d21dbe06a1091130822ae0ac240fec214ccf41969f0bd96524fbdfda19efb961

Analysis

max time kernel
146s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73eb62f7ea25243f65efa1961e0d5ca1.html
Size

51KB
MD5

73eb62f7ea25243f65efa1961e0d5ca1
SHA1

f40e1fd61e968c61d43ef8007aae13a9b2c1ebb8
SHA256

d21dbe06a1091130822ae0ac240fec214ccf41969f0bd96524fbdfda19efb961
SHA512

b969d0e191406ef175b87d3ad6c0492e0e71b600d47055f7b88f126936ea922fa942ea35feded6a51eeee4bd6683b912ae5788d2a88bbda27548bd4218b128e8
SSDEEP

384:FIf/FG36rcUQHEJPHQ3usQ5+zkv6QOogcOH8GIQCuuxsQZxfpa+WonC/2:F2FGKAULJY+H5+q6KZx6SC+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000004db5097c584bd73cea38aebeaf4588a4e8558e7a896864bc1ac949baf0a6fe3000000000e80000000020000200000000607611cad8c2907a921d605247b96ee89db629cd080d912bf23691b68d4921f20000000bc00f5e2dff282a86b11247cfef514c1ef272b61bb740d81aa9e025516a20230400000009f8f8c18688f8a6e3db05e8348e1600cf615ced70f2e254e96badbe023c65858c11090e6daea5d1f05becb669f7bec5be6660b8a5fb948ab5250ce555e5b0b4c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409886493"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12CF0FE1-A51B-11EE-93E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701f9eea2739da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000e53b6859617cee0c8bbd78c3e59966336be9f0ab862e2020bc85f61f351852d000000000e80000000020000200000003c9fd6f485a81e31fea33b37377471ab5b80d9cd1341514226a5bb879bdffdab9000000028f416ca11c4000fbe704fed2d8df125300ecf7469ab54ef64e0c8771a71bcb8bc726f5e22104b374e5e44b45e453d220044b1017f0ed836f0d1b6e8fd57b9a67c357b581b1bd87db73e43164506cf1936a192fb2bc772fa8bb033e46ac4c29e30fed20c5e5f4fbf1a838c1a29cf77e7a9062b2ed33db34c56815160e7d6f113f6221a1f8fdec3ab6174689af3369ebb400000000ff5848deca1a45d4d4abad981fc68606b5dbe5b65b7f08cca069fe48e2ab887db09cb35d361ac67ee7c520849d03d0e88dc1de076a31737eb6b90c0fdf38a1f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2724	2896	iexplore.exe	28
PID 2896 wrote to memory of 2724	2896	iexplore.exe	28
PID 2896 wrote to memory of 2724	2896	iexplore.exe	28
PID 2896 wrote to memory of 2724	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73eb62f7ea25243f65efa1961e0d5ca1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57aacadce225984a74f20baf0ccda17b

SHA1
201400bb5bd5f2a5bbbf4ce460432344cb241d98

SHA256
9f7944af394d6df42427db3c41b06f6ce6cbd16b4e22eabfca4271e538b0a537

SHA512
439f4f4ee187110221119cb0bcd5e4635b7913f27bac8ed931147c38dae45544865581640b2003c4866c82bd9d497c1a2191d6b507ed4843cefa4752cd5d7d2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9223c498c8ca4223d0d82396e266278f

SHA1
bb8329c458e38559d276ad1dd65fb56941ad7b9e

SHA256
29191a24f3d9d51bf1eae6cba80b66a55caf39abf1eb0b5a1cc09ae1cd026576

SHA512
a57daa5b00456d18d06b90a2ef661831996ab1204748d10163287ade454a417270f251f1526155073f7f47d6615fdcba0cffbd4ebce1474e3ed7686587359963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11bd6d80793028d27c833c4e20331e79

SHA1
aafc76f7d834646e4886e4f2211d44fdcc9fdd54

SHA256
721cf6995c00e327ec9908e9f96584ba8b38a9adb7651e64844e698661cc8a31

SHA512
f7c025d216924abf72bf3b881f1d3c33947a0755f2bb027b9ac5b75b02d802ce5299e3b6bc3fdf25e57a056928cba8127125c36159caa1a1248fec4bd4bd6b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c349dd707d04bf9fa151ce6c9904ba0

SHA1
16a7a23f5f9d2fc8529bacb7093002f429dd0786

SHA256
ba25a72fa5e7f7ab8fe4d26788c660a6e10d14f32aa1d8413a7a47ff83d9bbdc

SHA512
cad034cc8a510853f2e996747fbe89a2d1fe0adefea6c33e673b170b88c90fad265d76880f1c6469bfde59fb9b9fa4bb5653ab97213718e180ec1e86cce70362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00227fba96d8136ed7269d30ca62f326

SHA1
d3c4f3119f43b6ff2d1dc431b9f542c2f5e71d2c

SHA256
64b5838f95a3cdf679856956cbeb1ac7f977a6e965f8dbc88a011986899690b0

SHA512
867f057fb3b9fc2f333ca58f1d61c94edb9a9ed68c28630cd95d11359ddd4b5055b3bd566bfcc52abae9d5e594425749f709fe305d0c4b45191e0a789318d2fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c784150cbfa5f6efc88e0be3125a939

SHA1
b6b8a9704271e885714533b0a5c6d21d5201807c

SHA256
84d30fe10dbeb6999ab11644a40b0dae685f54602a922785b7c20bf1165752ed

SHA512
641d5619b244f202dc859c744d22daf6c316f309011219f48bf550fbc31148309d1e291857e1bf48eb453e2b99df523a85a0d2bd2387092a69dabd2b06231794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6e0c8d9af57295eba9c34642f93735d

SHA1
3a70fed553c6c5d709400dcc65b6c8babb5062e9

SHA256
c62138e5ec3abf02069b9fc44bfed92bdcb94190ec118f8f1d60659b5af5fa88

SHA512
57f960fac0b8cb860b4961ec2007702a011ef4ee1009da6691e1dc97afdaef56a4c5f83ad71098e24c2c323b57feef22fec7d399128296e3dde17f09ef21e9d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69ffda1c78e988c16a32e796b4646b0a

SHA1
0feef9d3c3b610a2e211168ef233a5a1d8dcea88

SHA256
06e2b3f1c3a90c25b00e03835594b2b7c58362fccdccdc90cc1023310bf8af4a

SHA512
79fa46a1d0a05997fcc515bf0e9782f85bc7b46dd8adb2f9c030cdba0914ae55100ad7da93ade77df921cfbf14045f859000d307aae3564fe5caced6c050aa23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e9dac0768a71f4154675f616345596

SHA1
e591547fa0d366eea9a9ddf59b18d29872647aef

SHA256
322755f008b4967a2326c1ebb1b4b6ba85bd10307d9eafc1af97868f840ec200

SHA512
c577290b1138a76917bc4e28345edb3d0f6d51867371fd939def49206971d0b4626813a59128b63c596b0d79b8435050b1a1e9866a573cbc4fcffd9d0bd7f8c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41a322c7759ab421e1a377a7e0faa78b

SHA1
c18938555e901f434f1fadd748f117755e2bf75d

SHA256
56dfa36367a8ff7335ea40f7964df668fc2fd1117059e69d935b364657ed87b0

SHA512
3c2273f37f1e4987fbac18979ed611e344b9df98bd9248697d8e4adb925076018635e2a0c97757bd7692930d4602b7bca736d2f17d1bea3c102342bea78a7e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
497ebcb0f6e970bf46bca0cf3ac78158

SHA1
5033bd92a0333c67110a76ecb76b951e9e94fc38

SHA256
d05168e7639182ddf371dd1424f369d850db5ecd64dda588f64bce70d9b11ee7

SHA512
5307574591149da6551be8ee1c9fb63fcd5895752a88f7f38d165408d2482aaed9524a777def607e858caf59f7ee6a931b71cbe14d4565b786c7245477cbf504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdfd2a88cd11126cfc3d25c34fddc9a0

SHA1
6e291e8d50ac14cd3c3dfb5437b3415d18c957d8

SHA256
f381d82189fd467fb41d4f46bbf47e0fa40d7c01d69d7f7e39a2e77cd036ee9f

SHA512
112650c36f215fbe5f8333b19921b312964a89fd0239e0ebf9ffd6454071dcdc91e2e32300f40995b058a05b21e0c35d6d51029e9aef49fff7bac9eeb859db46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b220478f32ddd8e776413ca4c8efc7c

SHA1
33af3e018eff3afe6169b5796c0010369791a98a

SHA256
a1316189f017e57596540cf852b77ce4870e254f7f6d85346903dc3fa2357518

SHA512
1f6a2a3ede228fe16718ca673b4a60eae931024e7c7f80387081dcbc10a7a20ed52040d0e882e2787ef5f86e4f53f5b1ad8c9edfb658129a140ab7d3387fa46b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21c917d48c0e32243335d42560033281

SHA1
a6a66e9a86038effb985ce02118eab6c6d0d5061

SHA256
5461a0b5a9cdb635200c5fc2791b85531d839b79367a1db1d05c6860e9bcc788

SHA512
5437f2e1a2e60a45afb235b2a9b315798bfa9bc3d22ab9d8fd72e4e6742c6e47ff7eb092da3ae2bccc184c9ab186cdeafc5c9641e2fbc05e854fd64211ec91aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e94579b7a694efb7c7b2be16d4244ad8

SHA1
9343ce65adb71cd041a99b46245a5d545b39f0dd

SHA256
6ed58519de7b4635d41ce9174d986ced219b13d2418e49440f58bebb4a1a9a3c

SHA512
e8e5d2a1c3fe0fc3718a7c13aff32c915df166b1fddcd3a5b80d43f2d736a90bcf80c99b4d2ee0e5e4138e21c45907cd97029ae319e5a357376390812a714b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1302ce8172839cfe8b017a4e45968afb

SHA1
e42a1aac5f3487b4c558f0f0a7307ea24da91a90

SHA256
7d05d72db812f9e84db7926ca699651651a7581f570fcbbfdf9002371978b892

SHA512
4ace38e3b0bd848b6b06db92a97091dd3182903e37942cb6c41fdbe34db1b137c093ce505192c1aa11c328e1f2582f2e614ab0cb2637586d9a21e20eb8f2e332

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89CB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A6B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit