e1af6473e9b0d4587492bbf00d4d15263e37759e8e67f24c69533ed0baf38f12

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f8ed62535d494dda89e4a0d4a146cc3.html
Size

6KB
MD5

7f8ed62535d494dda89e4a0d4a146cc3
SHA1

e1af960690dfc39dd87f161f0432188852c6f4dd
SHA256

e1af6473e9b0d4587492bbf00d4d15263e37759e8e67f24c69533ed0baf38f12
SHA512

15f64beb11ba6330fdc0bbafd9477844e8ad7616ee64896ab514500b2ca59669e997dea8c26eb2c8941c40abb2c14defcc272c1659fd3887a5ffa5746ae76f0c
SSDEEP

96:uzVs+ux733dLLY1k9o84d12ef7CSTUkZcEZ7ru7f:csz7ndAYS/Xb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c79ff03765a0ec70b5f7aab477e791b74780c68b5e0920c5e35e2b76ed30d479000000000e8000000002000020000000b5e3625af54a527ff6f27675fffee55daf1c2653a52a5e2453032d10bda3bcce90000000a8c49e95cef0378cdce5c68c2655099ee7444496f9cc84c482813effbbb40c209878ca687b4305c62b7c8bd7cb6e7e40e9bc47a6eff6e8b05a9f42e336c920f9c7ff6bde03c5b3ae812201fb91b1f6a78380f91dbb6829fa0106a9fbff1730833eacf6bd786b0d8d3e53f6d226bad9d19fa7d8183a4dbf6c8044832ddcc2c3e06f7603ed140839d687f488cbeace8a2140000000d2ad57d7bddfd38fb793e83172b43e85069db101d6ed5c0adb73b96d36dd62e6d48fa831bc3d7694ad4c8f95a5701cb5c6d0b1b86d655e151fcfe51e86105ca7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410740140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d7d56b52d78a44d2cb0c2efa15445e6baaf55443aac6c41f7f3d9805bd1b3320000000000e800000000200002000000004a3975503b25d038fbb2de74b525978219f41f312e961b2c4237c83303baf8d2000000098c9d23653124adc381349a27af919e4d3b938bbe53377423c25029b90f26b7040000000944f03b8565a14985bc87bacba9dc165edf08cfd21fe95777b2754735c75d2aa34fe3f5466d197a93447507cf48dd256c8d2861e78c5d0eafa988491bfe57888	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E7810D1-ACDE-11EE-BEF5-6A53A263E8F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006b4c77eb40da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2728	2424	iexplore.exe	28
PID 2424 wrote to memory of 2728	2424	iexplore.exe	28
PID 2424 wrote to memory of 2728	2424	iexplore.exe	28
PID 2424 wrote to memory of 2728	2424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f8ed62535d494dda89e4a0d4a146cc3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f03ef9f3fac96f35da021915eafa260

SHA1
4f5711961b29d5b9e6e041d85f99587f070371f7

SHA256
2886e39b94e1662d2b054c89a42cb64086c682ffabe0bc3c2fe327b497e592ea

SHA512
76444008ba03c951a20516148482d69536c969049cfe4ed2e230f0fd57c2c8835873b1dfb5870382ef60a9aaff7e89aab2c881b53cdf10379b3b49c2dbba9d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dba763cea9f8c32234109bed77f11b5

SHA1
710a01a162679a7938703a9a62dc6d2b4ab61547

SHA256
ee41e2de7619fc1c49237b1e2f35a9a470b0d0a438b4253bd99d2f74380d914f

SHA512
da67381924ac59f417f7f9bfa86d6565076a30423270274285df9324599ec10b09d818514bf628b67e8039af4ea21d12c691686b985fdbb90b2f08b10a79880f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef49c3f3b9bc448d0136fd02cab75e3f

SHA1
bce9589f23d4ce59b51204b6703b8767f4653eee

SHA256
dacf1519fe546ecb719af8de890ac44567d03c93fc07038816dffb24e6bbdce1

SHA512
6536858d2d8429ec518b67bf5037d0031d95c35adfdc5c5d42a9468281d3fbefedc69c98b8f55a74cc32730cddd7fbcd25fd62faf9ed1c099a4c76668211a0b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f65f3e961e60be6769ce51c333b469d

SHA1
03c1b1381872e2f8e12935fc5e675fa16fb89652

SHA256
3bfcd02792d0e5f3946163551da18151b6c3829a2e6fe0d84d8bd31d604f4512

SHA512
b94d3b919015811388d57f80df7c516def4a2a730e6309bafe5f5ec3bbd7c8ad8948e3430ea3bb8411e703c905cdfa936548150e0c3bb9e9180100535ec68510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
483a5b2d99d8ab1c771c72e6ccdaa8a8

SHA1
0cc5de775572d2e0abca161c43c31e0647009f31

SHA256
c43eff103d3ff126daf93290d495f16f2380aaf335f4b832a627ee463745db00

SHA512
70ded6bd5ca7429d0f4e4eae3d557978bda46bd2f0bcafb7c0903d39afccde705c8506b88113ab3d0923df98340718149981c7960ee4f555bbc02ff3e20685ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68392324c54f62564954b4067af61979

SHA1
622104086402d191330b630f0b6e171c91b48b91

SHA256
48f056107ff20b2c3a7e5d7930c42bb03d88f3bc444bfb60167cc77359421f4c

SHA512
269941c12a69cc4b5a0f4fad773c3af4c3f01ec1a77a8dfb86d6291016412c8e7dd4b0431b9be664fc81eb5c99834f3b7e805931c29fc39784d5041ebabe982f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd2ece4c1528c7e40f6197523f68c2d9

SHA1
417b9fabdb095f02e57b1c440767ab85500efc33

SHA256
ae9fe1b4b1ecbbf9b04a0bf825c93e2744b9b91e572e977a859dafc22c191b09

SHA512
6e60b12a72fa1829bec65867199a486a5bc020b1fce37fc5c8acb81761dc96195b9439a37697a30ca06e47ba58d832350d9a2f4293fc8df56b9f8ed9449e7b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a859cb2cf7daa58c57f0bef3f741704e

SHA1
fad15629826da4b368a62a64419552b3e157b1a8

SHA256
16c7ced609e6cc3d28317ad069b9384d458dbfe6aafe985ff203930af6f3d007

SHA512
b68c42bd5e3452ce8bc153fc144de6aa0f5c8c162bfa56c54759948c73ca8b9ac7da3851545d4d5000e84c4534ea9404f5f842c6163cbc97501d6dee7011c962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e869565dc3dc8a73cd374d91565a859c

SHA1
431c6864756b3a14da452137e3dc63ae057f1d86

SHA256
6b6c84c427e3f841de5fe115218b22485a79400eb9dd74d672ba978df9437b61

SHA512
1a313ae18012e76dc51eb840a2d3ccaa4e9950fde613e7ecb4f1c54b8edde74c313898025d34c5f0455580b7937479113e366486e8d97bda80786e6d7035daa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b3fcd71c5bdc9a04be55531bf457443

SHA1
df5987e1dffa4ea70dea64ee6645c9b1fd8509dc

SHA256
abcb6c7635b4e64b2c42b86423d6613652f2076fc2a3ab33d642ef9d93702908

SHA512
185b37642a830499d190d09cffb0fb4f5d279538383e9b32661f4d090a7279521e05ac716c5a201ee98759c1ce2c241b1092d0df1a80936bfd5c9e148a0977af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
191687b77b9a5cbc99b3c06b79fa30af

SHA1
18d872cc1c4bcadd49cf71500b6bf93355d7f726

SHA256
f80d222d08f0f1a530cb5c5957134a27539cc687c7e1d52162fb8567b037c6ce

SHA512
e6204246582077052f5d182bcc7a02e790547a51cf2fb461cdc9f9e6c1071fbd6b58405f875ec780bbfd0c99fb71020022fa4a4ddd80ddaf809962f80245b794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d392a9f509cc9b61e990a36da3090c90

SHA1
eb8273a500e7717d0db6fda03b303c4043438c4c

SHA256
ea861bdb546c0897c3ec8623df116fb9ae8daa074df85242e9ae921c8234ef6a

SHA512
aec1c9cb1e6029e0dd373505a39c96e531a3914b2f4dfe2337faf86891929202cb112ab104ade9df5fcae1abb8c26559108e0ad407eafcd3b1e84e02b2b9bb79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cb3748712b255f9ee4eea968b19ef2c

SHA1
2b047ff2b17c7f0866465f780c147683e6d42b26

SHA256
d92680e23eed15ae4df16a662272b1326230d053f23fee3c9f06027b8bca2a16

SHA512
cd97bceb6af6d866feed6978a7b10c28071b85432eedde6367a3884b4abb0e318ed48596847e4387f0b692aab75a0362345efcdbe3ac3cd6aa19e653da43f4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb719fa1b4ba7b9fc7e46e0fda1c0ad7

SHA1
b25c047b4b42ec00ccdc0df1e70ea42aa0fcfae3

SHA256
5b30a6ffccb53f049e7695f3e867c1641da7f23a39c9089fa52571e72af29a0c

SHA512
5214594fda9a2cf108783263334f5ba859adc053b43b5e547be622986df46ae65e41bb6b8255bb5df757495f902c24fd38af5aa56106a1f71729d0c16783bc08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71fad7fe8a855c423303b79f4361763d

SHA1
f3f0a42bfb1880e30b558ea7726502f52cbbaf1a

SHA256
326a7abaa46dbdd22254007d70db3f2b658435ab94b6af1ca7d9b3b9e77a3cc9

SHA512
f07fddd0e0012e69f4d9c0fd67695db57cab1b12980913a8b746e74de6ab86e6c8e587ff35b708fe1c994caeb5f1d49bc08db99443dc8203a4927d3f73f52515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a1ecac951e2d4b564f13318da78aa52

SHA1
54aa44f2eee772fff383dfd63922cdfd770581cd

SHA256
eb11ad648f3bb1cbf8b215fa39bc4249281ca37d03d9f10c47f9c3730f4a4229

SHA512
dde91ef6d21e93bf80c4c60710ff2971057a3a6d7a46d755e5e066a38eb1f073d91d4e204674b100278e771536eec08496d40be1333706829713aed6ef52f052

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7340.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73DF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit