11d5a8901581393fe5605231e9be932190784e021794799a46543a4092a00051

Analysis

max time kernel
205s
max time network
258s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

73bf4057413dd396a986711c9dc8f2ea.html
Size

27KB
MD5

73bf4057413dd396a986711c9dc8f2ea
SHA1

0b6eb73cff7611e4735f7647a924c3ee9eb38cd9
SHA256

11d5a8901581393fe5605231e9be932190784e021794799a46543a4092a00051
SHA512

ab8f5749f82a929739245b96dbbe18e6dd78f6fe6d2816ac9b24710337a848aa9f7db811733d3c6dc3dff4a406c1da4812ee6ef9dc62e9ca749cc7e8746dd5d9
SSDEEP

768:jRYDhuHNEW0ZCg71zvIqXjILyts6kTvDjtwcynCkeE9J3mmzyxaDVnR4AK:jRYDEHB0G

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409886469"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED1393C0-A51A-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000c94f257bc901e357cbd404ea4a5207e61c2d1c85b07b256810bf36e8659f7e7c000000000e8000000002000020000000acffab71456a753299a82c7aae6f6c60c74775c9019ce75f36f2650d41b3908b2000000076979ee884a2a5d3ff12a543c8420dcf2f65c0104bd88d53f43055b7afe8c7db4000000051a5db47dc7ac45ac3d0e2df7538d43e9d09e5e8b0d6baea19fd8b3810ee11ddc66a3c4de888f2ca16722726bd25cabcee2f07c9cf564c3db7a75bb1015b6690	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0952ac92739da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f668c83457c3f37090b69d0f96f46bf5cd95c2c665c7eff555befaa980fd5d96000000000e8000000002000020000000549d42526e1de5f661166eb9489304532d1026c7fca6ab63d283dd6c8bf0a84e900000003d1894ba0864d87449d8d399140496204d38e3079e66e4d8fb8ceff16b6571fdf96452b72be5c4ee678f4cb7cd7f9cf3a21c92e751bc6d03f1a69f4e73306b80f5c9e8ba3ff90382e35da71a88e96b5f294c4e4f6b9da155fcfca3d0ad2b16bef4df6b88a11dc893fc961408ceb0b7caa17fe81225f39c2da31c471e2eea0c9b0468a9fed819b7b30a39a14f8fe14a39400000007e7abac42b69ef04c7c388ee5bd51bc3edade7303ea0db62358e28738405349042d0f6184e98b37a1e052e6fced51d79ab21144ff323e5a374524701e1e85e87	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2968	2604	iexplore.exe	30
PID 2604 wrote to memory of 2968	2604	iexplore.exe	30
PID 2604 wrote to memory of 2968	2604	iexplore.exe	30
PID 2604 wrote to memory of 2968	2604	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73bf4057413dd396a986711c9dc8f2ea.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d8dabd4fc06c523a7cd59e47dc49b5

SHA1
eb13a5eff33b750f9e194add91a8e46caa1d7d01

SHA256
cde4097434e2fcdac059165a0494a6e2f2751f1846ae32b9e80ac1220c744c1f

SHA512
140c43121d63fce283a6c8ebd6f675ed1fdbd7d69c173a5b79502783bf2b95c3677c3c9bc2e623e0c29c23d65338df78bb4230bf12a53799d5d93e2f7b905a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
823ae269d76da286bc6b37b50d9d9361

SHA1
3454b0b6dca867b603637d3f0a7cef0126f008d9

SHA256
cb90a63017f02207ea30eb156e941513b3b5966909b222be835af063037f0c31

SHA512
18cbfbb6608e4c3b15725bfa62ea640dfd27d468fe7a06ee6d825cccb8393bf6713de7b91257bf5207a00c1f009175761cbd31b5a533f188bb4578fcd7b2cf16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9684702fd0e8201bb9ed1350d8a95865

SHA1
dc4a4eb391b7b4fa36f9d5ca805eb21c39d69270

SHA256
3b7b481d881d345d5dee845a1c534c05e7f29f6d4da69a03a5a04f41faac50df

SHA512
5d51f874765f65bb07a8866aa507ae04e1180ffb246ef17c28b5666f0e679fed36b2e4e4ffcdf184a03269006361fe13538e08512cf6a9e3f0c486654199f89c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ef6663c425d07cf9b6e317dc9f1d8d9

SHA1
bb8ee0c27fcf670d4672afc27cfa0d9ac12ee5bc

SHA256
2307bda98094be7f8315e485d9837cba5ae22966df99e43103e61e19f9ab57f5

SHA512
bde31e2d7655fb6f9b31df2828d50892b8ba389b9e96601db09d3451a6a85338354f6fe54f21582db9c83306807ad5f9c1cfc35cb90001acc9ac7a326beb81d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ffe41d20e299d6f60596beb81a2b187

SHA1
a88ac3da5e79956538f3d050be845c2e0c1ed585

SHA256
e0181c8b5590a9ec549a81332ba11c97473689f780964642680296da1cb5d081

SHA512
f60aa7fdf394e09abe1e63d35e10ad72a5966011d63f4103680e73dd840c8be60eb8adac44daf39b0b85016f5491493401aa273761828f069fea20def2e0970c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
930cd0c2323c847745aced4fec5844a6

SHA1
94c1f5bf12225f0a9b9ebedc9d3db383ac312094

SHA256
34bc805367a8a4d88fd8cd07406ac414a80e707993a1e3772008842fa65daf45

SHA512
2df476718e00894136cbd005e1d4e9067b125777842efce4f03d770db6481d656eb01443557737a0c82b85aef1b39c1c341420c9e9bace2b38e4cde64afc8ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a348bee440d17efe60cfe31e661055

SHA1
0a30c79721c508f643ef80244838152c8fe7defe

SHA256
417dbc16921f7007bca90fb99a4fc133305db422089c3b3be913c86d00b58eab

SHA512
b66bce18b5f30383215a9a64f93a3c9ac48e2a63586c8b0507c572d6ce40da6af6ccb16e5fade25392989bad862a0cd0de1496f7125f346816852667e2a47398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89b20aad1df399e01db988274263ba90

SHA1
86f0bbc4062a8be0d91922bb02fba89fc5238bfe

SHA256
01ee3f325acc3dfbf50c3177472cabf46b6cbacfb0c553e4b61a104b37e1ed4c

SHA512
3f55e1373b93cf441da97d0a8e1dcc3dd2a34ad0d5c7d9b8c177037dfcc262686bab11469567281dc8ed18164eb9b6bb60fe8420ed4b6e210a0be306efeb8b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77edd7ab28cd4842cca5f2acdd7a30e0

SHA1
5dc4eb2bab18bca4d72c2009144cfcd6c03e4732

SHA256
69244dad21d3d35dd00225b3286a02944fd8978bdebf065efc67302b2e3d9154

SHA512
3de562ebeb5f688b0a6720f5f0b572ba2da194cedef9069ee7c2ccbe6d1b116e76b151b8067654749f1074ffe5d0b3bee70d9da7194dbabf8e16b96d2a2e391f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b32b920998c2dda11a14ec92061826

SHA1
5da225644d4155b57c2b8079c868155d8bc63da3

SHA256
59b246b66d13914aa3c6e0cb7a084b111293d55fcf07cb7d36c5f1ea82fc4c6b

SHA512
6c03e10c12c6e98e204ea4cbe917072bf169fc485546119f77d07b5f819d860b782e981403030fd84a8630735ad41f26f72d6a2b7dee76af43b9f235fec63d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37771bc78221ccba65c317415c4fc8ba

SHA1
02d7586aec353a3ee14eb4844089eafb0f3a4475

SHA256
9526fc5469929fe886497b2065b2951d56acf968d41820376ed5221f6c2bbcc8

SHA512
e3c017c93c54ab82e8bccb4083529b2703d369404f09575491ae44fcad57fa047458f91e299ec44a85e61a093f4d4951ea451098bf90d8e4db55c1d8d555e455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25bb71dd7e3d108cd7984f202d0aa4bd

SHA1
4f62e81c097d308d0b8c51cba0e42dc10f635b2b

SHA256
578253ba88972ae8ed3f1a171ec43e1d80becb10b54dcad385508c44ad69d058

SHA512
4516f28f6f179168192ce74600d9d9327dcb20c8773a84b131667ff9c31b536f3c9995a855b64977eec3116d0042d0cdebbf12721866500d35691700d4c27f6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e37653a3de042c0afe0ffade9697b1

SHA1
f6a67a9dc1b7a7c7a9d67d3842a1c83758484b28

SHA256
18250cf079f25e1f2996a280ebc3f5a9bf85c8292c426811ca94dbd5686c69cf

SHA512
6f7df37c011436f4478b247966637e217ab10e15c7ae9cbe07b42929af8dbc3ceeccc2ff52e06f0cbf28f478b163e4cc1309ada5e3b2f14318818e8783d08d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bc042ecb42ae82ffc18fc68dfc0a578

SHA1
4fae0f3b259aef88f9e16d6368cd8c0722fb56bd

SHA256
be5b57cdd67942cef50c4eac5915f20bd75be6dbe3cf190766d08265bae2d3d8

SHA512
85bf19dca4fea9044b2534bb52a88d5d04c05ca66b59a762ea62c6a659c2d452c00a5d629d716310091506bec8b86f44ae70df8ad31f0cff6ed9b48df561292b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4127.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4178.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit