78aa1ac43f3995fb72e8a6d52bd27c2596ead9e68ab21624d7b56e11dc77eb90

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1df2964aa4721d8477de9a847f8985e5.html
Size

1.6MB
MD5

1df2964aa4721d8477de9a847f8985e5
SHA1

6de5aeb212a41643bf238e4f5a808e3aa53ebca3
SHA256

78aa1ac43f3995fb72e8a6d52bd27c2596ead9e68ab21624d7b56e11dc77eb90
SHA512

ba2b4d2b51c16401f0be6d27ae8c44bc62956822b0b277c750aeadfd8e86260ac60be67bf006607e83690065bd20a283bc063c0c4ef38eb2d7a16fc759363377
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6N93:jvQjte4tT6f3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b09fca27e7c81c2aa19140af1b1aed79e22d918b8f9dd781ad7460d2755c9d32000000000e80000000020000200000008552163a28cd0ee5aceaec0e4516ece5ebdb74279916212d2395a5403419d714200000000683223092cfbe44a9732812548ac702f93abebdec570fe013763de2d4b2a01340000000e81efc5dadfe3e2079e5b29e13d573ee76956ccd14d04771c9062e08bbd977d4b35bbf9c8506897b97835b5477fabc1cfef343869eefc791b7344e44cc0bb98f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000078d3f21247712f5226b41febaca5cf4a8300e6ccd105e4889c4115c976211789000000000e80000000020000200000006950580dfdaef34270bfccf0b02dd868d00950edba59504437bf67fb376b939f90000000d029950d0799e33b5496b9736a92db2ec7731dcdf84b47f095293a95610781af26b9793d25ba7d1996928a19d21900fd11b7dd9f6710415421150ddd7e32bc18500cc455e7698471321e15a29e820073aad528574af97456b32e76066f56cdfb03cd0e2994c6973a4a0c3f8f9e1813985aa0570dca5cf5551d5f16800432b7b79ae2dc4aec6219cd9dd3b7c83c716bc840000000510bd700796fe5430ae39390f9a86399a5d673e555dfb1d2db2de4e1ef4a9354e3526d0a076cc0acf4c3f0fdaa0dc831755cd69409b19c6fd5e74af028d02b95	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04d217a893cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410258225"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96C0B1F1-A87C-11EE-A76C-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1668	iexplore.exe
1668	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2684	1668	iexplore.exe	17
PID 1668 wrote to memory of 2684	1668	iexplore.exe	17
PID 1668 wrote to memory of 2684	1668	iexplore.exe	17
PID 1668 wrote to memory of 2684	1668	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1df2964aa4721d8477de9a847f8985e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2d50f83d1a9ccc65af42edcbc588ac3

SHA1
5155fc5969edc53f5912d0c3726f579e21a88e57

SHA256
6e9f4cf19821bf6af5530b80607500d24e33e48a1f14c02579ee47aa7c184b3c

SHA512
a9cae4ab311b27f0413d57fcfdc52ec4203e85bef5f40ee8d306b175cca14a53d84b46662661f97e9e6c968f52e4512f5797ac5d9f5fd776075089df40f82fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3068ea46ebb6839c1f0e9eb2b55aee8

SHA1
72eb524c533187d97689e8d791ecd9de1e07f8b7

SHA256
1c360b7fa148b2250a15b48cdd10c83d740b51728f89fec0512104a02bd4f65d

SHA512
b1aaf0682c5e952e50057d664554ac5a6336fd197b77498d1e8caf44377ff26ad90fdf52c1982af57f3b05f588270ee1dcb5d9496b1e8ff5e2adbbfa75ff0b6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bb58d8c762912063c789f8f3faa9853

SHA1
38fb2c91f74f85b3e554d5495df09cce207ceeec

SHA256
e1853fe3d2cf1aa299fed16eb044ff0934bfc3a8a6bba4fbc50f9c1cef038234

SHA512
fc189c2de90239cf75e51ba4e74a26ddadb430c93ec8ce6c6175d51464db4a4103a59991a7a53c2652e29899312398d070878840dc341f6ff300c3fa6e1e5503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6ace42deec94568239369a8fefb6bac

SHA1
b8536e7995e9e52d5392d7586d8cbff7ba1ebdba

SHA256
f4ea95d78b7f6aac20b752cc4c6718d895ef157b205a0971d1fb82a1fd149b92

SHA512
995ccf51b2f902cbd713b4c5769bd3f1f9fb315ec19c2a0df7af573d09bae28f05c59c608c465a83ec9a7438a6aa857cc0fb0d6daf166c38a9a747625b36c3dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
834d61346644a91b478a445f6ec20732

SHA1
de0d9d3b0bb82f28ee3d365d349d4342cb679bcb

SHA256
14124ae5c636814e491d1e0fae02d9a20cc2b4686a2fec9a7ee8b47b258f82f0

SHA512
a22b761634992440c88213f327d0db416f1f5e115c47cf38d3ad2b6b35f09bb31943ec3bdbc45e65d34ef560e18f2f2eee0de296c403820030765e0c9e3767a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0021e49270cc033e2efe6e79ae068829

SHA1
74adcf1138e5489d4bbab9efbb26db5c7b024735

SHA256
b684dc28e8b61f9076e3ddf807bf4c55dbfee269551278e6bc5d3439f5b43473

SHA512
7be3d86dacda4ff9b7321d0427f5b5d59d6fb9cb09777108a05c32095ee06805d756a4e0f9452131aadc7e3a8ec26f36b4dfc38f241329423ffc61396cc12bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6734dd32bc86cd63f31bf80ca8c2e7da

SHA1
514bc605dda2f84d8992fc6c7062ff1efbeea978

SHA256
49a5057fd9d2194e82a10621deba11f025da2aefcb76cc0ad0dd0e8df9f1acb7

SHA512
86e540995de31700f0121949be5d728057e4a00bee1f964b9593d2b65f9e537b62d804e7e27d6dfc2f121d9d5f21993ab9e26906be98a68442e23ebc8cd6e86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a458f101fc34f1e75a6a93fece5475

SHA1
1afe9d8abbdbd054e90bced904856d2e02f0d878

SHA256
6620d0dcc87639a3d3cc10cf840c5115f86002b6fc06f32ed11eec57d5b8ed14

SHA512
93f75e99acb82f212b92745baa51424a8b29dcac88b50474b267f6d9d966e5f2cc81cbd6bf3bcb7f0df989a8663b44e488f0bbdc228782694223877be0051c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9253d099bee2694a39a3b9f560995fce

SHA1
f022f87bb891560161483a89cb60d2c251874f12

SHA256
905b701dfc4e894212bbe9d3ddbd5a2cc58324e65628c33b202c2ae2997535c8

SHA512
bd7bf9f02ba905903808089d1b8b87df594e1322fe0d806f65da8a477e2a7d6ee9dc9ff4dc7a990521152a5caa3436507fdd2dde87e274479aa6006fffd15cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
906173be500d7ac78b8151b170157ebd

SHA1
8bd04acc16782a3bfcac1cfd1e00c5158ed2261f

SHA256
8ee10582410a817754a1eca4efc138edb2179e688aeff1442d91d2b6f9f46c1b

SHA512
d9902e00ce639b2bc70ffaee973f7c6be84299dd9e2daf07c6e020463e12558a5eb1d6fafccb39b14d8d7dc29c47f2f8e3bf01847fa381bfd694ec66ac1ba91e

Download Submit