dad5685961e961fb5fa156ce0f96a8de2e800631ca5b6cdf05aa93f961e9896c

Analysis

max time kernel
117s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7657a3f1f79df9b94fde688c04c95ac7.html
Size

30KB
MD5

7657a3f1f79df9b94fde688c04c95ac7
SHA1

0e3ca99a8ba060529a5be61febb950b24a11f442
SHA256

dad5685961e961fb5fa156ce0f96a8de2e800631ca5b6cdf05aa93f961e9896c
SHA512

8a2e475664d3070712e04c3ab0413b4ddaf0f1c35a141cd6e2449be9f3d84c383447d922b94cac3f56c001a8a590763ba0116e48da096624668640c730185c15
SSDEEP

384:S4xQWDTZddtJxfh8I3QtLz8eScGiE2ygCzHMdiJxX4tnHQ50eoXZvX9K7L1r2pfa:SdWDTZddtJx6I3pbkZx3ddYo6imE0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000b1d849ebd376faf07979234ecd5e720511f172c891db71a3e2e43eaf8bf0006e000000000e8000000002000020000000d5e8748a8c1c02c1e050025a1bffa950410819e4108b785a0ba48a967b6ac6a690000000d9dcf7e2946b5ee8bef315fb1585fab073087c87f97c1b3c65e56446e3002dcbe95f1fa457087247520a7335a73ec597987c8ced66c3bff3f04838881a47a3d9aaa75c54a08a65aa970c211be627cf47197039958336375ce97c78e6d2afe495cd62472179b0acf29d80d01302b33fe4ea24e895c2ca18026857b1fe2e9af5702168b91adf508054ea22f76de535194b40000000f504e808b7727cf8e68bd0f4d2b44bd20c1750d711dfaba94b72a53fe8554cebdb7f760635493ef84934de90e0b96750cae6dd51e52b6c34a6604b510d297a81	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D52B01E1-A523-11EE-919D-C273E1627A77} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909c51c33039da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409890250"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000f43af9bb53a5a61b15575a11b611eeb8f591aa4ab4204dd0e7998048654d2acd000000000e80000000020000200000007b73261c0a838d4b8992216fd369beaaae6f5894ed82e31f1253b3caa006d7602000000062e0c756657e6e05ab45d501c6ec23abfaf6e4ccfb0a8c277447e0bdaecf56db40000000e53f1f67ef66ec49cbebc0e5697a27b5ac3f52b82f1700d6d72716f9eaf182edc24952a9cef866be18ae95f5aceb7e9b7182dfc5abfe73f3f200e5379e679334	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2740	2648	iexplore.exe	28
PID 2648 wrote to memory of 2740	2648	iexplore.exe	28
PID 2648 wrote to memory of 2740	2648	iexplore.exe	28
PID 2648 wrote to memory of 2740	2648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7657a3f1f79df9b94fde688c04c95ac7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
752c5e69ceadfac4dc133e064ae15c6c

SHA1
d0fee4a42f7b8156d4817bedf95fbc362383568b

SHA256
ed3403d4e1e6893910f8633f851dd5f9df95e57286afa2a0ac96ef7069f54fb5

SHA512
1b534a54fbe76c2e5751f6eb62e6b6dc6c40418d51e9822ac5757392702efd399de50cedb4c3608eb25d0644a4a758e2160caa2438d94a90208f34aad1a1c428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eca18b5e775c1e5111c3efe7bc7b9342

SHA1
99026a8f187df7b5ebcf0031980f8d130555138b

SHA256
5a945de927f8a28572d3093d90bc4473a2e7487a163690a5314408570cc78661

SHA512
6c38c21d294cd26b2162e0448a1307f8b718652686767564b0ce419eaa13991e021d842f4248c4ebdd9b1b8ec81a201a1d70e275d49e162ce4a7b773f3cabc49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6613a1e278ec0f85d3680c875a138476

SHA1
24abdb7ff235e107f95b4e8ca9cec5249c4fbfda

SHA256
4c8529601a20bd827a46164fc39eb7e3ea3eb546a9a0d6f72d6b46c2f3cb1d95

SHA512
482021ef61d9f6681ed807fb4401f540371114e74a5f08b9c82df1d88c483d49a0e9282967598024adf7e257eeeff53cccb94f4264e33955022195298dd35c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
861cce14f3212c60d2a0d4d9c14d9f63

SHA1
ed2935338a720a7d38f2f4d60d37adf53e79cd11

SHA256
a35153ddec63ea7cda2429c18f36527f291ecdeda33ecd1a7273964d0ddd3977

SHA512
f02591082ce09ff4d5353ca92895b3768955d151b40e44da08328198728ee7d78fcfb731189afe19454da7232655e94f0eca8aa540b69d5aae50bcef0eefa812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11297527ab4e7cb425101a102a38b2cf

SHA1
b9d977772e8ff5ca84531db7c49b21da9dbffadd

SHA256
73cf5b6ab1019bb3cd26d8b8fb6373675b5561e989038b79e5711dea5898ce35

SHA512
7c712d6f22a30b1ed0b3653ef7b5dc961261050c356c2beb7acf6e3095ec52da58029099ef3e75f9d61c1b561c43e5512b2c84a0a4310acea92caf7cc5e705a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9389471c7cf92a1432bc008c96d5b6d7

SHA1
81c8066e734e8a4c521da45f1c22f67b290ccad2

SHA256
0d081d379f711a963784340a4b81de54ab33abb5af0db0c886df4a66492c75a3

SHA512
5c0773a15dd34ab0ed9444c524ae15efd3de1dc647b6059d1cd8ecb59286fd151311d4ff62bf84ea35c0bcfbc132cb9cdbdea69bd71fc00579f8107a5a0b1f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d259d4bef91826f4a416a8ebc8304cd

SHA1
87ebab677848caf8904ac6e20714330557ad7e91

SHA256
83db8709bae44139283b8de9e34479a5da999e6ba37bcb7599fcc8a62812769c

SHA512
60379f87bf28b34504ca1720cac75b3039ee7224cd7a972d69115c9ea26c534775855ba3c6bf54cb8adbc0b7489d5c856e3e4b0eb709595b57d61333cc0b36ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43cb3dabbfac35de0d6197884924550c

SHA1
118a4b560181e86cc2bba25c7e6d379dc4910bee

SHA256
a511d05dde0e8471e88fc97ce9e82af85bde2a08eb101ca344c10a2bae4ca691

SHA512
c3aa5a4dc3d10088a9602e4944083ba9773291d88c2acf7407c2af4113f41330adf792268222302ec7e2c01c9d8d004ccf912ee7cf475a61681aefb9d17d6d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc581889d500490e39f46b778314eb73

SHA1
e0e1446cc8ae23035e0f06030c1b0f6c96e40fe2

SHA256
dc4facc21bd21ba897ebc409f2a23c96767a590a11506a9e97305dca7165ec0c

SHA512
15d2488cf5560c44a069f13c8519c94daf1a744c0a76f0422124700754e5ffe44834b745c06ab88cf0a44d1d616e5113f926a94ef5e08980b87c86d178cd4515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
221ade87677b2a4ea88f56f796aaf4ec

SHA1
345b8dd699f455e4b22b7fe9b05c1f8181cdba3d

SHA256
939cd60d9c5bf7b3c2a67645e5ec3ece94c5aa225c6940b8a4ee63d14551a0e1

SHA512
7a66cfcda098128840c775a9a7e2b348cc0c4cda294e852ed3ff3f74c53018482212d96be1c705459595bb5285791ae73fad7d0934fc3aab44e6f84b70215340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89585cbdcedf75471a262bc00e8b1916

SHA1
be1445fecfc920eeacef2890aa56f9b9aa490ca0

SHA256
183536bb6f3eba550245891dd95aa7fd174d3f7d29ffb0eaee0d099796f0117b

SHA512
32c815444b0546cc451043dfd091e2bf80a1e35fb38d2e9dc4c15a2e4f1d1d9d10c289bb55dd376cde24dd996bb138e87f3dbc13c307576d478bfc469f6651ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e3553a492e0a26e56779fe244ad5ce85

SHA1
fef7e8b378e6c961985448236d508071c6d9a68c

SHA256
14540cbc064e9c56297f1e4089a655f506b0b2222deecd21952ffcde5a6792b0

SHA512
e5a5178183415898699195d4fb9fc1959ed654bcf02aa1fb0c0bfa1b97c3775011ddc8aab0819de444d1cad094861116aa6979e93488909594987951c094aac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1395.tmp

Filesize
57KB

MD5
6203908cb75c93e104b76a1275d7fa21

SHA1
f6995d56387034ec2dbd93ba1682af147b05ec0a

SHA256
380782d38234ff8a666ad7678517e4b3a18eee29bbdb6504079d4b4ec4b2be0c

SHA512
99fe30d8ec140bc6e107319513b0a81f40f52956d1ac1e929483bf0f0d43b89f32ee582feba3e4c02702256c45f32846b5c6695b944c65f30401253b72ad8daa

Download Submit