2725bfa699c84735e2a56964f3be6955aef0ab5d3ecb5c14e607cb9c916d1a01

Analysis

max time kernel
144s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e979ff5903010bb297098d47b249704.html
Size

254B
MD5

1e979ff5903010bb297098d47b249704
SHA1

d78fd3260abe0cd960a98aad3f2ecafa6c18a7d6
SHA256

2725bfa699c84735e2a56964f3be6955aef0ab5d3ecb5c14e607cb9c916d1a01
SHA512

d97450ebda15991b5ed2fc87c54f3fa64322ca7a8870cef398b0cc1d54cb03e915072519b5e755bf1bb36f04bc0bad2dc0a074b08659dcde0e9bf517e7c0b9f0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000007df3adf8aa6412e5438eb663060a1cbc399da62f6349fb4252abe0ecf30742c000000000e8000000002000020000000e9a7cec6aac7fbe31c9dec626f7f545f3856da83655d60b22f13ce4a69ec5cd420000000a9fad66f065bb838b28d622f82250463af3a677ba9db878e7fcf0b63f52f00e0400000007a9e0c4ec0b1e9cd8277ff1111ed2aa0376e675b036fa7cfe0f2011b36d1ebc5eaf79d2c6381166cef0efdbe67bda9d23aedf2371958f39cedac4381ed666859	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410262907"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bd314e943cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000077ed90e228b7155cbebc2ad11d8ef03f70f6b76d9fa02d90f8a2c77e3bb7a82000000000e8000000002000020000000213fa07f8577c3544802b7ebcae7aee42b817b989ec25a1750749837b5ad1bf3900000002cb4498a07e3c9ee1621b6bab8816d1608ef187754dcf68d4c3a825897ea9e01ae4491407f850fe6102ac786f3debdc52e21277c045b33b601132572e088353f92c59ed9340a1383ed90c21ab11a0ca219f6b80c79dc509d96af23efe3730cb2f246ec74f2e66baab44315f01de8824d178570f97093bdf13016a317a45eb62195ff7e9cea94df8d3a74117dcd483b4740000000a5a73ccdbd588a8c7bcbbf1df14ce410a2b00ef7ec98a2e3e29310909e30c90b7e44e31311b0b9fca1ff43845d40f04c3b5ab7573849b2e260106c2135783137	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{793EA501-A887-11EE-B2BF-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2380	2932	iexplore.exe	16
PID 2932 wrote to memory of 2380	2932	iexplore.exe	16
PID 2932 wrote to memory of 2380	2932	iexplore.exe	16
PID 2932 wrote to memory of 2380	2932	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e979ff5903010bb297098d47b249704.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc16282cd0d8300d28e63739f12edf80

SHA1
a6d3b2d2561a0f00dbc94a094608c52992fb8526

SHA256
f9d285a54b8763a6a43e0d836d77c3913f2345c35c86844629efc01a5b145bde

SHA512
2ca26894766c4b6b835e0cf83a4a25addbcfd9dcb180d61b6f9144c91dca7f81d8607b0c6e0a366324ee366d8692720728559d44a56c5e9912d79d01c717070d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5390db645c0a27c5a326ba242ffa0f82

SHA1
d13d727846b34eb086e4af473c929854c172c72f

SHA256
ecbc8992ddf0be7b656ea9268129cf7b99bce7aee2b6312f4087529b8d6efc4c

SHA512
7b0d1fc2d0df596a4dd0f5a2ec53e43ddadde05872200cf2e9da5f4f9fbc67c355850b60caa8feaea576e71ba36ac3bdf9b8687f10b6cceb6ad912c9cf42ac02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
222957b6653cadb8460279437c0c3e53

SHA1
de58f9e3779b100381f0a68852b8f321f7d7838d

SHA256
d504c752dbe48ca3bbd6a0cdde1139ab8acdc3eec6384d8198abbc04f534f729

SHA512
c525ed0562d023ffa4e1327c4e146d885d20bc52bdb4ad7adeaaafae4f651f0f9ffe09c604629b9d5b46e9869b07c465e45574b5d3dc20cfe0e04e5098b8d73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80f2d2b3238b00cbe27efbf825153d00

SHA1
30b8fe472a58fca0e2a5895e45e64e18bffba887

SHA256
0787f477ba11352e6731813f3263ef65605ec226a9fe03c91fd054d83c0a65b1

SHA512
e3cb32871d615f0e9737fbe7b9508da27db13001a7dce191f9d216214e3a8d7b86bef677722231879821b32f9820a90b1735f6bc7da53f74340176117163725c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcc646fb9d131ffd5b40d4add8339b82

SHA1
907a8e6c94407b53268e81f07f81bb3780c67e64

SHA256
81da2d1c10e2d5691897e3a64847d65b2492ab5dd3fac980d139ff7cd171d939

SHA512
9f6023b9609a53f7affd78ac32cf3f27e435cb83ab22ddf28f51089cb9c54b0fa14918d81509388edbf5ba8fd5d7b9e92b68c03053546cade31b3ec318663a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4107317eba3137d25b2ffa9a9e196170

SHA1
236337d356d27a7eec195337e024e588ad0177a7

SHA256
c329aa9363ecc0cf12aae2e503f1aed38ee76b3cb05e992fa3aab68f723c32bb

SHA512
6732b439b526ffc4dd66a1074ff77ea0b7fa516ac1ce31ac8e60fa2e43312923827c4018cd76db96b3779774ba0f2b8ab9fa8aa76a0fb2e41ece42af8e44f2ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9fb795645a2b035a4111ab531e231a4

SHA1
c06e2e3de43c238c0e062bc0c306194dc9a2fe47

SHA256
cfe5448d017d7de12210407c6f934b87de0b1f667d480ba614301fbf09ea923a

SHA512
f121b579d017950a3e149a5546c9eee397c7b5e9015be02f7c90e462249f560f0c3436f47203fcec197f022fee0a78eee11c89c12ef3b42adefa28680abb10c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3f7d0c1d728d36f50a1218eca4d93c6

SHA1
51b8e94837c2c6f7230c54a701024e85e20f5047

SHA256
549dff6724bfeaa05b6c70a24fe4c6efce57167d32b39bb6979ae27aaa82a08a

SHA512
8dbcd67eb830503b3b991d2bda33ed9b04bf0272b33c36f4a1bdeef44ae0cce47862e72122211d2eddf97d59f13ce4c6199e2dc7dff4c3e1abc072d0c9862164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b6e07fe928e053bf2836b0e270da543

SHA1
eb017d3e8605b92a51c88fe91de5f5c9bc1e38fe

SHA256
fe76d1b3017b579316bda988db36bec33523e8281bdfe86c631c35703cdbf096

SHA512
88f9991b1fa8d57030de2dd44ce52e44a7108c7d920fece60162336514001fd60b7d5067fd457aa964b4f2080894542d25eb416b566845b69b88ca44af0fee8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65c68bd7fafd530f223e1efef45910f0

SHA1
f6ab568d41734e71fd86bd0e0af770f6aa3cf4c2

SHA256
1520318909eece44ce1748e45841d7e6bc949ed53fc2676258241e0487ad1477

SHA512
1525c3b9c16920066dc812c9ba82791ef35c90a371793a8084fcc518da44538ffd1ebce9078f76b1e02e83de4674bde6742ebb667f6146525cca664e4df87f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef81590b2f93bef307316bc9206e542a

SHA1
1406295b0e0308e34c87b74adadb89745603931f

SHA256
149b4f69beb7c1fed64850c5b20d20d0e1ba4682199948d03c799ca1e8986de2

SHA512
ba8320b55723066688463302d21e81f219336257eb11f94bc5e57a161660c6c7d0dcb5f0ebb8f523bb80aed313455d77b1d4e005b8eadcabf1717860b7b99d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cc68a4e494d674bbe219da3accc7de5

SHA1
c4fa80f1eeed5058b8cb17ae823793a93d626ed5

SHA256
4a1e0505f340a83c4a4a6757aec61adc446cf56b5899203bf0e1f284081212e2

SHA512
03c18771d4340818029593c67bf395f5157225fdc4aee958e8ac8d942b5cf15f1c3ed3a88555f1d2ee943217b7fd0e49c691fc1b4187742adc445878cf4a4be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc0732d75b2b2c70ea78c858f29edb78

SHA1
7d10cc582f4860c0d52c8877c80200547b44275b

SHA256
308e973037830a9ecf35297aff1e1fbab66b7ce54d9f620ded27eff786ba0e35

SHA512
eb23f613d818f51fb85ee3035c4d19c17436791190c7ed60dbe1aa59d43597fdd67d94a7086f0ab051ae7c5ebae4f42940f6d5dda2d6c36c4e2790df13bd7ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
491a30af41770c27b1048048ded621f2

SHA1
94df2d4fd487bde2dcf2e45a5fc7207fe7796fde

SHA256
75883bce4ab836f6524bab7806a82fbafd4940f3671f725888b6ba7622d020a9

SHA512
5d21cb7dadb3e459780599e9ed8b787e7e2a2bf2c8c47765afba825990d76106c1a85417344ac325df34850a795d8a80c9f1a9d36885f2f0e5703a9afeb5aa22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
216e3d4b9740db8649e893c228730606

SHA1
21fe1d49cc8a1fee0c71cd45420d26dff1fd1736

SHA256
2bc2ddb0da93708597387b0f9dc582b232aeed0a9000a1a2afd163aeac8a6e7d

SHA512
ba24e6324a8bd37d50d96fd20587ecf83898cce3f191c184b39c89e94c59eee9d56c4dff859456a57494480b63bf3562233f72ae9b914493e57d98fc99318f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5d9e1cdcf4d1d52275b31c5851bf9f6

SHA1
9c977687d012045474955e327f63050ec0580059

SHA256
841d1a1b7a4bdbc7043f1fd2522b5b6a7bbeb34e8601467844c909e38ed6c749

SHA512
4b7a27246f894da8ba7ba4792e673f667d10fa712ec87ba3830e97bbee588ef6af0e930f2114153b24e9e900b0ac13154ce11d3eb1bdc2dd4f5e150fa3714310

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5708.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5846.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit