22ac6b1c13b6c8f5e7f7bbbed25652fd6dd5a948f519534035ae699869950d62

Analysis

max time kernel
140s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f52b292381a57a6ca749eb713e85502.html
Size

33KB
MD5

7f52b292381a57a6ca749eb713e85502
SHA1

fbdc26599f058830a4b0473f709903458fa03097
SHA256

22ac6b1c13b6c8f5e7f7bbbed25652fd6dd5a948f519534035ae699869950d62
SHA512

094548abd795bb30a6978a0f5961ac14c96fef345a9d66273c398ec0f692c76dc37b0e30f88574c3036e0858ab67f430df5bd966582bc6ed5f093ec5ca2cbe2f
SSDEEP

192:ShPPIlAT8kCqJmsXuWHGXfDpac0/tPHzpBt9zpJC+tCTzpEa9/tjTzpmtHzpOthq:SholAT8kCqJzImmqgqw3wdtfPW/E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09166691-A54A-11EE-99E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50960df55639da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000319a4938a218fcd5dc26e74659fb4858d72bfdcf22d6b8fc420610e83c764ae5000000000e8000000002000020000000399b79753b050dd1453d4c0365953cc51c647046b826b424e0b232fc30d9373c90000000f43cd33c46310ab43bdc06c1758dd083d6c0ddf910cdbf39cf28475830fa051c9e91233c97b101a84887f4641f081bc315ca4a117dc02467651b5d369c62a282b1fd5020872558cd602dc35e5482cbf9af929a2c7bc3587ecfeecf6f2232c11965c34a36ea758bdad0ecdf6e71cdd5c31b23a0225ac3fc47ece6431afb29ddb422b3c0e2d9e21779c5dffbcdd96f16de40000000e5c7285a583cff4dbd98861ad3cf5415c5c58a28d26364d60cc6b686d315e2988df379e09212e7dcb90fed60375ffcff8a0a1488261305bebd9ffb9964d47c0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000089e57bdae1253f705e59957290142935c59c9c9a4a044b63ecd3e15122da84c2000000000e8000000002000020000000fa4c28e26c4748712d72151dfea431ca902936e439f0a1eb029e5407c0360b8c20000000d6d8c3a7692f2cd5c584b872066ae959fb4845bdeac25e4ecb36bf313a5579864000000019c3f8d4ce522df4d1999c5245a92e7a5da62e073eaff9c50f907316149c7334772d58ae4d153d9eaffd336af50bb9632f4502122f7795894a0a1f140bd4fa29	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409906663"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 3028	1996	iexplore.exe	28
PID 1996 wrote to memory of 3028	1996	iexplore.exe	28
PID 1996 wrote to memory of 3028	1996	iexplore.exe	28
PID 1996 wrote to memory of 3028	1996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f52b292381a57a6ca749eb713e85502.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
314108e719b3f1aaf7141ecb97944664

SHA1
26239a6aadf08582bae77fdd3ccee1d83f836b0c

SHA256
bf4251e2abb932fdadefce23d6c66849943c11d1ec5b3780b9821b3f008e486d

SHA512
5b2abfe28b20fc59ff546dd7168e9165246bbf2c18b719cd6f9dcb0afa1a925d7431585cc19869e4e6d6b397327be12948a9a1cdcd49b8a74f5cb73180d4c75e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7001b0c84890d0e1a9873d4e82b1a28

SHA1
d97c971adb6d9e15ad045c8547df4853fb03da9b

SHA256
876b5adb0177b22d930e775df8b5201074ab42f74f3906e35d8792084c908011

SHA512
d3cf9f6fb8225960dfcaffd9633bc1da55901448b8ec9269dfd4c108e8d59a9675f1496f1d3388682927d038c99a68757b9e057d77b89e833e0995f6ed4bef6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9571dc9798089603e285edce9c88c8b3

SHA1
1c2b62ce05e876c85846cf04d3430f2241a03660

SHA256
b255a6fd4600df079d347a379a70ec9da4fc90ff614044f657f60d035f982279

SHA512
e068c713b060fc13af290f10701abf9587a8960580aec49f9478051584f6d201586189382201bb2a7387b91c7801a3300d50380128c2342008f256ca73bed068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d38e294a388b7470be3b7bc82bec472

SHA1
c7975d4bc90e547748419297189369faf8aa834b

SHA256
05a73b212db7448921e5fd71bdc1706d4201eed70d708106e5dee1e059c36b7b

SHA512
bec4ed607e8874527421c24d860b795e7bf7db35f7c528f0c6025aa5952086dbb35b136b869a59ac25b75b1474045caf9bee096de2cc1e33d815c9e12367454b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
596ebc0ba0f967bd34317676db4406f3

SHA1
633ad4705667a5ec7b49b6240144f98c4b42d33c

SHA256
78e371d779f36659b58f9b5d6d739b790fbd393f1e12c0f419a36ac06f31487d

SHA512
09d7b68abc33d2d3b1cc2439195c7ee64290c88fb2e15a5149ca9bb67f9a5e52048502bef47eab255c0837f82e4861786aa30c8b8d383740321cb34d18ef500c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5dacfee622622102baddb22d1d0fec

SHA1
cb6f46e28ddcecddad8a4b3cd0560457960923ce

SHA256
70529e5d665163d1d7c14562c8dc947e8881d6b3fd99cdffc28b842057ce9ae3

SHA512
2c9d98399b46cd29d468b92fe2821b9602544d6e5e449bf0af1a48d00d2eaf8af7aeed2a64e879266260306de2b68093d0bf91f96e3abc46374b18ad88e52126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3af48dc632bd8c9820c8bc41e713d121

SHA1
f5fe3106330068f174c6ddebdafd4c6b0206fb34

SHA256
9e4f4a4cda7d455e576476ce33e9d71fefcc8bca22aaf9bdaf40a45883316b66

SHA512
edf119600c3ce4f79a339c1f7bc910bc0254b9310430db4f7db7357e8232594a7f45a8f64cb393aca5e8a6dc962cb53096c80b96021042f4982a762eacb7ae72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
613e09a6fe72dc433894aab4e3373334

SHA1
06585ba53672b1e66ea2235608f7097c5b4b36be

SHA256
e01431309d3808334c773f8ac3b35feffeffae61ecc76451316172345e0ff2ce

SHA512
a9bba02cf80ee599c67dce6ce2c5e541f4f09d74f379ba06474824b7b11ab5b699d9030329e5f7e1d7e14921df08071da0f352e80b0426643c74b4bdf3717dc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
787d39599728b9409092ee53d3dc7a17

SHA1
9d3eac39b117c1e0d98908477405e54bf0f0de04

SHA256
59419d48a2c0beb9e158ae4442179e053852a28c476112179003b2d99e98fee1

SHA512
dce98e35e3c14385b1dbd6c69924527e04748d17ca027ac27c048020e363877002e6c60fcd7210e8915b5f86ba610d12c599d57d8352da5512c932e92ec5ce96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f0057102ee791e5b6d67026a56dfe4b

SHA1
fae2b6eb5019f6724e7b80893db85b5a08610281

SHA256
c56025ebeb4b33f588d7304c6078d61641d6645f7c8d6f497365d30f2725c51a

SHA512
b1b1bc5387420d7dfce74a24be8171aea0a96d2a9021c0254bfbd86ee904dd1d01fabd38908722e4762d235aad0124f82a80481b095337ac0a4567ebfa963f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
099c9763626053ea228bd7452cfee76a

SHA1
8dedc9ea42de4dd560aad30320c1e6b707681161

SHA256
caae0c7d468796de00b85794129b0dc8c73a7056e1a8f61b53104c50903f0d0c

SHA512
1c2e4234fcd10b73adbfd3f88eaae5434e8c68ce6ffde164542094c8f0bc705d0b0f01eaa9a40da488414a6406de2c1cc5a2b935c7bbbfe7af57a54c42d1cee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
0c9495936b0a2bfeb6fe6de2d3cdfb70

SHA1
225e6fb32cd350ee9036c609a5bb4680d9303021

SHA256
2fbfcd3ad08ed7d28be108c2ac3d4be2e74dfa606946e7e4261a23716e9a63ce

SHA512
adb2441b7b2e9a1f03e07c47aeb2e3b3209ba8244cf135a72f5644ba77efd8e7377f5eacdd29fd7453aa8a79df5592790309c48ca051437a69201f439835b1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC850.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC872.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit