b1e0dd165a0e821486dc3fd293540000000c7502483e81c3eeef33f0fac68d0b418f8917af459d9e483f7b5e645a83dfe4aec1038fee960a56edc27e39f9c70410a3d599eedb030b24325ba9afefd067a65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2604	2788	iexplore.exe	30
PID 2788 wrote to memory of 2604	2788	iexplore.exe	30
PID 2788 wrote to memory of 2604	2788	iexplore.exe	30
PID 2788 wrote to memory of 2604	2788	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65c2675c62d08a57f9a23762e8bf11cb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0912bd72868ab24cdf35fb95295880a7

SHA1
4d7bf2ef86fc43ee8aea7da898db9be1692cf92f

SHA256
10175fa1060ec088390e26f43b2b54a5596d7ee2ed3d50636a439b71b0b64924

SHA512
a841875262560443492e8e713372ff51685f9f4a3a4629bf86f0fba6b930062005487e1fd41ca37582834f815a9b27df724eccb19d51a6da68805aca7aabdb1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ff517c23aab15a50a66dd510ede3c54

SHA1
257199c3a77f044ca82d265a0d12174085db2050

SHA256
abd9d97411a099292670f41e35df7eeb5f72273e13c49dc8373074cba2f51ddc

SHA512
c849ed44492abf72cff0452fdba3071aeac943dc180546dd22736a6f679eecba01775fdf4a76036b1506bc26f4874c6f5c89f34546161bb3f8fd2fe2501df4fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd12a59c787ca8bf10d142dd2f3712ee

SHA1
c83e55f085c810790e6f034351f00db8cc7aae6e

SHA256
1711fa6b05753951f7c1d5a8800b75c006572b3dda09845467291f11df5b0269

SHA512
26fd8a661d386a6a0e28fea081cdcd34e17f7066ccf92102d4db6151254ed6d3951144e823843c4235628460ef2f7e36eada5f1bfa20a6d35a00c807cb4b3085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
045d6979216d86c958705efa93f79ac7

SHA1
a79ee8a355235511fd0b6264a677a01192b1357f

SHA256
519425013a9583fcba6ff9d6688546dd5119f9f434340e25da0132cc11319377

SHA512
48b9d90ca80bc3c25c93cc530dc945e88a86d1f5a34bca7ab89530b24611a901cb928daf3a85bddef16d01d00d9340f1f4bb5174afb8943054f5373a2f157fee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7021a91edfea4f8ddc0d49486ef9e38

SHA1
00befd1d31cf557170a3e70842236d9e6b7169e0

SHA256
d7daebfa36efa8fc3e8be19f5947fdf92499e1697e19b10dff155303807e2b4f

SHA512
f2427175cbcd6829835a776fccced616af9b794f4f690747e6a722ab747e6ff7e3b5cb156b3dbee52566deccb2112d8b144fce12ba905ffea497fa5eac73fdf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eaa058b093dcfa453d7d841a7c23583

SHA1
f8d9bd54c62663b53fed8e292d38e7767c71530c

SHA256
38d656b62dd78017c609d77dd07ad41ab18601416734906b8563c0f7fe17fe0f

SHA512
789c59176fab2b066bb2d4e25da21a8bee82b7dbbb6af1369c0e6ab7007daf3e8bf7fe88519ee8e34e9a507ecebbf10164b22b00ff198b6e3d93c8db51dd225a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad6cbf76c2d18cbee34b05574fdc4da9

SHA1
fad36ea03f85df584cc3459c97a579f604a00777

SHA256
f21c077f72f765b5b6c5dfd9e627c31678f6a6e79bd6b8e7df4b1b0cd8626f3f

SHA512
9d2eee27050259ce237e61863c281e2d800a4a4f4d4c5f72a27576fec83c6c4037b50475a55927f13da3fc261776b71924a3e8f2e7901d87fab9dc7976088b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d742a0ee8b311d3ed2f5930adc00152

SHA1
08ed4f0ee3114e6eff6192868db8f5069c5c822b

SHA256
cbba9e8bec408bf8850c553372f43d10bc6aff4f7cf11ffc66e299190c255515

SHA512
0a2bc071af2e34e70decd227edb323a32670c6ba901849487833706dc2736107932f4d28468ef9a0b63ccf7300ac1a13b110a2f94cf7bcf310630fbf75cb5268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7668188d41ce6280ce361c45cdc94b5a

SHA1
929a0543162ca4d4b8e773a7bead1777b3dd0669

SHA256
48430d1f0206a68db17dedbb452a33a7c31a3a084fc55dda38fbe730554f15a9

SHA512
63d70eae3ec9f5dbc2ca6357ded05731665e88eeb1e2373b3de0b5c5847f6244b22a33787b5415d13f48d88925b707d31789d777057381acf2b052534edf3825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7ffd98176c006959e0eefe4e74c8e75

SHA1
0667ed4fe48161526489cb427ecb69eafbf883d6

SHA256
549def1fb1ad28672f2f74637cbaddfb3040f3ff76bcde4db7d80e1323a0fd62

SHA512
0d57bc264d8ba673c67e5ad89f63baa81db1e354b28313ca797f31c43032889635fd04ba440d06e65bc51758a276e3e5f60273515d46c4b11ce8de455a25aa17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
864790402d60a1e48b3e47b820f18a76

SHA1
eda84b882d3a1d8a98cdfa2955e85e07705798e0

SHA256
43544412a5a9443fca8155fb0e5f459f8c134dad84e67567b00ddec30db5d8ac

SHA512
25374f0b48f849ef1234068498baa6f97d84fd8c1ce56a8992049838a7bf107b2a790cedfcfc9da66e4d8ea05513627954d138dcef092c5510c33ecf32e0383a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89ba9c139e802fd1b31ec92af9d20eb6

SHA1
645d39cbc61b3acd332066cf095f6a014d8a427b

SHA256
da7b71c8f6bd863f6d53a2a9585c42f1445757d74820bbe9b6c744ca783b71d4

SHA512
c515195edf88c313decec75334ca07d60c00f271f0f9140efce9ed52ff38b4dde8a0d72113283e95936801637c7c34c0a6e1a536832a46daf8ff634b39e9920c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9341e6487f40d91d9c9e105acf4c92fb

SHA1
cde576165a84f6709bd755de33a03a6bab82ce26

SHA256
d56db2edaa88197638380ad4208d5af2d69229035887132232f61157b98b55d8

SHA512
fe5896399257cdd0fb0a7d395bc7124a3239331cc39ca9207d32c45932ef8c24972c7bd5b9f44e496fbf78bcc042da34f4077503e28e06480ce415f5f3d4e531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6a56bd27662a1d9b1b8f6f946f34574

SHA1
623ee2f22037b958414b8aa64d224d8b485b210d

SHA256
79d09ae29fe572ed1a36d3fe422fb97cdd99f1081c86f2eee9a74d9d0c8e49ff

SHA512
aa6ce1ca372ecfb4e734eae5b86f7cdfd3fb27ec25518b6b0984db2a66948863a5c202d68d81f0b2e75239a060a40fd485dfb3f80be74d38c5c3843d9f1f2fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01717b8b7ab3e17a19fd9e612da21e02

SHA1
975cb27c2e183a859d0d1e5fdc2cbb701a1bd5e7

SHA256
e614bc62e415e8b30ff695ee80187a4f80add16b1789536f16bca9325bd87d4c

SHA512
c9b8e5a2b5822cf017737407967511040f09242e8fc05af5238136ed0d6450da8127a7df00eb3ddfd744ac65df7f42cad6ca660ceae2f314db0544dd12d47e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab206E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B3B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit