a46115fd5378b994469e5d556b23f81d80ca41d4a89f63cd3741958ba73adab4

Analysis

max time kernel
147s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03451c03c03daebd9e89b50af8ba4f74.html
Size

19KB
MD5

03451c03c03daebd9e89b50af8ba4f74
SHA1

0e5ebebd746f372f113805813ce6eb780994df75
SHA256

a46115fd5378b994469e5d556b23f81d80ca41d4a89f63cd3741958ba73adab4
SHA512

43bb5246d9c66078da8fc390a0f8af097726c94e0c6e6dc9b50e5b5de4fd6b675194e971485f1ff2565058e437f3ac328b963ea6ac9a160cdc0f3598eab50423
SSDEEP

384:QfRIjUDGO2G9kLL9j9F2OzngFJ5XnPhaI6HViB5AI2jKrMKxvQH8ARdCjeFhZWrj:QfRIjUDGO2G9kLL9j9F2OzyfhaISVir5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000009633889567073ce9594c0dac51c6d2e1f78fea194c87fe841ff591e2a6e7ee6d000000000e80000000020000200000006585e07f0140a2c8728d8b52760c6c1cd7718e51238321862b2899e18ac5ed75900000009893f4c4e2781afc0360ee22d9063ba5580250ade7e658901105e7402c8546d0333c4e7b29e62df989ddff28778dd76b78df7a7fcc36a15864ea098a29773a4c88ff1c82c9c31257ad7ae5e20382207ee6b87ff2cc747dba4a39c62d8f82113c7de6f144c3ec6434b08418edb3aed4e4ce39064f5acfcc7ce84ba246f07f61792f00270a3b74cd4c8c1f1f73ddb7ffe34000000044cb7010cbbad08cbaea7f58b1c4762ca0767ffbe33548fe69e5d18b403890280cfa4650d8fec0c621724163ec62ae57f8efc7ac86656c1caf507a0adaf23194	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410053349"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90E4F901-A69F-11EE-8C17-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3025e386ac3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000a31ede52ca5b572faa27656253478b01395709e87477993b13b781a331b96767000000000e800000000200002000000081c2326f20689f98bc5fc1704839e99ab6ac668955ee61cbb82cf78679b6ebd42000000029d6330b917ae29098e0d4b2cf837e11ae65ab7dc9b8d52cf8401b75870ccb7f40000000084e03822cbcd9d7ec510299ec506bfcced371f8eac209a6b6a8059341810e93dbf219c47937d7223c7c7ce010274d4c1a04e17d1e8a982998daa0e350463227	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2264	2132	iexplore.exe	28
PID 2132 wrote to memory of 2264	2132	iexplore.exe	28
PID 2132 wrote to memory of 2264	2132	iexplore.exe	28
PID 2132 wrote to memory of 2264	2132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03451c03c03daebd9e89b50af8ba4f74.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e521e3024c8fe8b98a5ac386feecc378

SHA1
f3c66496c2851934bef607df77688c90966257f2

SHA256
20abacfae30c2997afb5157bf2e35323e82ce68baee732b450da178d12cc8f3e

SHA512
b1ca92dab4eed9c08e735a530a471a1525e88eee6d371fb59f78ed68f8ffb562d59ad9ae6c260bc95142cc7c635c642382351160b4f4795c800fd706d978946c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d175b62609bc5adf3e64eb19487eb00f

SHA1
30918556cd41bb9c2fe11f704ddc9945db3b7702

SHA256
e2063eecd9678ad91a41264253ee0af3985c6a2349ed066010b7777edc8a73f8

SHA512
48660cbb8bb2793891bc82d08b9c27b479cc44620f42c147a85343dff684ae6cf1e7ed1723e636d76a4ca6249fcbbd267de8b71b9c493cc0d756e973f631529a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a9c9c745b4ee32622910e554686de1a

SHA1
7ac8f701fbfc253ef5a5e95fb7dd123ba22d18c7

SHA256
2993135b448f33eaf565ab91ed8e7b2a2d298ca6224786473e84d1048fe16c63

SHA512
844f0430bb772bd6add9fd6c448ec503b863fabbbd1a78df16865cec25abb70ff3696c0fad0c0503a5abb39783290ad8a9a10105bdcc45926655a92b581f8bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e83db0a8d99cdd34297da514d8c27e62

SHA1
d1a497552b409895577d132924d8b9b199a0f8f7

SHA256
44b4e36a03e5b7139c76e9fe72d543f5d0eca711e413d17d49722eb66cc5a5da

SHA512
862244e38b184fcfc90a32f597354bc19d45141f940cd1185e357e77dc1984fee173817377da0c74d77fa8e0ab7b6f7f871824d7e3daaff0c91175d8ec8f7f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3fad47b0ea38016ec60c803ab6f4a54

SHA1
53941e0f112253bf5b15aee605911fefc829a2b4

SHA256
46412a80349c3bc3084a2aa2772d966909526462d705fc95c62f71382df28c53

SHA512
0625b1ccc17f07b67216930e25ab9df272df8802117390a1bccbe917fd17c00863ed368bafc3c72de259918843ce211696a58a84584266be3c4997876a79baf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b36a8f27e722dfc6ca896a274182ccb

SHA1
15c9a5f55857bd3c7db5542906edebea805a7273

SHA256
189071cd34e4121fdf167d6f0324bfa5ac183c09c13e026e92560e31987d7c11

SHA512
cb1120070df4a0c7915f4225fa9cadf2962486f8764d8ba9bb98535f85a5416fb67b6dfb577d2ca78fcfc099f244aa6cb8abb04ed16feec9344528c0445b4b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9213dd351693b34dcc0f58f32e81dd49

SHA1
1840986d233bbbe36c24f74291a7d6b07399d644

SHA256
626f4673ec5be50d9f0952d1f2732ecd60f852d6ac27a0b2004c44852c79dc75

SHA512
15e4117caa6a914aaa65c3c91f05ca0816bf60d7b99975e3d1a5e688e5618d1300b9e935635b4ba17e892d5bdc7b3906e6b4c0069777d70a1185da7fc10beb94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
913b10bf8c9f6319435028313ee78c4a

SHA1
8a07c305f5b4a48cc3775b89289e8d13f6ac17bf

SHA256
5927775913557be1724d43005b44bf5a9e28f7bdb3b6ac406e6fc400e9007483

SHA512
4e4cc64ff0391857f4470d64f82aff21770e374467c2c570b2c4a8b68f3e35eda4e984eae593730963744e3bbdf2b7b7c77baca47b393a6f8e4c87fc2d6b5650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
004a59021a9033cc635b36a8475006d0

SHA1
fbe0207040c25896b5d6f22a4f078bd1babb5ac9

SHA256
f0b3e9fddb99e1594c59ab055710c5b444fef40389598a1274219792a3574ce9

SHA512
00743dc202fe0436ef27abd98d0e8cca19b34757db3c5ebb1d37958a27ba46de5043367d47b302da115254356dc93ab7438f79e35a70ad1b8465aa56c9e60908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ea41b0cd503f527c40eb97960919327

SHA1
88584b6f466b92ca0a46201292061b3dcadf9f69

SHA256
4e60477d9281fc71b8f7841f868fda3a411a00bfad42b3841a1d8f78b9368c8b

SHA512
b19fa8f0dd143203cd6aea903f45e093bc6e3bd9c0887fa3165d068749d58b12bb62ad92aa94eb796776048ce772fd259e6d53c95ede3d7c4c8b598db49fbb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ae20cba60319cbe062219e53f25998

SHA1
d24322c4270d9da883204f36b7251bbb80fca069

SHA256
1332b6bdcec939b87631174a55f6a766d77a775780444e6711a7dd747af118ee

SHA512
8abe064365e91e8a8c0cb9b300941fad0dc2025490d9772915d9a7394225fd0e9119d92fb37ce58824dfbb2844bf1dc368f5b0691c90190efdbf9514e0412750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53ba60c47be54891c45732c24844832a

SHA1
42a4c13342561df04bc3dfb788642799f23ecfd5

SHA256
fa398b3921fe2f2f03e67cba0a0bb9cd783748e5945ab730c5b556b510c98e2f

SHA512
48e184a09363f3e108b3ccf14fce3bf1190162cca30bbecf417a0bf05088945f919eb1c3f46e0a2ee7d79146a19fed94f078646d50f29f11b4bdd5065bcf1122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00d5dc7673e8ddb8065e3575242f69ae

SHA1
dee85bd31c1f51a22d8f01d0999da273cc84b96b

SHA256
7517c2af8b9a5c4c1741a1a0c71ae175a083a28ffcc8bffa6ea68db867a31218

SHA512
34e39948bf8f82daae1aabae341d3f16cbaa1dd1028928f7bb2d471335a09f38a22507ee7b0b8f6b3230183fc6b6036f8d940309523034a529892807270cdc78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efb5490ab58ba7b1db011e2cb629339c

SHA1
e091b80cb5c0bfe31df04cb7b639359b88e4eb12

SHA256
6c06d4764c94e4bff8e3bb223d4335ffc0bcd0ee2dc4205d4d3126ca05d5eb8a

SHA512
9fe3da9d9b33ea361a717f14ff207d12d83e65bc7eea1bc92a2d2c2c6aad1bcfc4116371c92fe682926339fc5321dd87228c5faaad66264005cd70d3f20239a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fa14ae90913c2a9682f63fd10991364

SHA1
b855564ba9ac0e46878bf684ecbfa493056b3f69

SHA256
a057eeb2f7cad11246c9d905b1f192477917a63529bddc0e10e450545c58873c

SHA512
977eace111b3067318cfba915a8324ebc35d00fe8235574b3ebee6ce9298c26ec5466a4d1fda6294e29477387edfd0da6fe207a94533caedb56b8c099e7f50dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92B0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9F12.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit