8ac88ccd411a2db4afc39599f548c470f4418b7a8735c63a2f273ec3f5da86ee

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

79717fb9137375b8e3839d3d7d785901.html
Size

955B
MD5

79717fb9137375b8e3839d3d7d785901
SHA1

4abfff9173e9b44869663e2eecc12f996be52c88
SHA256

8ac88ccd411a2db4afc39599f548c470f4418b7a8735c63a2f273ec3f5da86ee
SHA512

609ec51357718fd40884234c28d9ea68ed0543bdbc3bd4bf579b3e7e2aa73730889634c63e47e2486a4bcc279f6648e372a0b06a79c9b32076d665d61fec4eaf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1C45A31-ACC3-11EE-8C96-56B3956C75C7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0dc33b9d040da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410728670"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000030b40bae073ebf378d5b29fb594e47129d3fee681f03799f8a62363e5091995000000000e8000000002000020000000e84b8d44d7b63bcb94f011c9870807c60aaedd9d65169f9d5862be89f73f04e090000000a891ec2f9679832637ffd0a3fb09bf10142b72a12f85dff3933f7c071bfc13e0ae72f4689ff38327c222fea914e121fd44bdc419d87378da2cb81ceafa43fec1fc1e81499d36136cd027b8eca25b45c7b668ddecdd4dea4c18dd34ef547b150452aba55703e2db174c765351612f4430c8bdf9a8be518d8dad962ee1ebe4fef517ad3b165226ff28ba7f06a54cb78eac40000000fc6a0fc5b9b8eca0f4a001619e934e22b9400b2b6449a18164378f139f814b11520d69df4262f7e23bbd2a21cf6889343c225771416fc4f28eb4cc3dd63802da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003add5dedade9ad0b476701843c6957b6c51328369a31be73fb5caae8dbc68fbc000000000e8000000002000020000000c14400bc9fa3c433e0150640ec11ed09b2764c0b9b91ab5180499bdfaf9b52db200000000924cc7c9561240260074c770275054845f21bf3016783bb8a8f4119bcb67aa34000000065d9a671eb908d3fc703e1b280f41d75278fe735f7a46019e7068d7f0f70af256df973e8d7651ffb5c892cf12cb5e655bfff77947a347a47469df0fc53e42aa6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2724	2332	iexplore.exe	28
PID 2332 wrote to memory of 2724	2332	iexplore.exe	28
PID 2332 wrote to memory of 2724	2332	iexplore.exe	28
PID 2332 wrote to memory of 2724	2332	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79717fb9137375b8e3839d3d7d785901.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd865aa5d80080d4254788f4da929d39

SHA1
4ae318c426b55379b4ab6287584f635cf15cfc2f

SHA256
49b96937b39eff0a160b3a4f133bc9e7086b289bc552cd810ecc4ad618007f68

SHA512
d6575fd079efa2acb63a123a8526724b7100348d33542b3ed7621b23e2fc38e11b43d439e1d10df04fccc1eac38f7d4a32800033179f121d8f68e6f9b14a3887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a7872f88470f514d31e56bcc6af6748

SHA1
800fc7eeaf1191413093af4d21da6e410ba989b7

SHA256
6eacecda2fd0d7e8c81c07d424bf7b373f3bc8ff44f76fed26ab94ff8c962052

SHA512
3c3231823d93a86cf54394d8779e2c139d4f2887b0b268810db89be064a05c01cdc0b41eae771acaa5d460fc904701b83629b0c561b7e10afe27586d0af8388e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b185aba627d58fc7688d9f96ccf2da50

SHA1
da0ddb003d932a8c341f0bafb45eabaa87de07a9

SHA256
0e58c649a1fb5a9cfb02987aa37478da7a81b866fdafe0b2b76bcc515fe11425

SHA512
cc99c5c1f7f93aca2fddeb7db7e3d226778289773adaca9d5693b43d089b2c25423470d842772f560176b9ea2bf2a899bd846cd832964cc09f4ee4ded60a88be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
effedb6a4e5a05aea5a651f18459a355

SHA1
ec1d485053986469a8f8d140731c1e54944f2aed

SHA256
165bf59f8f3b78289681d900a0ac4d211f0f3615cd9d25d0efb8bbb767e45395

SHA512
9858730713ec58b00a2e289cf27743fdb26146b056989037db1b3327d5ed01a6939d1c133049f138d8266d9c8ea669f3fa92554049b96b8d942b589f5247030a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcbeb21a280e48b6f10ff1030511bb1f

SHA1
16b97ff7cf9301568667046342a9d9d19eb067b1

SHA256
69c62ab265d2fc15375ad22281d11dc93e16a26805acd00cacf9b64e0b5e8233

SHA512
0a8b052c375cbf10ea0b532848942c8fba9ade7f0e9d1b3cfc8dea44e9fd752e8e2a97d06ddc9cec68a97811217a6789896bb6ab7b73ee6b3640dbb589d836fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
481ca20693d1e22a503ec1c3f52d06e6

SHA1
d62e8cb56bd851ce769e6cbd61a19930728ef2d0

SHA256
93605b65a60978a690381f2ca85cb2cfba17361a41016f3662e19466ee7e184a

SHA512
f4d9e977564261b68c96dcb0942c2b847d41ea0fc295b8ba24dbe25ab7a2baf795b08827cc76f57cfbcef5e69af73e7bf3bc04a0dee5307e554938218f9fa1cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51347c2c74081828ec1e64b0a3dfda34

SHA1
ffd0aafe01780dd51597f6f0b4277d7391cc74e0

SHA256
9beddc24d68bc81feac730d3945376ea236379aa490b4d5d3e600aeb766e4d9c

SHA512
97418fd9809761cb442f0e2d6130e9123f2446a83b3f71cbcd6f1d21f994329e7a8e8bab4bed99b67e3283232e44371c57c79c7149810c018e27ffe15124bc41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14e058f542296c95284dcbac2144788a

SHA1
620364e00b532387e598df1b8bc247833e2db2d0

SHA256
8a0c4a5a8656a81f8bfa3a76e9b311127ed71970a15d2ac98f14f90d3fb92752

SHA512
64f927def3eeffd80ca779c931e76f871eb156573c2bd1d5cd7ae6203585a54565adf93bb13e1c7135aa65c85fac32624a31fa986c0e89e86fb2bb3c05ddc19e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd1271efe0bd782207467cae3a3f91a5

SHA1
607366f4c75c48418e0f1f80576e3ad6927e4755

SHA256
1d142db0becabbec79f44f1ceecabd9b56e412464c23f3d3e0c20a7ee6338e4b

SHA512
ec7df21ea5561bca2c0f5631b258a9ddc31ccbe3ed41d0769143b520ebe66e3dc5aeedcfcb5116e4b31eef550cb4bf3b932cbfec2b71196b2d5e1138a748e242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
430922f9b47aacdf4a30a486383568c0

SHA1
3b2aad45bd1528d62647d38072954fc494f8687e

SHA256
94758e39cfb3f222043fe80b13e978df3307fe3669bce2eef888d987d65fc45c

SHA512
b68e4176536a622ea2d12cf66c93bf5cfce160e69d0470981bbcaf3d6e5ea7c1b8fd3aad9145fb7dfd5e006911f926ecfbc13236ed35e55d5dc5f06a07ec4bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10aa5d52800a1714652c3e1e320c95ea

SHA1
24dda005c4773e9aa15bc2de25886472e5125918

SHA256
6a152598a636d1961c42d7f54b4b6160daeaba8f2199487a2671665424c30c91

SHA512
46c4ef9f7ecc6c975ebf07f77ed0f9cb56e1e5982420b7c5f98f50e9564cde66514ba5a286ff4a53ce3ff07062518704e229593a3571392aecd3e482085b49e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e7d692197b08017f41419ff4109708f

SHA1
2891799d38a2e946ef3ed6cbff7c2cbbc64f1c46

SHA256
2baa3e1b8be5deb38838bc76783df07d98bdef00bca11be4c7d24450b0c8b411

SHA512
9d9c39de328a65936c81ed33486afda8ee7d554e0590703e5fed2543191d513ee8574ab049d681b81d48097902e965cadee2a57b4906b4b7f4bb8b23eac969d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da178eb7ccd6b63daa39ac3d029743fa

SHA1
f8283390b070e06cbf599fc0588cdf77ac03a841

SHA256
7d695af5a71313f6263f79cd53de29e21acae76276e034cc35c3847e625e0b20

SHA512
4baafac528ec80d318731a90d8346cb42e1467d976cb00581964675362cccb623c6bbc68c0413e763b8b614f8546fd482fef49166f2cd87254cbfb5097e2aa8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd79151e34a94d23f79fc9d717d86de5

SHA1
713267e6c486db47fb3a47022a2244856bfdb0e1

SHA256
386d5af0a3e86ed0596791b1c8dc8d884dcc269ab6fedd4fec28df10fcf78034

SHA512
34a1eb68c98057b4114265effacf5a851384b0f28f72a7081b648e3d22742a9a4fe073b5fcf56df83c382927b168b094f477a5dca00b41a3b92bc79e0353079c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7a8cb0acc6a564705906f9a9438c2f8

SHA1
c5bf0ad43e381567f14cf9730dfc68328389cc86

SHA256
2ad3fc7ebb9091ce51d45d2dba22f663280229f503edf9daa56513c5f32d428b

SHA512
070a0c15f40ecad523b78ad00a109958042fa6e706cb8352ed4c1a21f76c0dfcd6f57d3507d9a9ab19671dbc527924517b048925f01ebc75dccc990e95c919b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B0A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C09.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit