533ae75bd39b6759ca72b14df2c35e45c9603e73f1d53d1dce316e1bf53f60ff

Analysis

max time kernel
145s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72418064a7b5df59a9bb620f41689170.html
Size

4KB
MD5

72418064a7b5df59a9bb620f41689170
SHA1

d431820e2a0b53cdc43f33857a8a9ced874b216f
SHA256

533ae75bd39b6759ca72b14df2c35e45c9603e73f1d53d1dce316e1bf53f60ff
SHA512

dc591471371126fae706bf34642e17b0c159120102e9792bd72eab761f0f0673361fa18a00bced0805b070042dbc99a15ae53bf76655f19c822ee4c57885fc87
SSDEEP

96:rf9seakGiwLsvfpFFOxUEwvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIarvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410717270"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005cd8b437043ed2bbc9326e8e989118fd1c8cb5947acdfa7821a602308091a139000000000e8000000002000020000000d2287fda985b0363b8b79eef54d96a58bb465067eff1dc34e3fe559ea468157e900000006e11d27991ec627b75ba22e971f9456a67c1a55464729808b3ff6f88569321af3f933bc13915aa6f04afcab007a75022d6ffcd139fddb7cc2f3e4a6a62a1844051cb91de4bd8b253c5fc160d0c1c1cd3cdb2b14db5c4334cdc56a6d674ee80adee00c95da441f17b8393400c10c980263717b82c5a37027b25e7629c9c39f2c40f84b48b93f2cc733acb69fc7ae011fb400000006c63aa6d0c10bc4e56d1c89da76a9c8976d555f588261fd06f9af18f353fe90d9911494bd37513be626785356aaa75e22d34ecc8fd6bbe9a4d2f872f4f6864e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D67C3E1-ACA9-11EE-9853-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000df5b7fb0ecf6b388e03f6063fbe89343dbe7188640bfe70458e93cde716f61a2000000000e8000000002000020000000cc515ecc594da75f04b1c1b9236fe24834fc70cf6c03525020e9859494eb035420000000f6faa3d16e6828d2a0f715f55dfce36e0526ae96fbe5ab50162e7c3b931aea5c40000000e860955d9651af033379e5e18b520630aaceee30391fa5ad0cb99f52218bc9abc75e7b0e51861ca93c37cbdf2ed3f37e731a30a118d700a4ebbf771ba3bac5e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9005a132b640da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2860	3032	iexplore.exe	28
PID 3032 wrote to memory of 2860	3032	iexplore.exe	28
PID 3032 wrote to memory of 2860	3032	iexplore.exe	28
PID 3032 wrote to memory of 2860	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72418064a7b5df59a9bb620f41689170.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8db8a77edaa074c93ba6a2f5fc96ec1a

SHA1
b8d7f0c8aeec4b5ca7defa42fcd9e6c74de39264

SHA256
cd23b2c6592da99786377b156e6b89287adea9b28726284e5a82d3f9e5fadac9

SHA512
3983789fab911056965cf53a7a5420419c6f764bb187c4a30f2d5b73ac348d1387549f5d4cfc2ea6eafb928af0c1ce574113ac581eb4a03281ee9628be154168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b94586d6201b83e82cc973d651738dbb

SHA1
338e5001583990f3357fa3d10f412455bcc10d83

SHA256
cff7d5cbd8642c5972e1b0015a761a3b26bf5c5b82ecc77be431f4fc20835b48

SHA512
9db06b2e6e2b1f141258d8f9bdf00267419f91cb3bf855a5471f3c7f1d8eea33363382154087a4fd5aaa5925d8e7fca3dbcad0fc047e9045d736fe48ded137de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbb5f1c8626ae91484c4c8290a536b56

SHA1
c69df058f6674fb29271c887d2888274de759985

SHA256
2250703caee8f9951e02caa2fef906884fe465d07833695b05cc9801ece4136e

SHA512
bc3053213491802dd7e4e95065bf05fdcc8b10ac2f652aa63af2100e0d690071b8a02757005b860e3e35ff37bda234be2eecce7a6e70905d0c9b320c9897ea5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7614a391b6b60906871541ad2cd1f5a9

SHA1
16603860fa513b7d12e6f5ff635b479a754f7649

SHA256
0de28809e8c2c99492ba4f08ffe901af2513df3b85ad5741c5381a0d0969278d

SHA512
07b7bc9023d58171284b4d62d1e9c8d9eec1b3a12f0e89a1c712ff8056ae5619ac2bfe25762f2909c76e8024d6bb2b3b4f1888d6cf259bcf15af648a0976f75b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05da5895739a95e351d979dd8cb5d6e5

SHA1
d66ea0173a6a287643701353caf654eb141fb88e

SHA256
aaa1b9b574217694023da7de8e54b68999fe7a8c772644b6bc3ec4e6907081ff

SHA512
632716d88771bdc2f8deee70ffb521cbaa3f25c225de477b63d88969c77a67eb059b6d010293e2bb13f30bd97cfbf23efbd255e3a5a3727a81311c28396b2fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e2da4d8c745d67cb07f27dc3e47c05

SHA1
037cf06e30686e72ad552374c5741ae2abb6298a

SHA256
659d811ed0a0a5ff5e69b566a2c2a52646ce25bec4256bf68356370c9c01ba64

SHA512
e30ff0dc9606b4928e4e84cdd69736380fd0c9cc93c4eb6b9016dd5bf4a611382b1c739d97bed96fd5f69b886513fed3b240cfef2d75cf1c1c1b37fb4b16d292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec297860cbf1367aa937574239d8faa2

SHA1
5d97e5e37c253277f7e6f3d69fb724233d5aa565

SHA256
1d49057872cd008968da2e7be06103295df0c2711ea0c327eec7ffeac64b9101

SHA512
49408bb985b9d65efaff01bbfae9521d1f19c111f5c4f89e17b6fae4a30d1c9d7e0204870177da4e386eb2e0a5999c0f97aeefb5230b95c38aaa8acb93e8faa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f2b1b78ff75ebdafc6f8bcb90ed237e

SHA1
d398cb54a7a04b21cb70c38f0f8588313d3e423a

SHA256
829bab105c619e9fbda24a33028971fe577422fd02271b3353e9d52b7ba7a796

SHA512
a9eee7c171306f3107efb32991ab788891c2011b0f5942dc9d71a26529c4047bad04c418f00387a35d8af55876cf11e9f4b7e8b5e2e85f46a3a6bb9d102546d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26fa7c3a75b62fa51bcb5f93487ee192

SHA1
01313f2d2d7a4b63a4addcebecf64b2abc8b332d

SHA256
a2ce4b4483736292b7d1730058880c815f8171ff9624d2bd25da68781ff2e591

SHA512
c6c2049fc50e0b267bb31fef48323aa41f4af84e3bfb33c25e155680adba7056fabfc82f059d66c238be56931656f2aaf962e21c30fad059c22a7340ab366280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64f8e0a65aeee7e19697d1dc7bfd8d61

SHA1
bfb7d819523b9413b3e6f25d4943b8047ee8f44e

SHA256
7d9a9f93ba5278b7de2f1f00311dbbee0306421c370e99fefcd675ba24a747a9

SHA512
94b19fa3b26f9286f7f35e05ef2b78de457d00806f4b4ca1b5d1b02d0a7e77deb18b6b70903df058db33ff631a9ad7713febd008746deeb8b7dc70a54b3872a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8609e9f56214b1b5b5d8bcbb60d9f1d5

SHA1
90e144b54cbe42af95f117c56d0037613ef543d6

SHA256
8043d0455c869b11283393e90f686d3d0f588a7c15c67a49e9bed66a20f516a8

SHA512
0f99f790474bb0ac5dbb5758bc87da84d37750c0c0e55ef6a621d2e33936a0319d5a763c5b9eb275cb01a064c462da3e55d03132219bf4957c370d10e159979c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1edfe9f3d7c721e42a36bed34cae9d0

SHA1
e8b9c13fdd16082a3914e7cf9875e9904600527d

SHA256
1b21dc51119b9a4c3d8e0a95e40268087d12f96b7d4cce7aece792302b255b21

SHA512
0909593996fb9fffdd035e2432bd785f9c7cd8380c208569c774a5e8e2eece1e44134b2b39ecee641a90e83e0e7c4c94d6c8603d70265ff22fb51c4931022478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0638b49aeb1e1cfdc42bc9906f6fdc2c

SHA1
1cfe9cc81c76233ac9b8db8224a838a15d18fb41

SHA256
67fef571098159de91266022d440c9937019dc6e163dbdd5a9046095bb92745a

SHA512
8cc13d9fb241f056e2c1b1b714feebccf0504e64daba40064aa6c0f12539254661928d8825ac58a01a5670efa2b0e4b676410e662c2061a865c758e61be6dcd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
939c9cd04348184312da1f6310e5b42c

SHA1
43be8936f5a78a36cf11a0cb5331ca468a41a780

SHA256
d52c9c87630a8e519437f3aa1fa383ba84a56471b273672d97fe9b6da1448b08

SHA512
fd5def3662614beb11a50650bbe8d299f16199f4512b95f752e5c34713bdb9d7027a6462c9746dcd7a9f3c2e77dd01e73e0544b6714916750fd408fb761eb61c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
268018c173278c1bdf1f902ac1b89daa

SHA1
f8c160800e6d518455450ffd62bf0051fad64a5f

SHA256
707786ce03aa3aa0470f857f12378a1c7de34f4057f6c8e356ecf08d9d541f02

SHA512
b689dedba615fb5fb8f22e57d560057618086b4fb17ebce653aaff418f6c1c8753df63058e6231199d3fc66768f0ed20447adddcbeed7d125cae516f439667ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92dd06c5f68ce96d8dd432b450b1564a

SHA1
6335f07ca73facf3291512307eedccf83d4316ce

SHA256
fc7d419b44c613fe679da1d9d3bb88e291fde7c10660a3cc9b6f8f1ccfb3f62b

SHA512
ece99129840299f38b646e47abb7e7606aeb84834f0feee55a701971f6f19e137a6f16f3f5a491e2bee7197fba9ab625c2c92821886194b3a16c70009739f811

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC88.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACE8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit