c70f395358ba20f424f060cd418bab1a5a1d1c8da079888cedc349652aad2ad6

Analysis

max time kernel
66s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d2320d8be41c0840108d418e19e35ce.html
Size

14KB
MD5

1d2320d8be41c0840108d418e19e35ce
SHA1

f9a87c1e671666070413a40d40661eb89572299c
SHA256

c70f395358ba20f424f060cd418bab1a5a1d1c8da079888cedc349652aad2ad6
SHA512

258942511d5d2e7dec70d78313d6bbd80efbbe0b50c4e28923ad85bc8e23535524657ff847adcdc7d7c268210f4d81dd0d5683ea3f43a5a25b6947a686c0a7f3
SSDEEP

384:djnTOk3OAj6pP+HrnbtmygjnTOk3OAj6pP+Hrnbtmyv:dPtmygPtmyv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A5BC1B1-A86F-11EE-8C17-6A1079A24C90} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000d8b156d229e019fbf932dc13336f664c5dcd9f592a8fcea2220fa83703b9ebe8000000000e800000000200002000000067f1d343909e29ce0981f98125620d04b4f721b0c9bceb081505a03388382a282000000086e5a1c107515a21a98115d78ac8637a1480e5f827c65569f3d8a0d573b4b3dd40000000c99f1544657e782f7a419d9fdda0cfc816f8628d3d387b7e69ee732eb05d75a4739f8837f36e4619251655a1003497bab987297c97ff9621b285b8a4d8d41ba2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f6d113a5928e5075b4dd5c394216cb626f628b5b7a87ccb90565ca74bb4b3e86000000000e8000000002000020000000986d42e33345609242ed5c631ec68658ca9a6385de0aa58509ecbfe17268761090000000af13fb3190c43e7ad9f57a3a1c8f8363fee9c179a4285206e147e523d28120f581f703d2245477d5ca9249bae5e4acf8fca90552e0270098090daae998f9e7df942e01fcc02c6ee5b7bfcb41dca5438516e97dac38bbd464eb9b1bc4783a356bf82d8405019e2e5587db263682c1f77bc08292502423fe0e2f0d2af696207dddb318635cb6a9ffebf2cdeb4fa5d485f840000000a6b3bc310fae232ac7ddd5ee906da9e284c64e87690aad1476a24594d834d35cfc3c2b6e75df27af79d982ece630d6c533b268a0fadc1d81fb34e344cd8f0616	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60852c4f7c3cda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2828	2132	iexplore.exe	28
PID 2132 wrote to memory of 2828	2132	iexplore.exe	28
PID 2132 wrote to memory of 2828	2132	iexplore.exe	28
PID 2132 wrote to memory of 2828	2132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d2320d8be41c0840108d418e19e35ce.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25b224ebb571ecaa4565faebc4cc736a

SHA1
8552bc630170bb7a935cdcde76cb8ecdd2b0f13a

SHA256
656037a2575dae4f80a852f19855da824e5ad2059fc174af1b327ec8cae42aef

SHA512
f664eee178d72cf88320c7579b04e90f500e6f1e1010ab2adc53b227bc7bffbd198a060f1066acbb52de07dbecaeff3d1514f171dbb818aa59f1dcc5715cf620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8c812ad61937bf25000381dc0fdc170

SHA1
441230a3aca7c0e45ae50bac56f47a2f1ca592b8

SHA256
3c6a26c5262b46962241a50181e0fae96f5742aaba5d3e68138d78ff6b521f6a

SHA512
6974ff4f33ae74b3e6ce3883742bd1ddaf2a378c9b276e51e24aa644bd62ab96f31e92a75ec5066dde10e2960c6b89b6d1f44dccb0e7e4b058b0e575aee43fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9882268da71935c1cab9580ee6bf94a

SHA1
f397c5dde3810104aecd3b8d2805bad4e5e5e0fa

SHA256
4fb608c7dc832d0d098a24b3db953f26d69b87d27ccd7fb1beac66dbc9a8c397

SHA512
74ac7a68520ecf8c32c160f0fcda45a884a86b4c8f727f3e82e81701289fec5c118cc77aa7ce1f766beaea9b94a085cfc1b8ee03fd2b3a9a932d1753315ff4ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db77c0bdcd6fb9f7b6a771de0f23d065

SHA1
fd85ce3090e85660f0f87b817f47aac905d44cc6

SHA256
e2949ec13aee93c6043eb23d301ec0fbc1c50037a197fada3c4da152d34b485d

SHA512
2ada5df92605eebb62f80bb92258fe3885811be7c35f867a6968e47dc33493c3d4883dc8deee1eabc5f1ce18efc8620a83abce12bb2c15401a2243973b39ce0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb0f96d3dcf380cf612d252deebef0b0

SHA1
bd55ef42796cf9e319c7e0928dc312e7b16ac330

SHA256
a2b1c4bb9f2fc570b38e56b9742d78bce71c5f901a2848dde0e02c1bd903438f

SHA512
17f36e98fcd50a62911e5b5d3a070aaa0023dcda1a1cdb5966a469b9da9c2e49d18c334b07b0c3c2655d5eb786158a8950647ff0998c0d2be4d37ddbae1fde48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5449f8b9c8bb903d663b264a0b84fdb

SHA1
bd55bd19b6f70158d6deeebdd6bd5f3c98e02aa6

SHA256
66fcabfa613949eaf3a246868f42115ca99ecd667ff2f06a86f926cfc4c66fba

SHA512
90de2cc563247eed436f949a3d70f3cf8256c44963e46d638ee8556e43379ba49a9e12261821d6e7e9eda944f0b45753a5888c3980c86f883cf289d6d85130df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe8b1e04fac1b22310f8f1fa0f1c42f

SHA1
5ffaf5e99ecb6ce2a990ec8ea6fb8bb59f2ae2df

SHA256
b27dbe4ab26e4ada34caea9819c365008efc0513cb3c7b028aa7969088deea7d

SHA512
00275af18a1856b1a6000ca30190af1a4adb081f9c5b25dbad54772259736ac9d778cd3e68e3c07c3f24b5a08e06e23861327855c4d3acce7ced9c4dde409e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8555e7ddc14aa687af48f1944b45351c

SHA1
5b34c3cef2ba7bf62ee82dbb6eb8e481b0f531eb

SHA256
1495c89d6b580018494aa538322ad92a0bbc80e20e9404830036776698293be9

SHA512
bea0f2ef1f30e6bba5a12d97510bc893a74187c0005daab16f9b7827852ada1950519d8916b457669c83aa8a6cbad67c0d6e8f66c4e15a25ef9d3388cc781632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63201e316b60f1d4d0e6faced72f49e2

SHA1
a4d7ae9585fdb94cdec1ee693a3d40f8c5f9f68e

SHA256
0b8adf64b694c96d6c70d05ef6f5f6ed82700ff1c5dbe3839681e132ae3603e4

SHA512
eda7fabc0be5707df220af033e0a688296c1caaf67cea0288316ee92cce0cb1ed9f43554468e9b4a2bce20a4cf546645830c122a69609b863d9017531625e528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a0d4cfdf7c38686fb434668f9098b09

SHA1
38c774eff70684817a1cceab6cf10fb4862eebb5

SHA256
0fb259571c1e7125b511e0965b127dc16784aa94983a84711df2aac464b5592c

SHA512
2d66117a95a4eaaaac2a7281d8d00b6a89c275c5cd868dc8d45461f4c54510950186dcbc9a9d10773e3d31ef016a47a82be639bf966f1c3d9017b10592c3252d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bc35a321587967eb634f79ab73fba4d

SHA1
76509a080ff7d69770452e61b73adea659fff058

SHA256
d96121007d57085acddc9378f90af0959dae2fe278ef52b4b1300d5c6eeae91b

SHA512
a1f2d1ea1f0334a6f8a112747d3afe439565f32e0017d442ae5f89f8678b2282db03cd781349d74819e24e58cca37cfc68436d627fc2102289fe61e0a3651949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98dc93368929de9259c7bbe7f71383d2

SHA1
dd79a4713e6585e0f6d8d60e9ba3a3d1afc631bd

SHA256
de0d8b6c778399b7bc6ad94d12808341335fa6e8b4157e9d340a3885ac118d88

SHA512
4d928b839991a88e091af073cf6ae12444e10fce4a3b3381b540a494a74d2dc767ab232943e4d844cf77d216c3f64d59d1a26fcde3c9824d586c3fe9750fb675

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7070.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar715F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit