e9f2afa958d71eba66b213a422232d2d1ff5e19c56bcc1998b2ee15ecc46b5ea

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7628d27c7c7ab0100cdc50c62aff7461.html
Size

52KB
MD5

7628d27c7c7ab0100cdc50c62aff7461
SHA1

bda5cfe862f42ded2116e7e00c6a02cda98be86d
SHA256

e9f2afa958d71eba66b213a422232d2d1ff5e19c56bcc1998b2ee15ecc46b5ea
SHA512

342f309ccaa99693a8cd694b72b9a4c6eefbd892d08ea9f95e80e3f52acca65d5e3ffb951f6a4d981d862feafd71ced416534407997e1ca85f6be7af7bf7594e
SSDEEP

768:SGdo9VM3QH5JOXQEmtU4z23Jkt+ugGHkdJGifnGrninmnlNE6BZ:SGdo9VMgH5sOt+ucTnGriQNEk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBCE1F61-ACB7-11EE-9A90-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410723466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009b6f93fc45489cd3e066ed371db21e64d1c158ad5f4846cb61aecafc5ab36773000000000e8000000002000020000000f8802be2a11d81baeec85fa02defa63aa72283c9d7785661fc070d8b1cf0893e900000000e357daf98bb0bfcb58e50416d878a7665b7a60ec8d59cf75ded732ab6003bb67b3a65dfcff233b279c8f45915655f670c70ffc43dceba7066fbbb96dd45404928b5a9d1c01f0ac9d91ffe8e8ef8af01a1fba4118521bab81905e00fe1451fbe5e4e96c9fb46666d0197c73553bf0c48ba6ba237f621a01ca2cc4815108b32bd6ec3f80d13f56cf0af0f8f50070f19a6400000008a513a62e1730947cfc2c877ca6a5e768681b9e4fb481650b4763f11f19455c12e439093d8877e05ac2a2eb54b32d5e850722eb18c3ec8a72113ed392e5a68fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e04f10cfcc67538540fd643cdb4d1f2e0c3d66bfc95eb3761df1ea94c5f38183000000000e8000000002000020000000ae4544f0085e66fe7f9fa78f978d3690c242ef643e859c5d34a9db2279951893200000003fc58e59fdeabac0693f71a09e894fa753820cacd16176bc99793ed3cdac28be40000000d7a429dfc109a689c1926182936e45900383d1381c2e8187cf6f43eb61679df99f146e24c7f13694b16b3f8063ed9d4826cd6374eab0b1b773a765c7831c77ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b9a7bbc440da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1520	iexplore.exe
1520	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1800	1520	iexplore.exe	28
PID 1520 wrote to memory of 1800	1520	iexplore.exe	28
PID 1520 wrote to memory of 1800	1520	iexplore.exe	28
PID 1520 wrote to memory of 1800	1520	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7628d27c7c7ab0100cdc50c62aff7461.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bffb23514afe80ffb8ee31e744a8bc8f

SHA1
97c8eb3805bfdd91d4386d1407b2de366a770a38

SHA256
282cc0b7d27ab8cb1c0047ab50759d7319b222ae8ebbc586aa9d57fb00b1bade

SHA512
52e9786fbdd375027cc605aaad07503228f048e637582cebe630af52843d10c33e4dd4ddcb13c37730cd738e554d23fd40bc6cac89a09fb13cf9853a8259e42d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
681b9f0ad8453e8b11291362cc7bbd26

SHA1
383db30c0dfb649327cc978823953aa4f61a9ffe

SHA256
6d2b0b97396ac87fee2da0843f39c0008c4ab6badb80b55e639292c0d6d906ea

SHA512
a9bb92c0fab3b6246be7eb1dcd6cb5bb4275b34d26a9a93ab985d4dc3f24ae254c67567597eb54a399b54d820669baba96b75d50bf6419e859b77b8ee35d41da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dac5f0a53a184b615d581e911e9bbcc2

SHA1
ecba2530dff166dd0a059df6c917cbd8c7f54223

SHA256
0a665d8ac9b8e5d3bc03e99988b539652ef336ce6371c0d2d1e4085cc0733dcb

SHA512
1d8795620c8c3b92192735bcec470b3e6d9eb6808990c44818191c857f47fdab3848018556fef838f8ab5961dfd15820ecae5d5f0013caf157e647e2ede13e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a639c47074f7150b955f79802fecb64

SHA1
7dbe65c70213e3e62be4cc2d8657553ee3980149

SHA256
bd4f173b4d6a60738cfe75c106a4bd62ef1688f86852da47b25acd307c14933f

SHA512
fa1788f20e40c436a5b0593587adbe5c3205317249d2b9492e412c1142bce89e6311231a11bc65570e0f25bf41b6b527a6c31ff5e0ad3d39bb2ce56b6cbbb59c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41a9d354a56a5726047d3804cb4cadc2

SHA1
39ae93bb412033a5d537a6af3e77dad52d150c5a

SHA256
232e1368cce41b5011c678e3994b864e89280062c43946902a2ddeb395587116

SHA512
7331d2f7115de9dfe0fb920df5a79a8bec77d5c7a2439a1f3f57ae76c0c0a68a3d4d3afc10d513050ec19419ee67542ea213a95f7984cf89286439dea1200315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50901ae28c81c31d4879aa0bcdc672a3

SHA1
dda9980f71988cd47938d3d67639cfc29bf45cba

SHA256
feee7248c48d1d52ffa54d5ce85c6319fc4c66d5d5d38b2a3b7e66c394570c65

SHA512
d9a4b142294f74db76e894e2d016b7e397256687b0a5585dc5b001a4ccd7ddbf7b84ffc64a4c122f44fa7e2e18bb1e7dfd61036f37181484e3d57cbd3502e29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87ec8df4afc00b8417544ed73afef013

SHA1
11279dfbd6bcf223f0ad3e2336144fbb8fe0f75a

SHA256
7834a15e0983c583b8f2010d79f6f5c4a603450fb926ace4d910cb51108f6737

SHA512
f2ef07c0554c9f28274b316bff53070cb9581a912e40a4daf0a68cf72b08e745ee4a463d8987f5b24404e618201cecfcae7e444dc90163394dc16faacc077d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2d7de26d3885d358750093ffdcb3e8e

SHA1
a4fc2bc1e8b28c4588e0bb208895267fa6c3400b

SHA256
541ac31d8f76f1db63caf6f7dc0a7973ad2432cd6b5841c01947b8fb180d6674

SHA512
fa939b89a8d20f318c587a9fe8872c5fb49dc9b557cef5aaf66bc83f68fb3fba6c029cba4fda794ba8d64385a6e8b872f7eedd67e8bfab48de6fbd1c9f800c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81e69beef432860239972239008e850b

SHA1
69e0ae42e2a2983e8ba0cc52d4d4f0d11fcbb321

SHA256
38bd850b75135dabceca241b6b7ed630c27a3679cdac10ea3d5f68ca0d32c2af

SHA512
28e92862310eece0225dfa881c534c1663f8eaf59b4b1e9b64a18f9858b6b551509829b1010114f6c0ebf8a4f519b43bf16c8b7916f59b7f5628d5ee7b2ddd06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddbc0ce831ee75121c9aae301be67762

SHA1
ab36bb5a08d50723ec65c0e4e56a2b47f57b126c

SHA256
1a2470a41f7472fc1c6658602c75d82ba528c5b15b4d64c3e727ede293cd991e

SHA512
d3fdbdc6665a6e2fc4a2463f48a46e746bf4fc40f34a12083b970c8334d2a5f8924f2532b9b8f85051cd001a48ec646474ffe48d42fbce49be30648b12a68bb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4a3bfd7adb1eaf79a52e830b9abfa9

SHA1
6a06632a8e70c6e439f242b1fd51b6260ef04924

SHA256
0e15d1c3edc54918a7c2420dd7b1b75717945e2129c4bf5c5912e09cab779c07

SHA512
600442b707786c58b664e1428854316368d172c9bb5a50022f53de8584d52d0402a7b4ed4731924e0b56769d79cf356afd39a7776f9ae4c5145c58e0cbfe3d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3120.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3133.tmp

Filesize
142KB

MD5
eccae74287c76d4265a8a3d04d53b3e3

SHA1
81da01fedd643b7c5af41fcf6dec1deb10ec6532

SHA256
39b783e37d6742f2dbf6851df2765f224524230fc021e12f600090c0435bbcc8

SHA512
e7902a2adc0e5309e9b1611e92cbcec2b21a67c677395d82dfe8f8d6e25eae22cb65d519c217b5a8bde695c74a1cab539055501e015c35f151e1cc8f08222b34

Download Submit