ea1f592f3a779ebc9bd7cec958993cc2e4076d4ae79cc73916974addcd30898b

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f9bfff345d8db0b029c5e75fd181458.html
Size

85KB
MD5

1f9bfff345d8db0b029c5e75fd181458
SHA1

fb3cfff400dae1f71a4fd85ddc43e56cb6958e43
SHA256

ea1f592f3a779ebc9bd7cec958993cc2e4076d4ae79cc73916974addcd30898b
SHA512

c98e518d428dc8be78374e15e2b2ed840dc9cd31915dd1cff6c51046c924425428c06055a4fc7214cafac05ba178eb4226ea8d59bb039ca6ffdb066a3f56ca63
SSDEEP

384:zIhRdhCqD8mWd1/saIBydc8CUIDV1IfqJPkWbhmoyJ09CvkQb3jVxibGygkTZiIf:z8dhfU1nXfqJPkWbhmoyJ08bKgkTLx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0701a7b433fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000941d861c1ac636ae14e9833f101da3ab8c0f5c1cd80361c83c844d0162937199000000000e80000000020000200000006c9407f8a872244bb15745d27e550725476213ce5f7ab2f166128cf5da6d86ee900000004dfbe52cd642bc3021d3ac6084b079ba56e14e4b8b874217238d881ee4a7b5c4e8bc15f71f09d7c96a854ae603e5d3b9a280f44eaa89fe6f7f47e2152f9851bbf0b421cca045232c4571c2837b5383244e761ec5f61c9bc21d7e43d238cceb2d80c1cd673ee20304ed108ac2ba51d2465526933f469d0e46184f9d91a58de539cb76686ec3bba4d66def8d1226ac52f7400000002825cdda9e21ea5710c3a34e586aa8a7c996a9bd8e880a68d52148a26d12e608dee3b321526cbe60deb698d040a79edb5b941f7e60d599c7f3095077dddacf2d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b2bac0d0b946766a512a30ff628be9c937ff37c79ad08a8621bc86c0fdd2bf1f000000000e800000000200002000000053f0d5b1212c5688cb91ab3a08952bea2c4b61d5527c22b0f3948e529ebb549c20000000c509e9c86b866e8047c3dcea4f7417a582663c613a62a15469d010c24f62ae0e400000001f16d00b83f1b3aed9ba98469b703f4bb8ef71c59ed20774561d715828be67a1bb8050e1db5ac3cfc12db142b518644ae34b6743e690c60e2d60a4c985343cc3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A36A04D1-AB36-11EE-A586-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410558036"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2668	2312	iexplore.exe	15
PID 2312 wrote to memory of 2668	2312	iexplore.exe	15
PID 2312 wrote to memory of 2668	2312	iexplore.exe	15
PID 2312 wrote to memory of 2668	2312	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f9bfff345d8db0b029c5e75fd181458.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf92a31203374c9943453ff223811874

SHA1
18ea732f30feb81a36f07e552ebdcdf494de71d9

SHA256
121ac32635fe74e2d6a3fbcb1b8ce0679f795180b01099b20054e5acd24246f4

SHA512
dd7f040f94475727d1908cafd7d3e93c7e539f7770bd5b8b4a883fd17cdea346a2637970b9c5bebd0d05333afa55bf91e19e35b6cab1e2e5c1427e180ecb15de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97347708762d9be3705c3799a7f76cb6

SHA1
1cbf04e831e73727968911a0160ea58801f5cf8f

SHA256
24c061804af8ec2e85fcb22ccabc522909549a03685db06138a23372537b7451

SHA512
527629b50c54e83d7fd0962b527451ea4c2942a4479422f24a8d8f24e93542a9df57f76f0e2e20becbbca8c74e0c9b54ef172edaafacba1ea8af7f898549e44a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4a0b36dde42704dbe089736700e2788

SHA1
f8ea9d3b6ffc1372d5dd88a4c91efde824e838d0

SHA256
aef78d34071ec137a0d2ac3f2de5d20a7891055cd6488a97a9d32058e50ae29a

SHA512
60501761bb1bce645844c68fe86ad4ee8a5a8be3c5b7a88b29ac35193ec275f68867e78f42d3adebe29fd679b7401bf1b83d659e6d72fcb329e4349984b9d07b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
187d28ac1862f2afee8edcfb27886091

SHA1
b07c38bb5aeb7258a387f35045e7d84f35c2926f

SHA256
9881918e710b0e7887ecfa1111c8dc9f2dca77f10d7ece1c96e141770eaad54b

SHA512
cec514fb482d3aee981756bd2c25c5aa2ad634bbb86270f4c3cdee36de4171dbe3592ab8ffd271f2b62402b120a2fe7246200c123e4de3442841e35f0e504d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29e2aa53ef70aba43cb0890586a944e2

SHA1
e291e56f7736878e2122d3803b12e5200a8eabc9

SHA256
4d74281081e70beeded32625b8313a6f2d10130233a2ada0dcf70271aa164fff

SHA512
b941bcc08c888352c14c3ab4ff02f0ca38699744b428b8b14262469881ab15bbdbeb03e1fa5bf102c231596d0c68b1756638b1b83e394e6a12c1c485855ea603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbfa9dfe046a288dabf09f582dbdcfab

SHA1
5d38295bbe516719a106fbbb764e9cbc05fa5b26

SHA256
1ac60826d653066fd662aa7376540d3e8917205b116c593440ee101c8f5199ed

SHA512
b9c235fcd48239a7f821de3268e5590acf3dbceecb302065e49e6d782041b7fd5adc679be1daa4a71a24358057e8fd40654a47d171ed68a060a0a388935f91c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bdd3fb219222f5945d0218bae423468

SHA1
619813ad922a86a888b13c2345ebf2bc687825e7

SHA256
6e3e5edf78e81d4f385211ceab38f8a1ec9cde0b3e5952d627d47d51d6442061

SHA512
03904972c23ab4d5239979b27c79a8b23efe1f74abe57be3754c6c8b175f1b7bf1dad837f3f23382b0571d7599df4e998f1a4aa1fd27fe2efa1e17e51181cf8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a79c87658c0e7dfc3f0548b3bd2df9b

SHA1
128c7a03dc1fb938ba2a57365b2e4e40ffaeb6c1

SHA256
08208d34a67b94e8a7c0c062fe791e40410247c51528d26cd09bcb2329876c91

SHA512
4f69d85fb5ce1d808bdbb931ab2519d8b8690ba7fc43d9818ae485d1a332cc428db5b592000da8e6afa15845b13947985429d30c619f1d9901ea370912e3b4e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcf9d5754964ae58803c816104f7492b

SHA1
70292b883053fbeecddf2adc913e3ac117c12844

SHA256
b0e4f6aacf169c495689d264f362f2a8921dad73572718fc1f1a877a98de28c1

SHA512
938b5386d67d6759a273fca3c0c9232869789754280e66f6b24fac06d809be61e2d7fc53a15e69040741e3d6fb3653af239f22dadea872b1cd376bdc280b86ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd94d7fd8944c4eb9e1182a98ae90cc8

SHA1
2600371bfce0a69b6020f0cd7fa9c7315499dc4e

SHA256
c32525b121a33d5d3cd1f97f40d2d4e721c09b6dba04b733cd37632ad2355389

SHA512
f0e058cd258e39c24c7d0c91850ce804c301ce971853a0de8db15400d9fedf047c52e1a5e8e7b6b8d3945bce51a5a7a18fd00ff3530b9988f90c1fdfe911d0bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aacb7cd3e6b7183b93af204ef9a75d6

SHA1
f754c56af428b5c52dc282e62b8a82776f29a135

SHA256
12eab68719ade6bc1a0f1bf66c1e254e75c54b35c9d12f25f78fdcfc557b5300

SHA512
11dbe660bfdedfd7c493609276343a74f01d70fb7cac2ecb7f114d6c51ea8af2352980ed5cc1e237f3763d094bda964a7e6aadafdcfa6c2050e5d014a7aa3ff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95a5e18450d0111dd6fd83f71a060896

SHA1
9c2d1a43fb4933ca6ce3389e5505f30ae8b8d047

SHA256
e37266891536ebd40eae4f14700df06c075ffac05cd0062e0992cb1431c5590a

SHA512
c81ebf33d83f927ab002d0e39b0655d664417a48fb1ac66bfff4a83183ce676f137d1af735afdc585d803653c8d219be5d8e36a2b1d47107d18d1b638a237caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc7bb109186fdab0374c46fe0df34af1

SHA1
de368fa211bc7e10361ffd23ab4ca5b82bbede67

SHA256
d548a315ffe2aee97c86d3bf5000538f9cda66f2a56245fb3f386511228b200f

SHA512
9175209517100d92635f9c48a6ea609e810540708debd7068741c89397c3d5ee52abb1b0b192fcb10de89a31efb1b484eb47be4a503bda22a44a59cc591dba57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6210.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6223.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit