f76964dd8a0b3c2e5a3f1b35f36503fae2e6e4436df282d6787a699e661affd3

Analysis

max time kernel
178s
max time network
194s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d08f7cb31e6b7eb5262e77d11a3736e.html
Size

1KB
MD5

7d08f7cb31e6b7eb5262e77d11a3736e
SHA1

bbb5a5948a44dcb558f94e3dbd6418f61ace649a
SHA256

f76964dd8a0b3c2e5a3f1b35f36503fae2e6e4436df282d6787a699e661affd3
SHA512

dc69aa58c25ee351180c918dcf36534dc7ace2003c6675286eeb880329534b09d9a136d223da3b20838edd0cdffaba784887cbd5d514d7f00e64c6db6b4da3b3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409902749"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000db5e22a32e1d90c0715f75dde87284c0ee7e535776ad71e84a6a5b11bee36f61000000000e8000000002000020000000ef44c9e32a765f1d110d6aa176e1fb8c538789206abcceb449fd5768d7c9ca0d200000002daebd4f16d7a0992702569c17ef4c7fa7a08483ee4e1d21148fb431c7d5d18340000000cbff8f969326ee564441d2d2d4887be9ad472f1dfaf64cbeae78068f82cbffee043c6db09bba3e5863e0de6b88064f439e95fbf54ae5664b156b66b28d50bbb3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0644fd04d39da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA4E73A0-A540-11EE-97A9-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f0f35eae4e1148f4b0008a10341328ef68a229c4788a9fa0e71b48577ffcf988000000000e8000000002000020000000a16f9bd61c48bede753ca5928d2ece1c0807b4d64bbb662d6e3245d4862b112c90000000811279d7b3d6966d42ad57cfc4d24cde781b1fce0601df20906c611cd4506954563a695f25da10049f2afc676201e89c5ef1787ee0ec71762ca39f6052d9bf4094b9b931c31448f2a3652e10570469b18f8b68dbd969abb55301d5816c8bc800e4c91a9ad73a32093882c5ca7988424efe115403731064aea66d6f8474012b9197d50f34ef175e2039c8284051ca5f1b4000000029a347bac07493e0fc10779044dfb09fe288874f142c639da2aa8348d6552fff4cabb68687a127ee103e7ad37e35b3c75753a5abed61ab6352b60f9d3f0fb2d6	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2596	iexplore.exe
2596	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2796	2596	iexplore.exe	30
PID 2596 wrote to memory of 2796	2596	iexplore.exe	30
PID 2596 wrote to memory of 2796	2596	iexplore.exe	30
PID 2596 wrote to memory of 2796	2596	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d08f7cb31e6b7eb5262e77d11a3736e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85646638c319cf08f0c503d404f218ca

SHA1
f34b405e47b95e4fb304024d4ac3a110d1a3c9f1

SHA256
49c42faff794d43d8ccfc7ddff85ebc0dc4a4b02d7938a9710bb99889b173a56

SHA512
7431aa2612a72525de592f2250dc874538ac4618aefd29234fdc5d313273d25de25fe8414868ea8d091a4ee1066f7b2ae01d2d772c380578aaed1b0c9ad6bf88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20a3e3380dd142f0da4c089f10ad6178

SHA1
d740031de9c50a75ef8b798d82b07bcc0bb0319c

SHA256
8727296088551ceed206bb26aba4471bdd59af80ad8f50a3b3761be685e5bfc2

SHA512
7a3272797f0a75743e113231d4d9088e1335a4e5b0162cae11ebfc2d2632582d5d9177844d88ba2ff2c1423d4b49cb0b2f57f29108bc858046a75baa0dbd7a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02855f81d2577ebca94b838f97b254bb

SHA1
1feac22d07b5441f9a5cce682a3fb3cdc73a1672

SHA256
de7529823d659535a3a634b2a8dbce8b2967eb6a07c93fd9a8c83d0eccaaab8f

SHA512
efe3ffcdf940542dd3dbf943bb7c65223798a9af1c1116b4f7e72dafc2ea2e054c0076742794413a09a60420d31b2e2291bd1714f56327ff7ee346cc04681fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41f51dc13ab336cb8f76d4fca23e4364

SHA1
6ddc475f1b8d233af81cb5d21ff1ae4c65982450

SHA256
d970033b552093cc2242e713b6d02373ffda66ed7ac8590906d612bb6f61c028

SHA512
4ae5bfd6be55afa40ea228fde32701d2847d77d22feb70489af034ebdc58e92fd8a39701dc6c427063d9a6e5883f166f76696de70ab9c1e5ddddfaa31cbcf18c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab953744b43a47c9551b6ddae5b1b09b

SHA1
c948b91657d37b03b6c261fa28d0635b28bc378e

SHA256
d06da9cb97b36626db30cb53a53a12efb7ff69a04906891fd91167abb55a0ce0

SHA512
077e70fde3c9ef3a1656f042c58b4b79691b8d09e11d54b26f62d13e7b4a2f068e9743086f89a3a0ce28c4137847b630f9e0f2da67fd86be4a85eb28a202729f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe5505590544aaf5795f66c80367051

SHA1
2eb9baf901167c806c68dca0fc13cafd93c2b30b

SHA256
dc819133b17c31e7566b6e5c20914a2ae321fdc7d1c9a723cef64a78006b7b27

SHA512
78470bbdc6a9ad3227e0062e22226e24eb8710797525dbba6044ae9d366317690336a821b1c75462c9495e075566663dcd99ca8632abefa970fb02c029d86202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08cb3f32b8be4d63fd3646ea66011526

SHA1
0ecc732cb628ca4f4143ec1d9fe66552673c238d

SHA256
d5a5c010aa96f1591fd929adf109a58220302ef9f55b31d0a4e4938e12707d9c

SHA512
2c2e270b4f2b1288ed5e899b9c99c54cd81dcea19ce0c203f44afea5d850a679a8e9131e42721398d312bf79d7a18d2c324bf5bbd03ab8c24dbc6fc114095cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f286487e919deff07cc16052d015a03e

SHA1
379bdb47036ce79999f56e3d022c8054267c8fb6

SHA256
aace0b93e0ca248c3b5b426c72fbc62811dd2113e0f794797710891e439f0a5c

SHA512
bd8335ce53fc78c265869d3a26db550f9c09d956f84760e672c14c24022c9e4037b038002c4e7ca9fb51f2856ef28953920327afbde8cd455f7defc498374042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e48f8dab0e0f98d978c36d9f3999a9d9

SHA1
8e6f9b69f2f7321b1410eebd0d16cccf4ee962e2

SHA256
9d7097a7052e96024659d8e3427141d2a3e67fe4a76bf833b3e9d88933fb1918

SHA512
c9ee56a2244bb3e6dbd09f8237d61ed7fbf2de5dba4e83cf38dfb916950a42f9182af42408df4a0162d459d691150c1708cc69218980fdbb7c070319ef61a9f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8cfd3cd7f4dc89e0386722d357e517

SHA1
a9669e91bc7b93f4fe405915a70b9478f4bc3f31

SHA256
28a5becce90984125af0f56159984da38d17a40e0a5c870f8f7a095fe90a7059

SHA512
380256ee4e223405bd10b87d277afa54bef8c0fad9d2cd806c354a08b5290ded3fb73418ffd113c01119689412d07622ef4695182d0c0eb943968fd2c19538b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ee6b9f03b57f8fcd021f5b73b7ad180

SHA1
fd1c78e4479fc5f4f02a3b4ac86dac0a4abe0633

SHA256
bfbd0fd6b595b6c1ef723165be557a6ea31c602f98840213ba088a153c6b160a

SHA512
eb3036414fa7b18420ff18dcf744fe2d637781f0563fdc8164545cdb9668196f4cfde1da2b9cbcfe4f5731928b8e7cd4665a21a660041f1afb472a3610a950f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4df857d3e8b89494801b21867d2045d

SHA1
bf2b2a29e5caacb2c2457b3a83233f84035dea79

SHA256
1f447b0571a74b3b6ef8d7bbfcab0750543131c7f25b1ec5de1f539ecc893039

SHA512
fac0e207689fe9994ade77cf0fba046a032b1d4a94ffe051c85ef89287043e7e07fcd8332982a8d2d3b89a198dda0a91bd8c66e3fc36aa88b40ca8bf4cf5fa73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a99a18ab715e85fd2104521222bbb940

SHA1
e507e9669da62cced4a493ade08a174f406f4e3f

SHA256
7362853c445fe8cc78d091d6fa133a98f6ce1f1a2f9edca3723dafb2f4223b13

SHA512
8f052251f70d1d58ff7108d43285297845f4dde77b71be7342a845501d1a894611a5fe491f04949902778d186d419b127d26890dc4264600ee05023a8ec4caa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93d8092cf8ac8ed56150f865f3e080c6

SHA1
e678cf1e18bf1fa75bd3e545f1fb0a15693c32a5

SHA256
dfe72659260727b3501e691ff4d33c2a40f1cb2f641b152bd99888f2d179045b

SHA512
0fc80bab618cbc36d339a41d4e0315115f116b282c35812f67626d1d487ccb2f99604f854ad960ab652d82d8c26689c6babc7fa93513bb54e63d460abdf5970d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b271f6d5805769dc190d2baa46c8f85f

SHA1
a8f6bee603939bb1b6a0c10f749db739cf191d4f

SHA256
1e5be98af15d98ba190814e6b0f0bf9200d6b950f64f94ccb09037d91fee5bcf

SHA512
26cb79f45ae8c12060c514adfd8208c6588cb7a3412c5edc76e4ced779cca829d11e0d80891268bc2115c5ed2044ba18aeccdf78b33b6fd221e43ad588ef7316

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDDF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF9C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit