3a815434b5cf8543dbe6a5e924542c8a27cf13ab9343999ea58f71ba55080949

Analysis

max time kernel
169s
max time network
240s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73650399eb59e843f14f673c4fb27c1b.html
Size

27KB
MD5

73650399eb59e843f14f673c4fb27c1b
SHA1

c8cb077e5f6d84d52ae81e29b30ecdd62e44788e
SHA256

3a815434b5cf8543dbe6a5e924542c8a27cf13ab9343999ea58f71ba55080949
SHA512

844f89f9f6c069e262a2ba7120e44b57920edd003bc23413b1ca6fbaebda677fea957e891c010b2bb1a66ed12a1ee163fda6d7714c156d9e09e8b26c23527b7b
SSDEEP

384:Kvpcdjzy2785ILmvBQsLjbs+4rPXfDQuOo+y278/:KvpcxzrOv7QDQuirm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0400f532639da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000cd6890e9f8f59084703bdc9844580b5c6946b0b7e381ca75ce1ca45948cb38d6000000000e80000000020000200000001721f7a2971f7c6dbfa078ce47b23d30c2440444d6b28dda488de341a530194020000000eeed8a9e4851f14ae9adc002d0471f8f5897052531e7785fb6d8fd090aff67cc4000000076e11a3983b3717fb0c4620ab16d0547280d297dfb0a9620fa79d150fc2980d6e0d1dcb80d1a1d45380507075520487b143daa8448e636427b7e68031dc00cbd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000076e4affc5e5660f233feee6d2c817d34d7db44f4b9600d78db8ad5ef88acfedb000000000e800000000200002000000014a3395f1c7cca0239b996f869d8ada76c3f001eba4bc167ae39e04ec1c9f98e90000000b3e37dd8fa64bd792da5c30dbc6bcfbcf7a1c154343f04e3e3d0ec1aadad574bdbc35b3ddf01620c186e728e6c1efb5b4cce5e6f2ba1cb129efe478dfc1c950df228f015c7621c6dbc9563e28570dfd4bce7386f72ca921cbad33c6b289ac25d665ee786fa988d2fd255cfaa789167539fef35b696ba9d4b40ed2bd0c97137063aba566e6bad0bc3492ebd11f5c4e56c40000000a4f9660c29512acf157831b4762afbbdfc2dadb8fbbcd500b7eba7f30fc9be05385948bfcdf420d6f38fa3d87b571b41b2dab007d775fef94dcb368a3e1e3d02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{571F0C10-A519-11EE-81EF-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409885755"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2840	2708	iexplore.exe	30
PID 2708 wrote to memory of 2840	2708	iexplore.exe	30
PID 2708 wrote to memory of 2840	2708	iexplore.exe	30
PID 2708 wrote to memory of 2840	2708	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73650399eb59e843f14f673c4fb27c1b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4b3390a0001ec9e29ffc45772c771cd

SHA1
6b63c5cbbfc85d743e2f35bce3b2751e5ccff2d9

SHA256
a0479667e4db27d0175217390c9166c3a6985459dc3fdb0c92d1618c3eb67b93

SHA512
db59946b0521fb70c326366851bf0da1a8908389276e45ac75f4f9ab15f51ae30d7cb4c73bfdd5c12e7b3857cdb63421f2015250252b29ab0c6547c3d95a2daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f4a773a3a9bba99655f5efa8434073e

SHA1
10a016d9317a50b923f83994532137136f179f5f

SHA256
befd7ffbb914a9f657c584aea4d65d34595a2c1cc4e59548aa1a30028ffc0a2f

SHA512
e0177dd3048524482947014e6bf182e1716eee52a29676e5c5f2e54cddb4ef9a3b5de4709d7b473266dfa49e1469150e587ccf7b7376731cd370f91be6f12cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b475f29f715f0a663c733c0a732837ff

SHA1
a38165d1250474feebf4899a839c7abbafae0a68

SHA256
23d23599f366a84bfaf9c06a6a3ec5d37db1181d16bb23efdf2a6174ee61eaf0

SHA512
5f4ba17f62ac011aa192bbcfe0974342f43e06b22a6f162823ce0857407943beb3fd6baf2b1b44abf0ab7fe355e53fb96a36388ce253de4ee7306a4d311143d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2bce106f561a5e8a4adda4b7b1c4c6a

SHA1
4067ed68f8077e856b858ad10b3d93ae864c29fd

SHA256
26395f0da58d5a32d2fd1ab7595e6fbbb9bf488983dca0bcf851179a140f885c

SHA512
8087e90fa3bd6016c4f9e04d3535b5d099799668aa61cf9640b8d8f1192d10f4404ae06863915fe579c4956f38a35e141bf4df0bff86bd3f71a6e4e56964296a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc10f5d4d6a93f6b6d226a194cd39ccc

SHA1
03f10de63141f216227e613093a622609a8ea6d8

SHA256
5880a4c234ea21bbaef89b373bf6209f516ec489d3cce1342d7c620250f81583

SHA512
a55e62c790965b4959a3ee4a84bad999c934ed3793921cd9e3496795238352475101757461120ca81428d3d1a13100e6da62ec66aa4b576f3ba86480afa0eb10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2c6c6704b7eb2cc386b19a9ce542120

SHA1
66f44f32716deeed0c74078d155ccef1b74b3785

SHA256
365d95ea6b36221324eaa5c9725c97343485c73a6f72d5ef474758e61996c047

SHA512
59a3d21511be06b75a4058dec709d658930a06a1a49cc47ab65a1faf2d8d4ea60ea22ec33d06649fbccf7271e666a09399ef187d3f05c2fb7f87ad81d0a5c92a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc8e2de0a2a9d6f804fa75a74f3c5c89

SHA1
e6d8782bfef5696ef2f5be7fcc51c4d095370358

SHA256
a260954f40367f9212e046cf81b2e821cc7c6324b157711c4a5ae2e164ad7875

SHA512
5a10c5c36d27e61372cbf1a5c0f1cb84bb7a1860533cf123d57aa571704cbb9765a56ce9f8c1970d4280636b4181e4ccba509ee69c4ae3686f388f9bb4e87e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73997cf6382b1ef842728d51a95e058b

SHA1
b57a34da9498aeaea89ce190af596873922fab1a

SHA256
1f1cbfed1f576f443ba822c73c3059be88f6a71802063a5abe5eb3fcdea60979

SHA512
dd12561b60486ea88f3c7a0d2d1a9a25808d90bc4ce7b79d9f28ca2b7b7e96a3d8c481a7c6eb02b138635a0c0ea0f03d8883ba77693af5c9d8a7faac9dfc8f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
187656fc901b5b716cfe0b06582e3ea3

SHA1
21b57fd5a4def65e44f44c8990576405e6c09cbc

SHA256
e1480f4d9b6b24def6cb19fd9a68d750cdbef83424ac228fe4c196813659ffa8

SHA512
76a7faa4826041617fffa30d3747614244d352493dba01f4af1a053c5fb80fd2eab51e8adbe46d94d68bd3782dce7cff3d8a4de7a781a007d011e79e400ee16a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f34e939316737d140b0243d5e6275d5c

SHA1
b350499abb3b1fd9e0ab6b1de8a13750cb831418

SHA256
1dd6cac6c67d2ae1c90e5dd7517ea9b49a39ddab08edd372941059de1370fc9d

SHA512
80a9f1153828f25999b5a101ba98102a5c2ada913f1967efe579f473a1b38c720b3dca5c2d32700d9df3a74bccba5a7799c085c7cde679b1258397608af5da0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ad3e97ce54abbd6fb8e5abf20caa1dc

SHA1
3714e8e2b37c80ffdb14a62f8bb1f50dee9fe139

SHA256
5eac17d78ba126acd4ba2ee6464ee45f16bf341c01b22005ac0c5ace2c7520e4

SHA512
1e7704905777db732e68950f823046685e8b9510c42aa0deaeb310e447c86fca806c483b59352e27d8fd0b86d436a918fc59c3858cf08bb856881241a4da5fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62b19a356f41c3dfaca95a8df5392ca4

SHA1
a4caf35ce9c3eacc6017aef470edd678e66ebe4a

SHA256
5d6c5cd23df596528b230c5adf5a6b0dafddd4697d34830c6bb3c10ab6e68e75

SHA512
64a6d3064de96da6a2779d04e773a032368fdefd12cf93b9dd45def7b0f976b15afa3f54cc5563a04c8f0a1d8391eec62646a98aa55008fd482cf7c8b7013df5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8e54c137dee72d3a3bcac498f32223c

SHA1
62a974797c405d10e6edb31fb3f2a54f4a15bcc0

SHA256
500bbb718dceb862a2eb229851db1318b79209ee057c23f724755e21d149f722

SHA512
1d1b42997212190e81176d4fa6b492997d3440aec0e5b1e0b0fe29b6e368468ff25e40a41484ed164a035b3e0b03630db2168793befc8e6bfdb6daa6f3bc461a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19d84affff8dc54176f762261400fed6

SHA1
8fa496f31f0f790bb251d0500d6fd2c651358651

SHA256
bd7a11c2ab95ac9eb3190b126653bd4d3461a1854a49a07c842dd5fae25b0cf5

SHA512
0c3dbcb9dba5375b6d6b64555cbd004a54810abcce6772be89e5bc5dd18d4cd18fedbafc89427ae30dff205b0e32b4c0245f9396f65154339ee56d4e9aba06f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f066415e0ddec4e05b03c1bcb7c42c3d

SHA1
4b1b80a046309fb1d71ca9e6910edc47e665df7a

SHA256
3a59a2e9e754f8f651a082c800041443b46038f2f15b370980677de92c9a372d

SHA512
5527da70bbcf3b2dbb77608d3596505d8205d730af51309e119ca12b1105394365c5cee909dad491834cac59e2dcee8d50a6e78027d36bd8b32c3a8fbd8420af

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4AB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF78D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit