ddf0f50551c5cd2002406a5c0e820836f5c40c83db594ead9eeee296b8678134

Analysis

max time kernel
162s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67743c6ca55d335103dd1d8b000a9b49.html
Size

53KB
MD5

67743c6ca55d335103dd1d8b000a9b49
SHA1

80f1c77a430e7c9b3970c1e055c5ee5130dc5b44
SHA256

ddf0f50551c5cd2002406a5c0e820836f5c40c83db594ead9eeee296b8678134
SHA512

0a7b651d15f9650ab29db11ac507359993200bd5aa0156c3bde7b5ca874ce895bc121dc3e5989e3e5a5b6f9060bedbaff679c649a03f30240973d3293edfd3c2
SSDEEP

1536:9kgUiIakTqGivi+PyUErunlYY63Nj+q5VyvR0w2AzTICbbtoF/t9M/dNwIUTDmD2:9kgUiIakTqGivi+PyUErunlYY63Nj+qV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000781ae056eadf4828ff0b611e99bf0c4fb7d9efc498e8ff701642a42f1f738e1e000000000e8000000002000020000000116f0730e1dcf82aca7bf1175052b5fa532e9a17676ee9c0eab89e3ac8afe5fc20000000d91798d057036b26dd3b935584c25547be3d8c8674d26ee6103633669ce1918840000000a65daaaa49430368620cffc6c607a5eeb7ae87ba15acbe992db83e4ecaafe736d7e24955f2b0b60be061a1a94d3b324dfcc3b22517e4269657ec4049a34586e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b2e9218640da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410696580"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a6641018fdd16ddb9f7511eb208fdae5203bad72b00cea63f674b251a8c4fae8000000000e80000000020000200000008e182fb249177bffba972f1ef1c3bc6cc942f35f7b33c0b470b83ec363204d4990000000c3103cd63dba0eeaae5fa72c55d245212fca55e711cab838a0ae1c971f2c4a8cfb60b49953e87db0d9950dce71295e66040129d7750140435bce12c84e50545abb7703a391e5a668be83f9fef4e76791d651a86a7acc7804002b9affaffe27d4b4623f7ad06726f27fff1c6b930e51599a365c0675aadfc8820d89503dc0c99cb135d9a00b210a5ad475ddd0e225a1b6400000008bcbbef74cf2f2ed50257de917228b6883a974d41b807c51bb58da2e09fc1fd31ca4463ade3399bb8899d7dac6b56dbc5e2122fc421ff996a2a7265dcf59a015	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3681F191-AC79-11EE-9F1C-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2456	iexplore.exe
2456	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2464	2456	iexplore.exe	16
PID 2456 wrote to memory of 2464	2456	iexplore.exe	16
PID 2456 wrote to memory of 2464	2456	iexplore.exe	16
PID 2456 wrote to memory of 2464	2456	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67743c6ca55d335103dd1d8b000a9b49.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
753ef2989649535ae815367ffd3107e8

SHA1
586cbc069c1cbc281c58a08aee4e96a81b538b41

SHA256
f7b10aa741fc75e8d609eb094913cfaa1409fe905895a481c576a2b95ecefa89

SHA512
53ae91211ab23b3e73816f9bcfdbb8dc249ab7139a376bad29fef1db69c30ff30702dc87d2b9a1d70f6f7d313d33515b76027bed3811313155aad2fb6a57c675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d531f6cfeef9395755fed94824987ab5

SHA1
eaefdc8ba1b4bf5648a1b8a3a3f1e38a772807a6

SHA256
1f32d8952bb8ce9273fd8a853c521b3bc7b46e79c562a3bc1007dfce2bc264a3

SHA512
9be23c54a0f4c1b44ac129f11d8ac2c6385b1d8287f0048731c554c77004742dcc89a7596d5934872efa35c9e2cfeab77e5167cf81bad8ccab3eb6ff86a574fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2618ff400f5f3f48351325f280917424

SHA1
fada807ee346978e53b00a196ad0ff8c392746a8

SHA256
34fbf854a0673e6a4e697b1de3e3e002a3c13aa39545635513a8276c869972cc

SHA512
b41b04c90baae6341fc6fc56311056aa636ab3d1b0bdf51b91d5a2645d829359be82a038858af6573c7186d99dfa968a65a0aaaf7713d5a14e7007488b535123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57acc36e4738df5803bd21e8a91634d8

SHA1
541e0a45fcb7457ef404ddfb20db22557e88804d

SHA256
f74d0fb728d90e582c95e5117c33fb6ac7bc534f644512406bb1d1efa6410bfc

SHA512
bdc3f747a9008edfa77c1a3a79c02bfa7b27099cd809059ee27429e0f76a1d325bbb00b3e309cbb387ca83d0fc8141ad2a7d03a2ab9caa0be665e2189afee5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49ce49a0d2cf025e1fd3e5786b6200d0

SHA1
2f20406a664cc7ab01580d71fd38e7ae0589a7ab

SHA256
ee93a0bf3a8d3ab00a0ab9eac9340ad21273b256b24d46dd3f273aeef679d39f

SHA512
ec38613ad3dc75260dc7a49c24da709304de44c0b8aa3805906eb5e961b5517dedb2b87662465407e196472c83fe69b3c0ff3e22cd675e225427636d38a34db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ed034eb9508cb5477a338b1da840cfa

SHA1
2af505c39efd6b0f6b2e40af6e1ad69d90718681

SHA256
002c9bff0931a67e6ecc5f446df3213268b593fa76814fb325432d9d09114c64

SHA512
4f59644ff975cb23fb7cc2f1343e9ce37f059d043ec1a61d4dda1e77193750baa69cf6f3ec21cb11aabd3edf57415e7dda97d972779bf74ce35d4caa049802b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e4aa91d8c3d66d2169c49dd4152578c

SHA1
177f52cee7433801f0c88d0b4eced05d888ad97e

SHA256
283d1487a75b2d0713db334ceb361a6c77f1ea81aaa821a4ef4667b91604ebd1

SHA512
dae89e651047fef7ff53113c21a9eb7656d0e1932b4aabfc014ffbb5574154c76c42125a656a5452841f13f797c6f80d2faef515278118813a7bde5e5d0f8b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b341f3b3785917894dbc89bcd838caab

SHA1
81ad5e35b7969f19ee0db21cfdd26e22e1ce9fc5

SHA256
19e9cea59a6c38f2894a6b0c3c42930cf99b84973079ee1fbd0b4e5df83f46ae

SHA512
14550c2b88055e2d14126ad388c621ab079443285fed046e1eb38115bc72902a363fbaeb5e87dd1adab623ef0c377d39a49b115ca4bc6a5bdc19136be9addfdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3586a74a21f94df4ab922f9843a07876

SHA1
6b00cd7891065b115477abd6a59157d685d738f7

SHA256
e0844dedc280c73fd662d57697305c5fa739fe9aebd07349204a5a01744ca675

SHA512
3059881544cd2a8edbf3ec911fecc0e4662fd7d6792848b6ca282147d608948a1aa989403c36a4091858b94a9f1fc995a6ee3ed4f604311534e1f010e3644b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a58e15ca22700ec169df10f604d3618b

SHA1
d21a0861a3a3c1ec9be26f3641850343b63cb3f2

SHA256
2748c77152809c6f0d85d4fabcc8c9c6347812f10ab5410854fc7f18a5e1fef0

SHA512
13e8bdf477209ab543e0e0ee7356ee473dc7d028ea146f0b2e8db73e7de66bcea33a2edc718c40f8e48f5b9c69f82788ef7acdb011ed30cdf9a16e457d67b53d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4223fdb522f9a41a8ffedb7e284f41ad

SHA1
34f4e82100388f81dd749ecce9078e9a49e11ec5

SHA256
525506e86a9a6808e7f5092cbfe33f2439075dbcf0e1f9176d34525015e22801

SHA512
fe8a9dd2cee8e761887a958f7f9ebda1dbb93ac51ca6ba60302daf97fb916b634b707702c5359f88dface53cf43ff72ed32afe0ab0d0855de6231b1117f948a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56228fb03227dc67609863f329d7e56d

SHA1
a0ddb991ca3c1465f62dc69f9b2260cd78a11e13

SHA256
b987058cda2ca72dc2e09c9cf115afd883c87ad44561d0ee3e32f40f4d01730b

SHA512
4370835375af86f9394cbb9a924ae52728e13afea91d8d7c540f22b939e48586cb50c6a8eb408fdfe82c59a28eba2f66bc531d8a441e5cc42ef57b8c12d66c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce574337ac8c19eb8212dbc33ffe7a8

SHA1
446468c4c07975e1536aae35aeb4b6532a9e2665

SHA256
0f67ec966d98d810a2a6eca25d8af611d1c63c1335b0f6b357b5d93bad23de56

SHA512
c287a5d43ad55204c2c4ff9f0d23294782471fc5cdc94747e6214aa9b235d2f487e9f576261ebed1be9ea78b59d8b3ed4acccf449c3de7b2f2581e3589546d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9ea8939ee1eaa0b6dec5671e9e78d39

SHA1
13b00f0587d7f2ec00c5ffd476535617c7709558

SHA256
8ded6e2fb9e28d374cec123a1d74517004abd3ec9c6e732d677e9235825ece93

SHA512
59e4d120de58f58d76a69513916b66bbeeed7a3290186c43a7470bda92d15b04b99439a16af43cfb196ec27e622c7c4e841402a2636fbfff81aeff3346d49570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5567802c4845b733564de830e282b6c

SHA1
a059cf6033cb236b0d7de7a327ef344b746504b3

SHA256
07d66b511973604e0af8b931b04d5655c2ce9d4cf098d33430b5439809d18ffb

SHA512
d3e3594a5978359aff9429e4142b5d34ddb54a18ed019e2977717fa57b17d772f077a3d9531567a4cc4f209bbae1bebf047360462665a914f320f76d3b855a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab80B5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar852D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit