767b1871d344f5c684987473f2b496cbf58eb80ac0987c4e0e2c026c3f076cfa

Analysis

max time kernel
146s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f7bdc1e7cbc527f54ca85bb050c75cb3.html
Size

11KB
MD5

f7bdc1e7cbc527f54ca85bb050c75cb3
SHA1

131a02de1c33982a7e29359cfcd0e4b8515b3a78
SHA256

767b1871d344f5c684987473f2b496cbf58eb80ac0987c4e0e2c026c3f076cfa
SHA512

90404c5160d778e5b662f79d1b4a3bdeeffae297ef16e28ef9b29b0d29f81b5d624bb99b0b5b80dc907d20ba72615959a37a52074ac47abf065fe17a7fee35d8
SSDEEP

192:bren8VwgJRtGAF/LylLuuH8YpZJybNUPEQd0lLXF9c0DI:3tGAF/iuo86ZJybNWd0lDFx0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20711a0c3843da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32964721-AF2B-11EE-9B8E-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c833885f00c5699c231e489bb0209053f2c72e2f6ba57a0f78d4c25501aada91000000000e80000000020000200000004109dc42715a1ac64a990a1d58a41aaf438fdbe398b52788e610e3973033ca51900000006629fc9d1f57e01f4ec53faba8f109bbd198903d0c1add1e376a2987e1da2b9359093a66f13dd01d1a551783c32f0588beb253dd5dd31b7c370ba44a625069b6e67ec0e5c30a9b0734633fb2740d0189c93304cebf9eca77d7b5ba1580eeb194a99b2c1d477108a0689a3d439e35404bae25dd0c8f40236504b523f798310a4836687cd05d5c7b647c9cf5cf7de5ded040000000f278e84167c91869eb323c44750ff9836d54058d03810e964c53309fc50b1219959fc2373069365f196c2e7c85d40e35f59ec6f398d57c81443cef2d5e478f30	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f351401ea4d78054558ccadc1eda870e0d50d7702b909e956a94cd0d39b7889b000000000e80000000020000200000005c8953d2d3068669ba4ffb230b987317805ee9e2778211b2c557d0295ea961b2200000004e01fa48ec62f1a8197f57ab7249d52ca8ff98e73a5f5b98d674e8ada13001904000000057199dc3fb123753eaa964d6f371b79d6dc1e3b7461b86743ff34ad831d6c83ca8840b863786cdcd69e45de7cfadc004762a49181b49bfa3ff57f48fe79db5ec	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410992936"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1840	iexplore.exe
1840	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2732	1840	iexplore.exe	16
PID 1840 wrote to memory of 2732	1840	iexplore.exe	16
PID 1840 wrote to memory of 2732	1840	iexplore.exe	16
PID 1840 wrote to memory of 2732	1840	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f7bdc1e7cbc527f54ca85bb050c75cb3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
889677ff10ceb5c52636801a4004dc38

SHA1
93a496c56041709bd220dea3b91a1599e70d24a2

SHA256
8599ca19c8758599c6959f18d9c30ee6d18343a7ab8879d303c57f43d6b66027

SHA512
dc003b7bb114b142e506e0577ea7717dbb389768c81a084d85a9c78b592214387ce05b8755f37837d07cc6a6aacecf41e22ceddaf7aa72899e0d73eb1eaaaeba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f0e2c4597777e6bc6796e54813b8104

SHA1
03033ea539f0b7ba9a1669e4c00143564974d78c

SHA256
061d337a2d8987b1767610d7e97881a3f457b5640b7fad3a17cc1e1073e7d359

SHA512
a7cfd6f4bd6a65fbfdade15ede7db8fa025c92d593bf538526bf5655958f02405502aaff653126ddccfcfcc3fc22fbedf3b0df47e69db995cda21b40a0e49300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b5ad33f8ea7dc333251d3bc2a8b0ab

SHA1
743bc488ca286574d10c86426be8a0f2903b616b

SHA256
b6553484b908dfeac35cc6a1cf33f3c5a4418ca2711629f882332cca24cc234c

SHA512
8f599f167f08074e9d8e37bd784243c7807ae250c2a794a6046d19ad9d95878e48f9e2c0ae17a96024fea7f3d6a5d21b11d2b56a48a3fde41d115d96fc34ff36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2635f7bf151a0179a599cc780a32c3bb

SHA1
f80505d21508077faef3a4f9cb97eb0d12b012e1

SHA256
52d679b8d691de80213f9348bc505f0d14ab8b69a7322e501fc2c3b96f8af33f

SHA512
902c3686d2605c83ec70f850c6b500bbd2ab6e87edb83cc46c7b9b3daab84b4cf3d11af3f712370f269af279528e42b459fad4903d820cfdf77133d9b7e96f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94d68007d80353760cd584c351f41997

SHA1
12dab8031b6a6838caa752f824815443a7444191

SHA256
2477dff757680795ebe5cf083d5fcd40af3de8a245daadb6dd60575507cbe616

SHA512
62eb03aff0a4c6ee6fa34d202e9a62b11384b0aeec15be4c145be7a9500ef933966396874c767a56eb945980289826c470d5ce52b46938f07b362858526ad60b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78599778bf8768ff9936acf81a4bd7bc

SHA1
d9ae7173d80fe7ba3045c535668c43251b117abc

SHA256
cbc7c28c6ddde57a9fee05a75d4d4d9f274317d28104153a3a6e018b22d1e21f

SHA512
b970a368ce8b31e780b632ebc794b082f1f51f4279e94a4c47138625faa3918370ff4d63e4a8f4856b9d47005aecd32b28b9027b7a142381b12bd75cd47227b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef173f7398a4e1af02dbc37f78c23de8

SHA1
30664b1db8b27b53d6d5c04b42360a9a5d4ceaef

SHA256
268840ec1e3cbd3934681f6ff357e2c9624073a08e86cb4441f3fce82b565038

SHA512
36c0aa8c16fc8f7d82b72359706a14b8c5a9be1eac9480ca29d2d775e6e2c438d340a0b3ef73dfdb231e4043e8752b9a305749f3336ea4191f7665ba447fe9a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4234d0c74d2e4a389aadace944fbba3

SHA1
9d7eea00d55da59c996c9447bc89fe3243aa5aa1

SHA256
df5d3f1c24f8aef62dd900de80ab5881f34cbaa10159ac611dcb5553844c9c38

SHA512
944a5a34afa2c051467a2a19af9d218b3529104b80412e35b89ea8b885efc5ce6ce99fc72a9962c147a3dfb36e7e1f5a213fe23019c686cdcb63fe9666ca1a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d9cc1ed1ac40f727ded40c8cacd8611

SHA1
8c75ece435e83aca1d7b27450579d4019ed5fb1b

SHA256
7b982193ff3481c621a5f796e141a5f74aa1f6b2ed47b47893bb0d1f59de59cb

SHA512
c67e92f84fc10679164e66576b903fa04ab93c1ba8fca0b040825645c00d107ed51d573170fbeec4a37159bf838916a86f988e4643e13d17cea140025caa4590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a53953a1c286b778cbe6a774bfb255e2

SHA1
b8f7a4504d5f95ec0e547d7db1c232e38385e352

SHA256
c82140395813404d9aa64c2d75819fb802442cc112a4b22627cd07ace6a020c7

SHA512
cd23e877b44ab8c4af6191bedcfae2c453886609b54aec3933d69a953820650430e0db55c1e9d33f7db42a7094741b935d25e4f555fb1a2561f0b2aa95a1459d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b74f6003d0565c216fb18d1c2bb9397

SHA1
a456b8c4ec190d58f55139795ac3b6753dfbf1a8

SHA256
b7fa5c005b8c0371d0db22ae1c6b2280e575e8be0c51a670d6f4061712ba1188

SHA512
1f4ff3c8a59c639c2784a26b3e81342fcd095d2b088ba6ffb2444e98347dad256d25c2d3757e12a5c20d67f0c256226eab493c709195294a8d83b31578b86d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c17ba86b156830c9e127a6c1bdda2b8e

SHA1
c514c8b517dc18621991fb124913fe908306b14e

SHA256
0be4769666cf56b2206bfa15627bb38f9d098e0651dbde606a23f89934e9d3b6

SHA512
b29e792976c0543916b2f99cecc04ba5cbd95e5ffd1f66698181db38d5b433e95577c974999eb59e481b1a3c599e566f4d1f3233aaae120289bdddf9a5d57836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ab67f5a0b40e3ec2abd97dc3e86b3fb

SHA1
76eb36a0e79accc74479c8c96147043650299201

SHA256
e918e260ada33429ae54dcf38292b1bbf7b91bf31005d16f96a97bc100011cd8

SHA512
dba352550c83f2f856b472961496149da4e1e5e8d1f34143c9b200867937f2d1b343d32d9d1227e500783b5dfc83c63ad53eb657b44bae361c7f0484fb48ca78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4661c9f10777bb50a55d2daf0ba29b01

SHA1
d6d980777c0ebe1abfda224b0cee3d5f796c0840

SHA256
0be7ae36058704a752d6befe1fc11eca75ae76be8c489a0db4f5ed901220a490

SHA512
07bffb4a083fde1a22a98a8cb6ac2e1abdeae5281807e2f9812db4504ee94e3b3cdd451a0ed0b108f8c1c03aa34f22087ac2a61678a6efe6e3e29af0c10ec9ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bab27bf5afccf537842fe6390eb1418

SHA1
02a1bd7866cf687a7ad8c7a783ec8b489f56ab20

SHA256
cdc6d8af38217330de74adfb81c1b700576d3029594b647ed6c42ea66d159d14

SHA512
bbdcff1785dc6958faf11c2b8d96b19800bfe9f2197d20cecb7a416f05ad9bb4c8ce1581bd52e410f88da544fc35c830c0e35c12c674e8b3d23c28876d6426e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5BD8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5CA6.tmp

Filesize
66KB

MD5
95b19072e1b11463fb2ec810b0e6cd08

SHA1
10fe5e79b94378636a0aafeb79925833fc400548

SHA256
1f7833dfcf1715a43544eb85bcb317e29496691c0da90ec9e0f0ecb199769d05

SHA512
6387226da53ab1990b40d17be910ee4a89dc75ba65ee00a25b5a37a3c11f054c58ee424049fcf80fc6d8889682cd256786558c49596ac021f18ff6a61dcdd562

Download Submit