285f00a7dcdbb254916b4ad41d457a9d2e386db79d0cd7907caaf83bb9fc75c2

Analysis

max time kernel
144s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0481a3cd54a69a3053bb6c6bed23f7d8.html
Size

16KB
MD5

0481a3cd54a69a3053bb6c6bed23f7d8
SHA1

1b2d70fe0fa73c4efd70020dd71460d3cd2c1c9e
SHA256

285f00a7dcdbb254916b4ad41d457a9d2e386db79d0cd7907caaf83bb9fc75c2
SHA512

07703cba1161d61c8e876b0487f84e2bfe6a835f4243a6c583ff006fef8279cdcc008c8c0f605560561d83a5189b24421fcbdec64129ee862eca103e04ac303e
SSDEEP

384:PzqfWypOU6wimzME/YYLdP2N9x3LLGMtQjksHwUD:P2kxwKN/QjD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000026a6e9b01bc0e4fcd6f983895f69f575ee6638108e0d016a1595e2cc9a43e2c2000000000e800000000200002000000009304ab3638ef8c3871e92aaa5d83b2844d93e3da8b6defb83a7a75cd5daece8200000007b6c45d75c3a0c2844e1c885e47cd188d5b26fd1c936b0e66469228c21b975e140000000541c581538131bb3f685f9f89e406d0918de5244cbeeb842d56ebfca588dd6e318cf6b94e3a0061df859e351173e8d1e53cc397f1af539a5754fac86dbf39828	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410079506"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0627252e93ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{796489C1-A6DC-11EE-A908-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ebbe03e82a31afdb461699f85f2ac91ca229ec507fe6ad3435750e7944f960bb000000000e80000000020000200000009a76ead72151e8b461c2342d4d9652fa1e1b78a92441a500d51be114abcdbaab900000007152417f8d47fe9241a40fca9fbf9a94e81a7e957b7c23225cc816f51da5a67d26f55c259192de8c81d2bceea7a9b4e76fadaa9f94304fbda6ecda79dc749e5bf43bcd62d2c9dc8cc06eef1c91a2513b8aeeed2704ae2d34a102f2b66c18630e8d8b29b10c8381aa534e719dde61771113aae824f86601e2673117e531028c0512b7908f952654b9b06e641f4395cd6c4000000013c2c27aa6956242d3fd491780d2b66163cfe0e6e7b525caf38a5e048e796aca6b6dddfccf08afb5140966350d0c10cbd3d0cb822eca0fff9eb68cda02bc80eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2064	2508	iexplore.exe	28
PID 2508 wrote to memory of 2064	2508	iexplore.exe	28
PID 2508 wrote to memory of 2064	2508	iexplore.exe	28
PID 2508 wrote to memory of 2064	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0481a3cd54a69a3053bb6c6bed23f7d8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57e8f98522f4a8347f062c675a01a0f7

SHA1
34cc0221132a28e7669ab52f27950f4f85843025

SHA256
8f9a2aaf498892987b20642a5fc5ac30ede60cf62001dc89c79d78ffa8d6090f

SHA512
9ed95b8e46bffe7d4ed6b3a6b8a885104a3e9f5454666d3653b70dfa81db2bd935da0e42124dde4d038b8896b13bfdd3a86dacfff398606c5cd9fbffb51b6d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16a24703e549289a2448aa27f3e867dd

SHA1
4b56202da91dc44c505f5f5be3dd06e5f3dd731a

SHA256
9a703fda665a37d882c51f91c6b50bb0bcb8ed806fc6643c8d32cd9aeff2a8b7

SHA512
f880926b283037122603fb72093e213109780d9a6c0399073d05b5d1c623486a1059976958b0b05c9e017d2370dcc38aaebee55f310d97695a04dd1c4545b09e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4484189a594ea6fff83e3c485653274e

SHA1
ef6ab019096347d11ef35ea2c70a412cb2925541

SHA256
4bbcd7cd0c1bb978150c04c45423e2e6ae5686584fbb9428e4257f03a5cdafcc

SHA512
b8096d17a211a251acb65dc51c1b8d7a1ad70bb2846c467c97c3bba44604572b4e0cf4b08760a59b6e587dbe3083f991dc067b21a462e30380545b0efef91054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
921569d1d64a3c306763f876f4843075

SHA1
fe9e48a7a9536d8fd6d4b48892de5b8f34955c4c

SHA256
b62ffbd3bcb93291c3520ed3731c9531db9b50e063cf3d597bb9cf5f02affde8

SHA512
74503ebdbbd2d091959879fb180f0da6dd463e9b98f4530d80e1783fcd158153a45da45946ade7e0ce188b425890f5aca699b72e274392a852fe0650728758a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f61ddb5bc5118f28ef8366610b57700

SHA1
5672fedadb62ac36314516ae9df444f86e8b27ae

SHA256
0eddd36d8b1b2d7c727c8f280eadaa38cbb2f47dd612ff62894d6f6ff4a40f94

SHA512
0fe372ff9d2508c0937a66f6df72af2b0cbcc11a2b488fef6f4e89a943e77610b9ec7f64a840321c4a26f585ed5b679effc841ff5838749e2f019b89825b7e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5457b6849217ff7c3a180389bd14ee6

SHA1
c3190df7d88d241cc1844b1685ff04326269ed0d

SHA256
7d59f66d7c598b4f290fa0717ec2761bb9d2b59cc9ffb8390c3a5052a6ed90bd

SHA512
6ecafc7da00eba2b6bd69a55f56b279561d0a049c9209f7f52db4a2577ef4f0607bfc5ed77c451f6fecbfb3a82d2d618568d4808e16326aa298a873c1cdaa085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c333ea53086db1fa3eaf003af563eb23

SHA1
80f53483ad1d4ea7f23751e03a26a78120b602fb

SHA256
945c6d7a28fda334c6acfaa577a7209a8cf009a78e2708de90a4b1744310454b

SHA512
df092d8da528a2a9c66da9ee574d8c56f16eb73eefc11ae1ad6a6787249455503b65bc66f4181a0955380b44085ec8cad54a5526b88c449eda50d4d826e12944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5868122bfb93380bbb1be46db81cf42

SHA1
c8202e60f7f49c1c2cce958aed3e2f1874c7b1fe

SHA256
90b773cebf25420c2cd2ebd126690ba881b8ee7d90571a327bc4eb5e53bd9173

SHA512
d893a8445ae24b3f271369bab6c443e92a657d1bcdaf3fb658fe02fc11669883c467e086596dd51eaa07f81158cc4fb72dd4ec67a06bf925416aed2ec25c7e4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12d67aeac1db1d061109b80861196fe

SHA1
b51a390bd488ce8b2d254907d6f51eba4e33357d

SHA256
6eeb7930514c2fe1415a8e04a3e35b41126384cfb55b789066d6d93acfce863b

SHA512
344c93dde5dd1fe62e41bcb1958884ed5d4cfbef37397af71236c7bcdcc8d895ee1fa45cfb7011a4b830b873c46e05398e8e73e9bbd7e317cff0f6f1ce026db9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08975b94068fbfbebf2dd18ba9a767ae

SHA1
2c7b4d38f1af60ea176458f331bc531ba849ae1b

SHA256
f6c465b35091b8bd73b7324fbcadeb77011243a20622176624e85ea2d39e9e4b

SHA512
7a19385add86fe7b63b3e029d6c1ca910583587c4b43764b5ed8e0bc20cc8d99f1062693455480dea437233d05b327aaba2e4ffa66b7d74742316cb78bdb2f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe31fe7df544b0227c4151f925318686

SHA1
535359d11452aae0281a203a8e8d510ab4fa0b27

SHA256
ff878d2a5a53c71b167f9b01cf0d9f70705b51a9aba1622feceff37f334b3d40

SHA512
ec455dadebc0d23d66b6c12a8034931f833a969832b02906fb7a2ee49dac0e63c1132e449eab087600647537ea68853ef60e29fc0fc9510dfc0b3057cb635a4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d4db90117e3e3fdb360d5200d69734e

SHA1
ac9133dc4a345416b0d0433f0fa7b44cfc3f8aaa

SHA256
45574922f1685c950dce4efa561517b62de3f4d11c715bdc309f08020f48d042

SHA512
2cbd6c6873fd0c10c04e8fa8b418b2ef448a208b1d46e7603243808d53a8b801c5a804f1b11e61481402cc62d834f02efc6ac67d4087d1c1133922552df69ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a499ec1058a26e5b2c619f0454b2f1c1

SHA1
ff88595d26550596b5db1dc48edc3614eee832f8

SHA256
d538b167bc73a751258cd0e710a08fd08eddade49a98b2e84b81e3e39ac947aa

SHA512
a82aabd638df234446bbe358c5b4972ce4e39dd0fc7908937d706efe1fc2d4b339dbf7df17457984995a26fc81ab963421a2e8112c6fe79822e71a5d55de80e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cda2733835266290b8b589e412b35b5

SHA1
439d2c20027ff545841414808cac3ae3cc3c1fb3

SHA256
b7eaf4eb853f8ca4e9eee75d8524af7095a93af45d1bd3ae69e7919a9134a7cc

SHA512
5469cded4861fe37a763b602897d31f26cf251cb177682d06d1bcd45f356892564c60c09b80e7a5e7baceb288ddb5d9b98d9c8c081221c75f19702d63edca754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8db3ce2273eacfebae289ac447e672e9

SHA1
20c61e174fe6b82d7d3d38f90bb974f51adf6cf4

SHA256
b214d3fc82b1b801383a3f534e3dabcf2409c3f701e1f85db8919865634cb31d

SHA512
0bcd31fd62abcb8a85cea58509960e38486f1191b1bfd5dc92c12eb8c8c1ed8fd3e16ce1da98f086db1583c0bdb147409bd9b8ce98177af2ce34d37d1b192ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4014c3154c0ebb28331133ac6b4b359

SHA1
d42c7d5ce457954897d5795951e41e9136a9ec44

SHA256
dc59dfba5b44f89f8e4f6e7e932e46bfa9e0a0b6930c36f5b78a6f555b766a3b

SHA512
689e00f10ec835f9dd2277450d8dfaf7926c1de307f849501358356557e4daf861f1db326c760dd66f696c36771047fdc4f5411f1ab03059f6cda4b038de1d18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar919B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit