529c310a3ebc8b37d6a3d32929560b181e40a469c2d15281129b632839dc67af

Analysis

max time kernel
142s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

787acc503e9e737edbc79c26e89db18b.html
Size

432B
MD5

787acc503e9e737edbc79c26e89db18b
SHA1

fc103d9f987467b10a7216994219be345e5bca93
SHA256

529c310a3ebc8b37d6a3d32929560b181e40a469c2d15281129b632839dc67af
SHA512

9dca4b2aaf33d0af6707b01d7be2bf96a2bed0d7d7e45f4b5a172c431b77ff9e978430e91a6fd3679dbae2005f8b217e6b0b3fc852472fe1a01686dff3802422

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c137753816ad22f66be8d2beb6e59472505735683d7c3a687975dba9ecce8022000000000e800000000200002000000058a1bcbb6fab9d2952fa6e0418866faa79cab6d37c06c1a9eaed462ea00f730420000000495a7073012e4084a09a00fc830c48c7671ee684c724ab2d02c757ad28071c23400000007df1ae014f7b3c65ff693c0fc5332f07126c214a7034db96c6924651a7db7b89bd6bcc19be27446c42118333f4d9bd547d3726dc96133a97224cf4ec4dd56fb4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d0a3b52f264b6e44f365e93f7139439975388bb49cdd6b1919c1f7c561332c95000000000e8000000002000020000000d2a08bb7807f7727b7ab5a23281a63dcf79edffbcef779d2beae8a503cb174ab9000000083ad1e2fdd405ff6b00d221d8337fa5938f3c4f59f2b97084d1cfbf9de97995070f85650901762cbaba0ef9e664b8959ac517fc18ec7b96187c386baedfe01dfca5e6230acec648f40dcc86300a3e689e37e6dbdb24ea189fc6fdad543e47e8248f1940c7051c3e998bbe60658d5e493c338f843f82cc6bc1224359262911674f8ae1512a13f03d219258a08ca1ff08d40000000a634467d29ec566264ac19a0b9e96816d26fbe5ed9c583fefb065340639b1689d1981e36591069a9fcd487de955392a1164dcc60f48cb2d2aa057fd1512cd4dc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410727230"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1019795acd40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9093BE61-ACC0-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2128	2976	iexplore.exe	28
PID 2976 wrote to memory of 2128	2976	iexplore.exe	28
PID 2976 wrote to memory of 2128	2976	iexplore.exe	28
PID 2976 wrote to memory of 2128	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\787acc503e9e737edbc79c26e89db18b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d0f0a4b92e50dd301c90ba765f0ba42

SHA1
3509230cb9069f54b1064dc2b2d35480a95fe1cd

SHA256
0e378997c454de60d37686c27189782b2b1cb0b69ddba95570ae6a9be421cd01

SHA512
9377760873024e9f4425a2205055a43dc7a750c124a6b131632b718991deebc0017ff376a6acb52cd3a89fe889ef9e3317b6e67d9332d1f94652d6b71616f157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4af2bd5c38a177d5a9bad65f1399b75

SHA1
3947262ff0445a5acc994bf7e4e72dd6b86245cb

SHA256
324d2c8c668ce34240e6d2d58337f2d08eb61a203a878a66a60560c42b99dda7

SHA512
e727fa07ad9854f7935f04b5fdf0819c9486c40a5ee202ae3e01a12163ae85ce5372d7306383d40dedfc1cf27cc0be772f2334fbc3d4a97276dc6de81008d967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45b1a111f985edc7c69b5e1166443246

SHA1
282096eae88352b321f6d717f02c6c967207b02b

SHA256
9e5bc132b345d1ac6e1105f69c1d33c4608da6ce612890e7fcd1ebca29d3c29a

SHA512
9c92adad5e9fa4b4d152f493465ff96698ca0c17a41c91623fb5ecea92e10d2edde716a92f66e2343bba662b47e2e22bfb47f3afd4a3e56db64e453698e95a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a612bd26eeb98aa357706351c3486d27

SHA1
9fe5fa514a8bb0629c869bae49ffb15e8f946ccd

SHA256
94446d3b3b4f191d04f72fc4743ee3debb5614f5545831df4388c40d6165b26f

SHA512
5619f55f8fd4db8b437a5c62e7f312b146b68ece60900b5860f833509e7d15e7447b8e760e335d217d038e8d6a9b27381644167d29a78d095445768bcc502493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f38065cd7e2a91febea304f8fc551766

SHA1
927ce0c24181936b4ae1866f2a3bd9f60b382fb2

SHA256
6e60888a61e5782cd9f349e042a5746cd9f7750677f704832a901e80345acb03

SHA512
8a37d4cf2a07096cb90bea1da0603b0a72d4516089553a3baa866925a5a1ca0a9cc0d6a3985f5c77ed4f5b0e3d61928218efb778f60c554d76d69d9343a2ae27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8212b53eb0deb9f70c6a8c5a2bf731ac

SHA1
c70db4fbf2dc8959d3131c8b152115c1bc49f4b4

SHA256
d84628fde4c52387d24689cf8a6e0c4d830c73b5a1c3c91c7135d93619c455a7

SHA512
d43d812fcceca810777e5a43366b133b432b790c496b8b72721a78c6e503fd07d163bf8dabcdf78e889fc37cb0612e68721c06bc17fd2a6ffba7a4b915850e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcd17f2c5c23934098877f2ca6b1dbe7

SHA1
7fb8d278a4d4b2305c24099e847c7d3af84a8e20

SHA256
b721e31eea8936a905fb2f1a3c65b71f133c6587a80a207d0059553bdd1c1b38

SHA512
b4fc026ad5aeaea54d205e5fed618f75017e1ecef880acbe6073ffd0eaaa6e7732ad4d05eaaa8235c85a7c650fe41940a405fd01630973409c812365f899929b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5988e6c8e0c08a98075d66a80770c730

SHA1
04220a48078631abaa49007c37f1f103db7e84a9

SHA256
87d671394f962659d6ffe44652ab042e577892ab3f51cafe959e3ce85ede69ef

SHA512
fc88de68edd202c778ecd06083e940c3ef400620896c830671f22522c0a4a80656e0790548304a23f8a9cbb1256728010c015d83a6d6064d824abd424c4d0c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc636f568f9a5d4484fa9723efc8fa60

SHA1
e9c9ed94d7d2dad6c4ee983a925eca1b12067b1d

SHA256
d54b2bb25f2a454bb6d02f62ac6570f96150047106fb8ed1d081d4434f654b4e

SHA512
5e9564919054a863af5ab2f0571d2ab273bb00c6cbbc18138d4d10c1e320470007575126e869815fdfbc9cac4c5a81224f2ababeaf31687df32e86c59b319eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a32cd63c97e80358659cd266ff3e61b

SHA1
c4120125ab92ab319d2a7b279a68323b9f7caf4d

SHA256
93c559cd4d5115bc2297accad72005b6a9695d50fd47117e520f1a5951f240ba

SHA512
f73377167f741e52c752af63d3dd9b9d08771ecc62106e541d86b60ddd5f8b2a1b9a7fdca90df1935423f5be8403df900ceb41da8c347509b7388c4f89df089b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb390a084fb3823a87ecc04f2d596482

SHA1
d5843db8099df6454261e7e306b2dfed6ea73fed

SHA256
b9327a03729051d25a6af676ada374b1553804f0355d2b1b792fe5844c19d2b5

SHA512
ae5b21683b3d495a04475947990efd1fbb778e1197b66f257df4a98c5e9dbcfe02e5ed23809ace87398aa27a11e9d0a51cdf92047cbe67d743e419d00f753912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4c01f06333afcdff44cc878a8772de6

SHA1
9f07108e119fbd2c236ac3d874ee331d12dead90

SHA256
d8a1c2709d4816d9da3a346e304f7473363aa2fcc80c84ba993fb2998790bb86

SHA512
8e85bd85bdd5b867fd2e221cf3461e81f7ba03107a52833b11537463f01a850829e768ce62c2546d8b1837ef029fc0be34ca8f1aee9801d2a85fa76507ef5d0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ee46ea70b1b778e7cc3ccd43a73f83

SHA1
ea671f109cf7565ba8ed4be569025d754e7e18b8

SHA256
88722fb88f8ef656c913244ea1b9d2ba539d479599cb3d0ec27b7a6c28162cf6

SHA512
71d6b8d64cf20090fa6f1c508b42e421b3d8bfafc740d2e5c47e7d96efe2563c9a20e2c1fdafd8edc84a395fc64d2d79226509e2035cd2111144ce7f1ef90a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2b0ed7e05619ab96ef7d481cd7b605

SHA1
f08ab16ce807da97cf4279055181a034b23e79f3

SHA256
56924fb7f2b837b1875865a4de4687afee0fa0b4563c25104a71fa610936db28

SHA512
da6ac26f9a5d65ed54a60ebea2a1b1bded44411214584cb15fb2574f4f2508e4281b66e0dc3adb301e4fc6ab6c478e35e67702ca0657eea2fa23ea33f959f702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e50329083a28a2004e7875e107f2898

SHA1
e2585d67d8a30b7402084c7b8857a9b2ea07fb39

SHA256
bb4c1d3297010832f86b7e87320be2443c1378bb4aea8d080f879c0b363bfe1c

SHA512
eb028329fc50b04de9a8e77499567f800ce53bf7e8b08429fb926da54dd3c05a5ed04c609bb504c75beb15eae133464853fe788674067ae3fb9327b6cd82d134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

Filesize
1KB

MD5
8a8b4741dcb46f45504c3f43515db71d

SHA1
dfe080cebbe2095115f9a9c7a9fb317f715a3d8c

SHA256
9cc28e02ac5ef65d7a3e987a4f515eb038abccfe7c2909e0cf0f8f0925835604

SHA512
e751bc5d2bea37f0133ab5ad53e10e1e4440c48f3d9d86c696436f870b6dde209190c131fc87bf25e2d26ed38fd9df49f1f7dec2908f434d419ed875daf96c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab629C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6398.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit