2b501636a078d162a7bdf87571e529d6673ad7cb66791e28f71bfef98b37c747

Analysis

max time kernel
118s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

041b25660af930b72a01bf35b4ccf5fc.html
Size

12KB
MD5

041b25660af930b72a01bf35b4ccf5fc
SHA1

922e01e87ea4933729b2ab022d087734af9aa57b
SHA256

2b501636a078d162a7bdf87571e529d6673ad7cb66791e28f71bfef98b37c747
SHA512

5de76f68d53148a378628792f4f4340a01112b3fa7fbb47ac796fea24bf9ae78c2e77a6477c65ce507ca1742b0f32fe41270be91a536f74f05b7a40e6328dda1
SSDEEP

384:ln8uqnGDnW0qHTzVLDCNEhvdMkzs0KcOFiZKa5U2t+PdqFFjdjYdzf4A7TZuq9Cv:ln8vGDn+BDN37MfbfZv3Q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000000829c14af1df8cab7ff3cee6ed023f483f541a9b67cdf077574d8d211f85f38000000000e8000000002000020000000dc401f84c8e9593669ed2a6a6cbebbbeee858bba512196bf057e751e99974ec5200000001056ca374d2d45c3bbbefa6c007c926b9937ee11c077ce43afb6ebc82c5984374000000072ff01e9a40ae76fa81edb9ef328f446d0aead7ad15208976e1349527907cc0d7db0b9b58e6edb122b6c283f8cb6f69b8402882a1b69b8795ebc133ae43e0112	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e413fca945c8c99f79ca55749bef36e51c02b5a25aa68885c3098abdabd9920d000000000e80000000020000200000008dcc6fe282a5bbdf8c7ccbb97aaa5ae261cdb15685054ac6edbc26fd0e7ddfc4900000007b1c4e1cf6ae6d006b9ef672f4713aea329e06576d4260d148b791124e70a9aae2e2619bbe4ed2e444d67740453a263580947372746569ac329b84e5becf3820f16d9b3e646269344f5a82794d3b9940531377e79c8e3a458e1b329328a4cc42072ac51e4a6235271cdae34b33ce575bf85204cb578ec01e7b9d3b44ec26109fd77e2dff9476e981d1f54d2c6a0d8e3e400000004b5df996ee0470c3af63762a0f3e4c48e6d81807e1e626c38ea287e50f0b330975fb53699138431af2bb6aae5b2559d15b364eb8e7eada9a5d2edfb420a3cbc1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410072892"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50220bf6d93ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1216AAF1-A6CD-11EE-9BDC-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1244	3020	iexplore.exe	24
PID 3020 wrote to memory of 1244	3020	iexplore.exe	24
PID 3020 wrote to memory of 1244	3020	iexplore.exe	24
PID 3020 wrote to memory of 1244	3020	iexplore.exe	24

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\041b25660af930b72a01bf35b4ccf5fc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd4303ea32ee8149600f60b8b885872d

SHA1
628f0ea10e4d99291f2c172775c107c91adb1ef1

SHA256
e20d4dff6fdfeb57957b03b40138b7cdd704d0ea916e041801feeda4a23097b8

SHA512
60c31cc77e659087135adce91ea0acdffe77865dc7228ccae7f766c23bedf56f9c95c5e2f512611b2eed6f47e845ac2a05ad97b00e8dee2f37f48f03c727c285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c728510e686e8003de26d9ed28252ec7

SHA1
fbe2aa032bd0f899d8dd98e346a7469569708977

SHA256
dadf41808a65c8b9034661390ec915697745cbf5c79c4ea2870c90091da8381b

SHA512
dd45208736c895e7426d20705d3f90b87081d7e921a69a3efb4592792aaeae5e12d9718fe3372845d067a406057d2ce0ee9eb796b4e597b0b6b81cede75af8b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31368cbec02733b7268042dd75211c07

SHA1
90617c1b465c24d0182da7c4ac136368b09f4c9d

SHA256
7a8d391a1fe4b32680bd3f78252f43e9f8343aa75d648b340d1bb15828aaf896

SHA512
a64caca581d6c2d47ca296197435bc4f0ffe0d5e4a7ff467155365f9925f9d56b710d27b7026238313496c43c8afeab722eef77db4e2eecf762357ec134b2b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
155bc8d0950bd654fca8035c36b6e40a

SHA1
510cd39b8c310db3108ce5a71328b4907eb546a8

SHA256
85386ee58f1a7063364e8d778296e2f7faf5a2399dfb76631abf9d5ebb5a51ff

SHA512
a7578168ae1f6bf72732039fed8137b7c2cb75cadd0057ba081a1de0ef355833aafd3e0fe3f0aca28d54e296390f2c9d540b416946a47acbf98b0b01c5596768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91c984dbce53473f7fc0c3fe232e990b

SHA1
52f577089a81c0cba78d3531437c93bf6b0b33f8

SHA256
1b630f5ff19a9c3da7a040f4e4d25edec01d2fcc3fda3d1af2229af626f7de82

SHA512
caec2eb4b7a858304ed2e5c7a6b1354d157562064e0d8658ed07cafc963e23b702984ad4a9bdef45b43353d3f0d4fd3a93a0502a8003948fd79c4781e96d34b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d81534231ccbb8d3e53b4bfba07c40b

SHA1
2b88d9bb267465756c0ae6dda5b26936fac94c9c

SHA256
03f227f9a38bb44fdf3b49e383f6eee4a6ce053ea2b4a613524e99a345766440

SHA512
27fb2d4d2044a3895186eca0c7085ccc87605fc02e417338855be8b08bbf80cbe22fb5131edaf496da6700db86afd37d34b9d0f3e02862f66af08da1321c75e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cf698f3b9da71e0d694f7b0c56e2dc9

SHA1
9af46994728c34fb26b85ed90d97f6b9f43a25ae

SHA256
92c33b059cec49f8b568f053a2fa239176aa166c8a5d566998d334ac5b2d56d7

SHA512
b21fb530df48e8012186704433085837fa2424c85165651fb0fb41d34778019418cc6cb0c4513b1cca3d85e2e4bda5d749a32c7675b71a69b94bbd7d9591333b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8d59c96c0ca5b914eb750546f4ffc82

SHA1
fda00f034164a4405804d1028a7bc458855a2534

SHA256
908e85d9406cdeb5fa6696ba02afeffb6ba1799d976dd1bc02dbc5f5e932fa6f

SHA512
0f4edbece32f787f3c1fead8c05e307e5d005c64f96457fb9adb74e34af1680e563fde067da05006d5f8cb6c6f92db00caa8b27eee8a86e705292de52e1341fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e89a80ff35b551e65228c63871130687

SHA1
afb67954801304d346c4635c340ce4bd5466f42f

SHA256
80851fd84eba733c8fd50dcb487be7c3be91843582019e7b5011f88d2e3b28eb

SHA512
ea781ea8a9d38ce5871921b56d650cf7bdeb9c27e17c778d560f236bb19a3a1fa4469c80619a78c6d30cb05608651e651ab26c74c2ca24bb3290de114bb6113b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e8acdaf7533d7cd1569c09a78b3c95e

SHA1
795b1b001306aa77639abfd2482f1d3ca2a74264

SHA256
838fe9d5770c5e29dc7a1fb4859a95a66e01912040462d573a43c44b8811749f

SHA512
a6298b42e00292a054cc52f1c413a09936ac41dc80a1b2d24aec7bd008a58555c371943542744234483f12eac3e95975e8900a75ad5ff89d5e478609e00a65de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14a80770e746bb613f4a77b89930edaf

SHA1
4eba3141244151ddfc29d27ee716853b5311d9fb

SHA256
5309463744f36c3c16ef44d4ecad20a21bc293128b1074f4ddab0ca333a2fc73

SHA512
d7aa518ae2b7da5d820affc8580b6e88a60a81046f6893c319ffdf958d826702c233dbfc5ba855e0ff89316324e8d489700f52f99b5741cf7cdf398bfc5a7d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9bbd5356f5457120d5c14214ed48b1a

SHA1
19f2ee03e7ae6f33904cfad14980acce0a276f7d

SHA256
e27326e13884e7fc9c0ea8ee807f349d17562c45d8a5b7b280415364bf65f3c2

SHA512
28e7010c9ef00555d9eabe9c37a90d89914c8d8dc5ca7af8374ab9f836437059632c935e6a54c85354234e4e56bb60f6379e08fc79ffe2ce64040f74fd5e4d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
888f947a3675a573ee3f1d40012ca1e8

SHA1
1348853774d31307e76fac647cd8ea580acc8b20

SHA256
abe5c01705d262b9fcca5df45e8316f2f1a31b587a0bbf954b825ec938118abc

SHA512
239369412c3a047969b1f34de6390184d7a84e54b18bdb88516d196a23c08f6b2545ad9bf8bd3851db130bb9b8cebcc895ce72d2d62c50b6f116e2124182c438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41f167e142c21605ecf439a23bd5ab11

SHA1
70208a88ff81dce60ca6e8b1a377bafe0f1f8b8e

SHA256
4cad8c78c3c71c96f32e72c452d176e0ac9db108879fc80a8a217dc5470c5bb6

SHA512
810ad4789cc86246cda43c2a1f0359aa6a6c19f84e6232dc8f112917b36ad46661cfd2001205176aeecce93717aa81c58d118b3444a86fd11f71bad06f69696a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c7d1e1f63ccfc53ca464218bce2da50

SHA1
ff8e0313cf0e2cc459ab6aa450313b75e2a2bff4

SHA256
73fee66543feb0394b880a90936724dae8dbc43a20329626504dc35126cce584

SHA512
c536430f5fadd4295b285d729f203645016dbdb1f91aa44bd4236d2fb82b46bfdb5a2a32e9e57be18164f9a604ddd9843f37c82f2f760a2b2ece892d574bc64e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1df2968d4da4fc55f5025f782617a3fb

SHA1
c2e552d7c3704a40912f606d84ce3a15953486c8

SHA256
5400db79b6ff30156f59bd6c555a16b2bd2ed901bd9237e906b1267618889c87

SHA512
22d6d1955bda85c95102c6f50d28471127533c1ca1c19a8d08072440227537a8be4aa91457cbfd8c3e6ea78f57d4dc87398d2c0878d5bf82cce6b7fc04e16978

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB55D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5EC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit