e1d6f188c054fd9ae384463cd28994074c1f305fc3321c6f22c4618b0c10751b

Analysis

max time kernel
138s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c2709bfb513579834dbb6335321906d.html
Size

58KB
MD5

7c2709bfb513579834dbb6335321906d
SHA1

c62d8842c276a5aeba53072aeaa1e841f914e4c2
SHA256

e1d6f188c054fd9ae384463cd28994074c1f305fc3321c6f22c4618b0c10751b
SHA512

2536d46421508438962a9d8e362f05180626c8bc54b2ad88d718ae470fdb41bc0f624495413baf95040fd8fd6a98767018c848e971b4ee5606f65054832e5b1d
SSDEEP

1536:gQZBCCOdV0IxCjnnhfyfif0fUfCfGfef8fifyfrf4fpfrf9fvf3f/f2fCfvfFfro:gk2L0IxAaas8qeWk6qDwRzVnPnO6XNDo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000daf734892d5d963136826798940423841c9b91b0b8a3603a2e9f70700944ee14000000000e8000000002000020000000cf5b79ae16a62236d604e203999bfc3e07a1f3dddb4f8c8d2bf380bc297dcb6e900000003e6a6f3def8f584ae0fb87d57e7f176a01061f9beb30e7a604e0dfc82550d5f77be3f9fb2f4f9432b156869a6adf40b97c743a03aa9bfdb0a8a320617562395a6d302e7865e0978744ea364fa6f712381223bef7581eee0f0511a061014ec159c777b4818376f58f9895d3f346a94e333c592ed8bb8cdf0bcbbcd50b7ba021528e2e7ac9c9619bb66ab8b55f205f8995400000000907379775a4fbdb4b2943d217da10630431abc28f4be49e6c11cdbdc029efbd16cdb1d91c1f80f02a3393ccd9b7b0c7ed6a9d38a5ab1ea64ab4fae15287ceb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409901023"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000344e95ed1974b9a17d46a5cbdded40853708a9e5aaa16a88c49f96525af1f89f000000000e8000000002000020000000a43bbac13d9c67531fb3fb5f5ee2a13381fab33a1adbe99b5cba4f40a9b2234f20000000c4cfbfcbd7a5950adcc56c6a9915e97f4e63a3f0baf4a563fc921e224acb343740000000183367b69c25ca4a8694d88d7bc929adab6d1f3757c17372bf12776058c275ac0a14855fcee7480cc80f0384ffd8110b6e6b4853ca69567f391a7fa14eb2ec6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8F9E4C1-A53C-11EE-A57F-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b41cde4939da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
320	iexplore.exe
320	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2536	320	iexplore.exe	28
PID 320 wrote to memory of 2536	320	iexplore.exe	28
PID 320 wrote to memory of 2536	320	iexplore.exe	28
PID 320 wrote to memory of 2536	320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c2709bfb513579834dbb6335321906d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede33ad1bead60f0416ad828b00908c9

SHA1
47feb97d6f336588e089d6d23144f7009c0576cc

SHA256
ee636b6738e3a0e22784fdc2af9430906f2aea1512a1856bfa2a124a87028129

SHA512
fe5c30f7e1a448bdcb1adc84de3653e8068fed23f290e10d6f9006660d67393bb8e4d3187269ecf7eab23fdb551c7a95567d553f85356387e91cda39d1758369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6a3fa7bca9a0720736081a995cc57b4

SHA1
6d739938f5b4db25b72593e4a1eef9c89782555c

SHA256
5df763acaa6b4760cc977427f15980144c451394d71da927a462c6d4c783c5b9

SHA512
4e8ad807b4eb67bc1dbc0e0e9fb18bde5a8b912d9f87dc0e1e9221147a29956b0ba53041e3b8a57a1dcf09f23561c7d1344250ed7ae5167ee831b10fa3601f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad5a662ab8bb0e8cad46037cbff1d3b5

SHA1
3f74f17eb1b6f8d1f5afd9834d9fea7ff209809b

SHA256
57ee613a48210f2ebb25f1ccfbbe41245b4faf5b0ded3c9be7969eb4591ac1cf

SHA512
c8c32595b421d77d599c5e73b3d9803162f9386ed57cb47a3cfb1df5c75e288502b0b4a304c599b723300e9765f628722710a93614f4f15f9660d83aa3ded4a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dd0512d955698056a1fda3f6b3144a8

SHA1
9d6ed1cec7313bb3c45850364878f3ecea7e699f

SHA256
6c0b862800c33a320e9c54c3e26edc67a34f94c1c9b24fd3936256c6bec6e97b

SHA512
fe2ef380dc407ec66141e47cc58b04cf84b7b7f686612a8c002f35108e607aa3417cb86a41b4436059658de3251050aef485b25510052fd116ee2f1e40320f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86067ce316e517d3f505500fc717921d

SHA1
9013037f9fc852d2eafd8ede5d0b9634dd29045a

SHA256
8390b8bdcc0a30c6c4cf6337df24199a39c65c6d37f358f1c22660894b5fe3c3

SHA512
8411136c790799d832106c8e4e73d65a12c12122d55af17af9780e10abcb0036b57cf23d4495987a2bade08d78ab632bd78578a07abe6e12ec06f47dd81e0b61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c44b056a9b3a5610629fe5277357a2b8

SHA1
9b797e1ae73f82c88f60d1a43f7e211bfd45ced8

SHA256
57a164003f81d13ae69651811635c3857fad4eecb6b21616cb17001e79970445

SHA512
a195ceedc4de0249e61a40f94e3e0d0fcc94964ff08c7019923603ef7f42a22d62b63c33254cff78e6471deae56005616fec422e104b09e04bb286bce9efef62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e88330aa92e401e4a452b9bfcbaccf

SHA1
2e25058d15f6c069787b579d4988448be9a924b9

SHA256
0f9fdfb7258818dd8b9bc2af138b97f2901e22529d578da50c64039415d5cc03

SHA512
26f6ed0aa692a47c5ee4a2215f300d08963e95f2e8587bf87bf12d703454d26b214171511252f159c3c46bb32d2db8e35f23ba6668044e622d8221df4ddc449b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e63e328e4e6f1c7546b680203f021dbd

SHA1
82b03e6cb5dd836f3ee4895ebe1720d7cb172b5f

SHA256
55f02a0782de4fb79948b9c68ed2010dddbaac2eb4df31626e561f8adcc15d9d

SHA512
f6317b586093313e0f2eb3f260e00110ccfac27871c251f6cf9f800310e1069be8f5f30ae50a07b2bd4f2055b9c0569a893a36a461916ff1a04cb2367c7553ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aceffd1c0ee2dd6b9524e57b087c5f07

SHA1
339bed44ef34164e9f88dda358675971cb02d6c7

SHA256
83e6c6681552828364bdf6b0200de15b07c96bd238fcac4ddab66dd824dfa814

SHA512
1e5453a075466e55e477c79b37491ec4384f157c4e5c053a412e278458c094831d93c5d2c67702f94605d18d5e6dcfb2a55c63c81cf98fc77a0bfb35fb428c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2481640f2cfc774f796ce9acdf6c326

SHA1
73e48b6f4f6f401c8db6bd295e989e8af6273abc

SHA256
345978f2671fd0d4c601143ecad0aecd9c484ca19fffca29618161bdfd303fab

SHA512
c96eceeb561ad499101129e1ff5ca44869e003e9a18fec43ecfb416c617dd331eb7a4dd250698bb16d8e5533a49806da06d224da44ee32cf28888a7b78eec94d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d4119ce5f7ac6dffec5eccf12bd7c67

SHA1
97bee7ee66d4eef9aad64a6e1220276833d96ca1

SHA256
eedfec09dc617e57aef75430bddf70140720d4d085b99f58de4ac692fe7352cb

SHA512
ad51ba1bfd40d1c4e9625d1ded3298f86fb01bb546c468f00ddbfd77d6c5d10d1349bd1c62a14ded7e79b968e982fbdd174f9a5e56782396759a55b2d4f281ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4720c598b896f17a480ca2cca5d1e0ba

SHA1
137fe5ca77fcfe4c31e634a5f31d717a9c05f958

SHA256
aec079d13e8d7fe3f1cd335cbd51bece7f4c318f0d2ff4d47492c0dced35ef01

SHA512
e29bb2dfb4857af35bf3bf330297416d069c42dbb45ce51052ded182ee2c21507d11b5239acf1e2ed4cf29bdcf6421fe53dd12e665dca035100455eb091513bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cbecf4fdd03b530efabe63476964ef1

SHA1
62900e34bd7cddf08674c296a1eb5ecd5ea97aa8

SHA256
8aec11dea3b32831eca9f7c8abd8cf8bc03ca94c0f769bef20d2e2bba1bb9f21

SHA512
52fbaba4b47633823a6e7e494a1cb7ac2f5fe3d58f3fd7d78c79c54e9c8c1090d84b5ce605e9cefe8d280dc7ae573324d95274a5ac2f2caa8b574be9b9dc53e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43fd02a8ef7c3cd99fdca382c11ca240

SHA1
b3d7081add2261f87858a0c03d7cbb5892a92b86

SHA256
ed88b997fca645943c39a5ef5f26f8105b88c96dca5d0c3ae1089c9edaaa9b7e

SHA512
e7419b9e4ca0bf37d5bf803f1c26cb85f5560f3e9db29f86af46dd5db654819bf32e0b679d05dda3726332e90feb37a9a70aa461e3ee1f24e4fd42e4a6c89ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63B5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63F6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit