e8adf3ee2abf9806f5b3e8a2ddb82d103f3d8aee510036254cbc0864ee7fb8f9

Analysis

max time kernel
122s
max time network
182s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73361607bdc3fe39286d570912c31702.html
Size

37KB
MD5

73361607bdc3fe39286d570912c31702
SHA1

225d636e8256e50f6305fe4750e318e8640ada94
SHA256

e8adf3ee2abf9806f5b3e8a2ddb82d103f3d8aee510036254cbc0864ee7fb8f9
SHA512

a39eb1c47431539a37e5eee14fa5d998b50e50bdcdf4ec89d825b03baa72be5ddd80d2c7a822b85201cccf9a97c0125acff74d45a96e72fd73ab4e5555cdf207
SSDEEP

384:SIGQOtnTpHDXAyGhI+R/9TpH7cAOSK6C+4F8t:SeOtdwyGh/R/fUH6h4F8t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409885217"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14541161-A518-11EE-AC02-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402c35fc2439da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b3879d17e83cd5eae5102938f73e1fc5ff29197a41fca165cdc53983612c21b0000000000e800000000200002000000058734550b3c74ea513409416434934845d77718f9f1964aeb73bb3bf6741e5ec20000000d466b3db167542ab8a09341295480884863a1798308ea180b937dc98a0b2905340000000bf4c2729c988efac4f1b9183bd1b5abbc8a04c3e81b38cd9d1593d3f2d46d98c7d3d94826f6eb80b006f18419a8961e80abd0333c6292cc43be5a91257be4391	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000f83f4cd189cde0a81033ba13571fff5ccf7de90791a0aaef93ee99a78e0b0b0000000000e8000000002000020000000641da619789c59705eb61b2ba9a9eed23090fb9d0745b96fd79b54cd6cefa2ac9000000056c11b1c4e55f0fd66c42a0422d0a0d76a3513458c132249d298746d5c47e4fe78c14f2054af12b110c2d2520f25fab39a641f968fa3f0b853eae96da8e403cf47b69bed5f53ba4d6656d8d35757a8fa799e9421115de0a55bf12e19531e0a0d466aced9f1e2731e4e0ba1130e3e386da978e829136a6e114fd36d9f3d4f96db5e6ee5859fed798ad6121db778bd3225400000005d1a888a8d81d838afe814b8cfceda23a2d861e29d14421157c242baa4c65f1da8c9de10dcba729c6acb8db8ef27e243526b3776d4504a6e1e779481dbc02458	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2596	iexplore.exe
2596	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2600	2596	iexplore.exe	30
PID 2596 wrote to memory of 2600	2596	iexplore.exe	30
PID 2596 wrote to memory of 2600	2596	iexplore.exe	30
PID 2596 wrote to memory of 2600	2596	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73361607bdc3fe39286d570912c31702.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a99fdc5dc282d4d07feffe47dc5bdf

SHA1
8c4c2ae3bdc33c99b7bc410e9121325bf4e49fcc

SHA256
547f4dcaf35c8a2bffceebaca45be8fb5c1995792cabe8096f36b0b799df3b84

SHA512
0a2d96f81371788166d9d6e858d31720b23d9624872c5970b4582034304b614ee9a8e71e13520ea24590cbf5d253fe52f1378a69b660f4390b9e0c8ba7560915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1c9e65552e49f1a8ec104ee51990d83

SHA1
aaabb9e350ce7fa8b410521ce45ea7fa641d18fe

SHA256
06770d923e9b293539baa268411f3d35f17443a921a8a6d5450e10c0ea3c1dcc

SHA512
8e25cc835801171af0885b383140365d2faee85318ddcce4d5da5246244fdc82ccf2dd7f7c47fdf90b07f9b347638bdcdcab144870aac9966aa03b8bfb4e8304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d356c5216ddfba00526c83ce2e44642e

SHA1
fd835147e30319ba7c620ae80313b26842a46aaf

SHA256
f4664b0b6171672b36c6c2706d08a9d7b30893553406e383bf70e5df07984400

SHA512
e850b2ef9a3feeb55d053ea61abefa3ac3e21f579cc0c574437ff967683d5433fafbe4df2eec58f6b2f6654c149b991900db64a81f0543416a74a1b8784164d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60da2fad3dbc6077bc504ac4f4c81ed1

SHA1
8dab62fd78ba9e488cdde85d8f7c68b2d4a2a6c2

SHA256
9b4d24658c70da03ea9df722de94a1b7ffcdea630459cd571b0955ea297f42d6

SHA512
b1c326f4755172470bad0dc44a78cedd3d54a688a951870a3e3a432a05c1ca5f42c69132aa388e60f224692977700979188a15aea03adf6cd33510c19923603e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
269316abf0bda57f36422e0d790852d3

SHA1
021eb51d8cfa58a43f6058c097eeb0b66dd88177

SHA256
331bbb88d38ce91b8cc3f6ca84942c250a8f9c10899f70d39d069f28d169c47c

SHA512
e1792def7e1f6e61750e6df33e88da99fbc49e61624299bfeaa9d96efb919c4a4be6f62a243344cbd6812137229941b90c41b9e5837e33d2da33a29645c22e3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9670b8f7fb816fba2896f758b039a35

SHA1
ae54ce302f9bad5351177bb5cc68d2860cda5f4c

SHA256
07f9b41746a6f6203b2221bbd61df8892b1278912fcde583e416e4ffa80e25ee

SHA512
cffdb3eaeebe031364b947485c2e3edc4c8480583fbf549dbce31461af12fe88750732343070a812ed21808ca7de31e08be83ef651f791c47a570331338c3ead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4934bb5abb1e0dd26df61bf12740a04

SHA1
320fa6ae58245d8e4e78df7c0497569e0c4ffaaf

SHA256
f1591637aa9a333cbe38ef8c7535398645729e9c419b6f6548e3909ba1b28008

SHA512
ffc2e6ba8a783dfb0892a6c4c255193d00f6cbfd12cac513e5137c3a9cce43290203c2f8a289e043c6b9a08ca8c3407f28088c3a9751f0edaa51f71de0667648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eacd1e2740c89efe42caad13b8968cd9

SHA1
ae52b969e655ba67ddedf4d2b678c32cc7ec6524

SHA256
13c3e530fce8adda237c3372cd99a1d9318b9692d2ebca47b792b27acb61c132

SHA512
22c41611291856afa547a422d7df16c7c4cbb114950e63a1b149ad68ebd5204c6629a1cdd1cd6e16b88f806ac643f4b757cfb7fc91be4598744d915579344bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e6fd9a07898a3f8018769b9be2f8919

SHA1
d7d4762db79518c8aa233942340b024c03a63503

SHA256
e082c7c49714868327b529270c23848652e22d51e4c4977ccf2801027e89ebc7

SHA512
5741431b5824761b0f3222a8e2e3c182a16d8a03a39c043e449ec96e6841823944a6142e1af715c8b1f09cfdbd968565fb3899928ab7acae0ac7040f524ff28f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
305925dbe36f1ffdff695e43b290e23f

SHA1
5416a0bdf451748d5e76ee58dd4a20fd4c94994e

SHA256
b26523979d826325d9c17e62c9a0cab64490efd2145db38cd17c73ea25825dce

SHA512
7fc7a35b4c73ad582d584a8c009e1a4c5f943c9fe227a1dcd97d434fccfa2c075ebad9c39917368607ce04beb7ece7ef04877b9bdb5a83df1fdd20bf48deaa3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
820e94bc6a05132761c3d67fc4ad5e62

SHA1
f675a4760cfd61479059dd15cf0274c46c27b250

SHA256
f671a106682d1991490b377329063ece961f9a61df1f03d535ca199c13f000ba

SHA512
00d42027fc696cef4985140b428287f92ef31385b618cce1a551e074dc74a71b515b3bc8a18f3fc3e3fb9f906e96a9e01a42a472ee1bfb645bd151ffa84e9f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efb91198a13973923899cc63cc6d60be

SHA1
87e39e5ff2ec77883c0481fd52299b02874f7d2f

SHA256
1b938558f7cdf1dfbbd333d03425a26cc0fabe081af26afc88ec753dbe9cde0b

SHA512
b114c9346f59da98d1324e4067df4cc1c05b621a9d221f16e0c83b51f87f197a28ba087aed30074ab864c9b7157be7284cb71f2bd7c23c55a7f09602e4be8075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02af2c44e84bbbc4d63536cda1ecf93b

SHA1
b36a7adb697e88fdd0815ec683ad0c1a5953c9d5

SHA256
71678c1526a2d5a00c945e76ab23ff14fb3cd9b496ad0da03719ca32156aa62d

SHA512
4696eadcc765f2a591497743ce4d5b52c7e5800be3ec9d286fe2121a3cd5e8f6eab28ee68ae10d4357ecac4439ff0227a89f95bfb85f50d3ff5dc2b9ea59352e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44df314af82f13c57d1839f1de1230f5

SHA1
23653bf7f08a54131e560d7f691cfdb1d6c53bd5

SHA256
2378806149abb4a74c15ca0b8601f6cf945b788f11278d2a4d89587298dff4d1

SHA512
89e028046e5f95c000129b5e16be381b6fa9641afdddde2b70557a7a4660a1fc87113a9c3804628fd88cebd4a07f5531b80686953b28502edb654cebfb101446

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD369.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD368.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit