a215326f88c1b024a1be62cbaa422b8f68f1462c6644df2d3ed3be29043f5232

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b96d42b55e3112deca01deff36d9d72.html
Size

3KB
MD5

7b96d42b55e3112deca01deff36d9d72
SHA1

57b1bf6d548a88e13cb519838a1ccd6cee0a764b
SHA256

a215326f88c1b024a1be62cbaa422b8f68f1462c6644df2d3ed3be29043f5232
SHA512

73306c0ade2032c974c077e2b78e2d7b58a6d4ba4ab88f3dfc421b5e66bec7328a2d72dbeda5961cdb1d2f653c8d794511f37aa8dd0654b5d910281a0ceeb1d7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a826634739da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409900010"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009997157a8f83a31c353d2a1e1e4169fef859c819bd0b779211ae622351213734000000000e80000000020000200000002bea1381cee367cd0cd651bb155227c645fa4efe78a326d4de6ca2072f5e602720000000a8a88e01580dace68d155d837e869ea4c34f3281fce6274f3609eb96a244aa1c40000000f04cefe97d6311654c8d06713917ff5666362726ad892f93311b18fb0edcc1906e2b52cb6e3127bcb4858b85d2788464ee78ef62c5adc2b58f6a125005a8343f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DB631B1-A53A-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005f082d8ecf76dbf19785807f72d3557125d4c942e088c6cb3128dc25d90a1bc2000000000e80000000020000200000002db69dde605df6c3ec6427a831b57a7b8515e478fe05060adece08c4544434159000000028479ca9b99813165684d7e07f9ae795fb07fb952224552cead28c387f6411c040a82239e5de8dde027b5cb43f5767c047c2aaa7659f130425b4348e6ba9a19c17079219221b01b0b12717768cba2f7b2313e0798b2eb2c73c32fc1f3e1fe644e6b62e431232f8e8f90b547723bc9e6c18b8bcfa6ac3eb21bca0812aed3681b5a2735fa001fdcfa149f7b89d9620849640000000299695508908edee24a311434785c9896725fa35bd1bb374d4b7e03450425300694522b6e16d0e8527dab3e058ba8d82116ac45d9beecc4680758ec15b205ac2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2696	2336	iexplore.exe	28
PID 2336 wrote to memory of 2696	2336	iexplore.exe	28
PID 2336 wrote to memory of 2696	2336	iexplore.exe	28
PID 2336 wrote to memory of 2696	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b96d42b55e3112deca01deff36d9d72.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
760ac923b9761856465ca9c9f687c39d

SHA1
956fc8efbaa5e24d05bd698126daf506eaf94a25

SHA256
70c52af24502b8632ef930cb581da97aa1cb5d17b5f502b290df5cc876f42fdb

SHA512
5d05618d9b5adb00fdee0e55ef1caf8232778798648cc729d58f93c96ab0654d8ea6b7a98c9ed3619034fc3544cc9e32fd715db47abbccdd75d65495fdd6e97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b830cd5c9925a51f72a7528924a60922

SHA1
31629497b144d133721e0454e229c83464f4730c

SHA256
4e9716aac73f6f20f12d06175fcd1971aaf9520e279a825acb697da2a8e401c6

SHA512
1eb0acd5b7fce0c2274f9b9cdadaa21c8ce108611e55ffba7c29a209a53d8839c00b009698d544baca5d09ffeb55f1393a0962ef1b2b2a75dced60cf268bba0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d9ba61168512d073105e5b7a47c4691

SHA1
6742d404e7913e7338c041369f1546b4b9b4be8c

SHA256
b246dae70183e607fb08bee31475528961fbb4af66a8fa6b6c70a714f4ac158a

SHA512
c9a09bc3e7d0630ff9a10df1334b5dd4cd9f257be002241f6627aabb50be632d798bc41c7f7c483e633d0106dcb3584bdb5937bc329960f01f440e1750f95032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bd6f8a1e2204bf7682096c91daf832a

SHA1
33dcb99382b5a79b0b4b53a43ba4d93e258f6d6c

SHA256
8dcf31df97451a007d904bd907708ffa7173d74d360bc8732b72b59a09397aea

SHA512
937ffd944502403668b576728bf1f2e2870a38772132afd71db6ea766ca8eb5ab590fe94587c6177a8cb54ebd9d40ca6c5857f8e4a329fe78e6c70b73f1137c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96456804bf8b9e2cba0b8da2184379fb

SHA1
5c16a9f8d34e0ceb5109e51ba684b37ae0818cb7

SHA256
493b6264a201002aaa065ebbdc3e73991fe201e887a8b5a96af1e402bd49c485

SHA512
e6ce426b56ec01d96d2bdaa3df88a070cc2baa0c8b52d3fef8fad60e61eea5351473cebd5545011ffa84611bd54169a868d66a44024dd2b83cb76a41a8a34587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d626d1d93efa71eb5b76b99b92d99c95

SHA1
943b6a6de8a659f6de97331564ad307dc1512049

SHA256
040c3996a409d12aa995f16edf8075a268f5a22b5e7df0dab719d0b57dc6c983

SHA512
455c5cead297a6defd6744ada1f3afbbdfecff544f5e7b58db19263eec4fc19b2a73a121792604bd042234860dd0f4c9d18443acc2cf74d78cf9064d8d349f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc34f5df8542f4358200a5ad92da6582

SHA1
96e010f1bc85ac4fd4698f5fc7a4be77089a283a

SHA256
122b45b851eb359d0d98f165558b583ac67f495a3ba07e2ac12e17974b728526

SHA512
8d0e9a952f3ee65191d31e135084b8a9dd01b9c9011887f0ec6765d3898da045023b8e7011a28a56ac501d0f15e9b92d9bb572a944c79b2837d27bf63ad83242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a03111ce52734110138f9fc7d7daf4

SHA1
a655566325a8bf51f08b789772b9336eb19e1bb5

SHA256
d8a9a14419ad251707c20635907e69e8e2e473a0c2eb1711e2c9e8353339dd28

SHA512
194e92618227e30c9be814258cdecde7d25ca289f799f4b472c4a9183d704ac0bea19818d668253e3dc2852ad0e368393fe800301fb49f1b4aaff7844ec391e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad25b667469c093b56fa155ac86cf1ed

SHA1
d9340e0594e9b0bb8b1f77cd7091d9598b6bdcda

SHA256
bf0b41137fb9015bc5777e1cb7052a76e58fa2795a342c3a35f46390f08f8294

SHA512
cdcbf8695a8381fef5f1001a27b7cb3602b97e3d43d56776e15bd7afb09b72232bb6bae3ad1e03d4fba2b2801ebeef7eb15352379ac4e7e56f6faf37b8034964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a959a321db517017b6f37665583ece10

SHA1
83b1e2c47bb7257389431025492c475b00c52d92

SHA256
c272d01c7be9d698f57e83b866ae9bb9b3abfec64ce8f0656df2807867c7bb2c

SHA512
46a56359d5a13fc429ad36fcfc572ae6b1bb65ce4b118c6441de8151306914b13be2cf736a4c567becd42f0d0c4c235c73ea4c9d7336a33d4dd8178908add5b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2b5f035f7ed6d40a028a501149cd272

SHA1
d20435c40a1f0ebab43fa41e9cb073a09330464f

SHA256
9318918cbbcbe8ddfc61352e37ce446d0108be3a1515ac9b2b4d76bae335c822

SHA512
b7aa203d9795de5e4a539d9a78eaf205a2932ac49979d4dbd601cc033904acdec1bcd115e4f0aad4747232f3cbaff303fc53061db87203ef8ef6b1c047273647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4958931fcb644ac3b72f013d81225854

SHA1
5b19c7c08290e502ca11a1d5c0399c61f09071e6

SHA256
1aa7a5e24328d38cc05aed15a7611a38fe410a6d5782ac200596e8c8cd8cbed3

SHA512
03520f508135355c50c1a728ad3e3a59239e0319c9150c896502cf73bc57871a07b098f1e31b6fc634f23376438a650c561d6442779b073d4fae9356d4619878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d782696c35a272f70758c88adf11532

SHA1
cfdc7906bf72bb28d8ec165e1d844c7885012c4c

SHA256
7f818bdf6612c0306edc86f23e7b2fb9290a3f89f39790958cfb72fa1752f524

SHA512
da5e437a797a537dabc63ff9e2823674d9f2d3879894392823104a135efe1189febbd0ad533e27e039589bf2ebcfc3a6b5df38fbd6ca8999d2bb2c7a756100c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb198099e656b4bb6d74dd495baab2fb

SHA1
6d5f895d7c9c1be219c071112de4ed9df1d6ba25

SHA256
7cce3715086730c5b1454017fc7df920ea7cfabcebb0d374a838129a7bac7bc7

SHA512
2f46f30dfa23e53138bbaf301f878ade009c09d45fdae5ec29dcf5a2d007d9f1e17f128dc87f5771c17456ab75a1ab3af298885f9f496f72a5f08e6f103ddaaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3f474642b6578470bd880403b11040e

SHA1
26ad09454457535c32de6751f55a8d3f091da1d8

SHA256
4763d073f80013a366a07c15a5317b02c1948b67dd10babd70086c543e88efc6

SHA512
07aca6dd8de0f136afbbfa9ab30f6fb651fc735192a3535f41b9c9fdd2584cc3de80b7d2d9755bed1411ea67eded70b11eec42609c417655ee9fa7e25cdd55db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9465.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9553.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit