553602571f961c11ed9da8914fcd81d826e8e177275696cb0c40194d3a828550

Analysis

max time kernel
150s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0242bdc65ae2dae20db66ee8736c8d32.html
Size

8KB
MD5

0242bdc65ae2dae20db66ee8736c8d32
SHA1

084dfae0fe223c2fe20479e2ef0076b4a1e72875
SHA256

553602571f961c11ed9da8914fcd81d826e8e177275696cb0c40194d3a828550
SHA512

28d5d476845339d431c50da9845495ab6c95728daffb4f748e0b0f4ec07906be8952c1c70a6eb8c979944fdf1d9bc892c19e9ff6b922e76e68fbd83eba8ae1c1
SSDEEP

192:FOZOfeAMRyibW666lSs/ED+Z4TRf8EhkH8WMvSlml8b:FO8fRo9eSEqZm2QWM6Uub

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEDA06A1-A698-11EE-A57F-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000639b58a37d294b2c012b15da9d222ea3c37b4567c668f63233205614dcd96544000000000e800000000200002000000082215057fa67ceaa88ad9ed0d5136a3bfacc470478259c8405a36b093e5d7cd79000000065578a347bc6796b69fd4881c54e4e8383a4e1c7c9ab9d9ea2f37b4e01796be7e29130100a565e39fab46f885003e1106aa26c43f9f8bcb884ef4e9871b69f34106582d0c498d839bd70d0f406217ed737aeaafce03e548dfe10b85d0d4afc4d286fd0e2aa8f317e6ce1c6ed860856c5ac25db4970f80a2c79f5c7c9423cb28c4385315adaab6b5753803d076b024f3640000000d34c98107939b7267f320b99402b190c123d74aa930ac274318b32b461fd9332aafb18f34fc9b28afda868c86137bf77d6615cec88222c26cd88e628e5d48a80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410050402"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e1158ca53ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000634fa1be1f3838e0f22acbd99fdf75b3dc46c61b5159ce13123bf8a04c334fe1000000000e800000000200002000000030a26eff4545705e6e82124eec6fad5fc686b60e23581fa5388db6755f6058d920000000b053c93f6f840675ec1010f90881583f9d36c33a13e252d5c88637d79557eaa940000000bfccc90ea437199816c64237f34887b583b6627b18d52b7fde9a0811782c1a8a8cd721e197bf8cb35aa51850cbcdae9785d7b9f81f0a0550f14dccdae31a02c2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
320	iexplore.exe
320	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2844	320	iexplore.exe	28
PID 320 wrote to memory of 2844	320	iexplore.exe	28
PID 320 wrote to memory of 2844	320	iexplore.exe	28
PID 320 wrote to memory of 2844	320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0242bdc65ae2dae20db66ee8736c8d32.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d79b708fe396f2d31060659339f3471

SHA1
6a20fb804a849cd96ff155439da4a3169c809c8d

SHA256
e96c50d3765427b9ef5ba384c7dab8635324023177cdbb647709c3b7250b0b0c

SHA512
680bd15892d4b5bb09f6d2f1ea396d3cb6468d808271864df3bd0a233fbe54f123aa6c596194f37209f3f4121303dbbbe254453c22c005503f64017028ee1940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf44a35b88bc9fc1679bc78a154cce7

SHA1
0192814540b7413536c8d8586970c5bf760c2f0d

SHA256
25e6064e1deff358e449568ca4712195c25ba6cb02426336946171cd7e77ef64

SHA512
1fa30c5421a0556f0aa42cbb9bdbb302aff2c4aa2511d0b7f12393d35813b55bccd68892553252f12593486ce21d4b0c87fb8530319f04c878d52944af740211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67b76222b9dbc51c852301d79f2a6463

SHA1
27084e89d03f0fd5b2e1d1e6830ad2df613cf3d8

SHA256
fe02efd55c48776671d11e6e2102c8f76a8dc61c78e8e2caf31af98f746a523f

SHA512
bc9c3cf06cd28d1483183f8334289dce15e1b7181b042acab040951e599c03bd2697331caaf6dfda9337c7a8714aca1559980f293163b5259532b0d4237ea7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ce28215cfedfd4ec87e61469f19721c

SHA1
d68231c1796bddb3b175073b06e8755d383452d3

SHA256
19b7aa2de00535b1b4dffb3de2de31fbd2bcbff76f8d8d9cff64e9ec0571ca53

SHA512
65f1e554550b76b25b58c1d4c81a8674d0883f3c4560c7cccdc4db51abba5e3aee03d8ccdf78c6604cfbeddc2b726abbe7174ed66db0108548c6df287f8a1da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cc8054af3939961c22a9f3dd79dcb94

SHA1
bb808865e16a4b495cc1a2bbef07664a0947dcc6

SHA256
779c975a735835702ec3e862f0020532a2473c0cc18b28e358e53dcbec99bfd0

SHA512
5cb5d31329c69b95a225cdd63bc7a132c181c57172a21af644e904368a718901dd8d45555cd9eaa8b4323c00e89ef373f5a67ec647dde456e1f8cbfa15abdcaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e330c650eb7a24efaf8f000712a61041

SHA1
964d76ac25385f7c27ff7e6f317e62fe492236f8

SHA256
31d8108a786fb522fc25d1c4638e244b8ac7543938ee6b78450ef94723219dec

SHA512
0b6b165c890e7d6cc5664bcfa0e9a33f4b4b578de216c3942a9bacc766b37e7f2f0898283b4618691c56cda5ec1700d852b0fd42fcdc6b1ec306c2d2f274a2a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f34a935da1432e53ea56d905c90958e

SHA1
e5608b9ac218864eb2055efe7da6eecf455b382f

SHA256
f0452cb14c9dafc5f0831600148e557d1acd18c6055cdb0638b21dca51381e3b

SHA512
0ee93a25f6470ba68d44025613ec8d88418135dfe59d31f6ef0084eac332904ad55b783598dce214d2fb029db38db736d346e64367dac9a8247ade3a5d7413e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4d43bb72054fa6e536b16936088955b

SHA1
c4afc58a15a574b64be64c08a967aacfe8865b95

SHA256
51ece19a15146c95fe15ef7d65c466a13f2b3577b772c15cd6ce7c120a364b4d

SHA512
c953e66a54d48d1187b7e1ad472cef05ff402c2771b840f7b32d70809751b64b13115a0b6aa6b7c3cc35b9c85de9900289993bcb2af424d5ab57b0bef3d2b168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26b1f74ff08e14313a0dc559046f2e73

SHA1
8e243ce8c1c3e250b80e9300bf68fe79c9a1230b

SHA256
52370055b7a93948a7a90b9221a0eb1f07d0a71307d7a4c5e5d07c5b6b403fb7

SHA512
3f655c893db7c5a5cfa8a12a6996983dfed56572fbd40898f2473f171165518d8ef454b7d50022789d8048bc31bcbdc288201758bd3e21a3698541388c4aacfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ebe48b72d31f38a13ffd08ff6640b3f

SHA1
bc3e18d11a5d7b644171daa19bc3d9049c134dca

SHA256
6f66720134244145b0b74d40d7ca24836fee79f7eecd0930c3a8f4bfad90147a

SHA512
011e5bd99db0e75999a6727bc19f69ae86b1e18769380e6a676cac11282fcb397cf575832203a41229eefdafa8883cf2677a316f7d51bc7c15ed6b43cbe6e26b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f0976b6950b2c1aa674f925a965b691

SHA1
2862f42fbc0bce66838a0ca32175be8ea84c4578

SHA256
96d54f03c6e473d87281ab813e7f028d7afe65237b1ca55064ecd0adb417050e

SHA512
0a212df707ae9150b6f7d7606b27393d95cd9c7cb9411bc661b5aedbf6d65d2b6092302d1c92cbc37a51a648b648e0f022c21582e4340483eb1f4b22e364ea29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3643b9c27c090096f7033eaa3e988612

SHA1
afef562bf1a55bb642dcfec05c4f51b9a38e5d7d

SHA256
2298c36b24ffd89083dd5d5d6eb3ada99e391f6d94266b0accf7ff1156839a40

SHA512
b19d6a7483c325baa85a551b4b04643412b1e1036b8966e3be3c10815efc63e20175b40e322f1edc11bff4369533c2c0096c9d4756dd192ba29c1b5c06ec5853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d0968edaf1d9f7e47887071ffaa6e57

SHA1
a5afd7ee02163bcd84776a19e68d08ca7867a504

SHA256
edfd21837b36212425e834ce732e416d749cf70b9ea4dcfb71728262612efefc

SHA512
95aeaf5f54c3e65a2a63da98a7b43b3676bc4b87d93931d6bf85e9253fa124237da8ed025ece2c469aac08727dee8335d04bf74768447f80f71ecfa8627820b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f15be6321f5934b0e98fdcd39cda39

SHA1
d4c488e25301a5e7b39bbbbd85745a6815b9a076

SHA256
fc155d9c2e235d15a32e5bf0dfc28095f47df390c75d61d7629146c3f215fe7d

SHA512
50c6f264a6c1f3d0d54e7264d96049a74b2484105eebb5a7d6980e92842204d11a30ae8870113cdb69125cb896f7fd070afbf19ee62ab642d0176e38c24bd464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4907f7ddb0f0b4b47010983a43975978

SHA1
3f477477498ee761def65fd57cfb252791448bc3

SHA256
4c978f5996a8bcba35caf5b059d947369dd24470a14b7ab9f2b88babd4a0e25f

SHA512
277d12804774c2458bf2046a029f73ec6c88c8dbc8beff9c62dc6d47fa2aaea000461e902337b577318b0291a99b067d3a34a6520c9d9f8109dedbbb1fd3c4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03d21dddc5f631bc9667307d6e8b2121

SHA1
5b6764d38607bd15433f27b1e086c655bdc6da5d

SHA256
3e012ffdcdcb42a9d994d13af85911bc7f1e3fef66e8a1804eb9d1b5f0c820bc

SHA512
d8554b3a41366ed5391d8d036870c8c4142b9aff817d02059b53260401ae13e1bcc56b5c6c33ee26b609a3db1bf064475c101240dd3d6e49ca25d98f53254d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE092.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE0A5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit