64b5cc6431235601f3ea92bee39aaf29938eeea22d7b54e1f548a6e23c01251f

Analysis

max time kernel
146s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20d8b3801944ab01f6809c49cfe2650c.html
Size

35KB
MD5

20d8b3801944ab01f6809c49cfe2650c
SHA1

a8f6f8b616edf48bf6d94ed79484e5c287a5e9d8
SHA256

64b5cc6431235601f3ea92bee39aaf29938eeea22d7b54e1f548a6e23c01251f
SHA512

84f8e42bae30edff81830ebfb72c6b8a121e5f5ba9661adeed8e9aeab2689490d351dacacae8ec945a2fd2feb310b94510bea3871d2619f72587569b78264a06
SSDEEP

384:C2QthvXIxTNGLAsuVKG/QSdidqdSdsNdWdHpdTdidqdEK1TGPF2:C2QDXIxTNGLRuVJ/QPl1TGPE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DFDF5E1-A8AD-11EE-8459-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c4fe460d4e8bdc7173dc05b6840c7f9aa84569b969b7660d58e85cf9023a39b7000000000e8000000002000020000000020477fa89b5038d58d91c9b488a3cd291f6c55c877dffc532a73291b794a51120000000637647315a1d23b6353941644b5faba775f15c240035d0b6b0b89d99afe0b6eb40000000df5d791082c81eb18f1d6d0bd83ca5c45de4a8bd16ddab7724c7246ed83f7aab838af242dfc9d81e0fc1980f9aebbc752f5c264872bf5554648c0fae79dd2bac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200d0deeb93cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000ebf30369b3456eff87b14d28f01a1f9f94a19ab0ddabe66122989a0d5279afdc000000000e8000000002000020000000bcc5e4cdf677b3ec76236ad35c068ab2cc7696d1988242d36cccd24a427259a990000000ee1d7378a2a70901bf0eb5de19f1f9101987330427a1fb8e486f63bd8845c365cd94009aacc2adffee9ea46095c5508bff6c31dbda87c3ec817e1964fdc3baf4b0eae3c7716dc5c98a40918b116f47892b0c8dd131ff0f665ad46d33dd9f0462f0eb4b5e32b01e4cc49a0107c60ca0c73b24580b280538ca75f6b3016fcb7d0f48714fda03ce0d4b7af5a3940b3d91e24000000007bac8b82563cc969e62ed7904389c5a1a8d7151cf7dd213f83960c7b7ae9f82f6db391acb1dcfe4013d318055b069983811c473876a1f582e2b1e07d08ee760	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410279051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3064	2924	iexplore.exe	28
PID 2924 wrote to memory of 3064	2924	iexplore.exe	28
PID 2924 wrote to memory of 3064	2924	iexplore.exe	28
PID 2924 wrote to memory of 3064	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20d8b3801944ab01f6809c49cfe2650c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
68e6593c33d2a4614d801441d75d8c30

SHA1
dfbf4bece991473382fce469624dd2c44374b439

SHA256
a77cf42438fa2222aff28834bae9a45ae7ca50bdaea677841e406ad53da938f2

SHA512
314b643fed3b2eb73e128571f6234b2d15dfdc253f93ba910d381e0e8747ba8bac801658a24ce859e9802b8921c4c888621a2b207a6031b8a218ef53e4127e3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e863fd739e747ea7c47283957caf23a

SHA1
f96afb14e1f28a25b838658149a0bc7699113d30

SHA256
f4144590f971518c9f9e25003f412cc30c072e3e87a720a42205b575f3ba30f9

SHA512
830a074104580a593707cc6f2f402b44283a1e47afbf87eb893bf233498f15d8891b8d2e5667bc63663175c82a05685cac9f7b7de5c7438068aab0ab2948fbf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa90b3aa4290bc0440bc2611ca47f5ea

SHA1
f640393abde2ddb10698a5cbdda6336db9079c46

SHA256
e3be5143911ed8082f4a9fd7cdf1967b6852305274be8fcf7cdf91f41212cb18

SHA512
2500b4ca2f4d0677c0ffcd16a8e3e3f1f1c9c46c9d75fef858e1eec8b6157c89f562ab96a35161147a3d8c4f409b6347b9853c21a1f1cc800a6f29e623af1de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bcdf314c6d6cd0ba8129ffeadf28f12

SHA1
aa0583eb2d6d85f5acb8df57f9e3c0567f74abde

SHA256
e2a6abfcd878b57b93262a00c00946bdfb784c29916ae902cc567b0fd7998ba1

SHA512
b0ad1794b9b32feb817af8647773122685ff84b99e9601b9dce3fbfec4405177c929b9f656eef64d15ac02431bacbee8cca2f9f0c40e9caf9795e87f837a736c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f24205b761519947753042e70e373afd

SHA1
8c46c473669039d7cf34e85e0c9e1364f69be8f3

SHA256
128dcdddebf25e73e7ac7104f95daf2c9cc51cf9a21d64331970f9d48f002382

SHA512
5885c2285328d1bf70ffe81a6a6aaac9787228b55993d5ff225c6926332c6243bdc37b37c6f8f7aab55e31af170d4693d1c586771bc2952ebdc3483ff578535d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b550e47d0b61234364d060ca753914e6

SHA1
a0afc13af65e7de372f5fea89cbb17560680e19f

SHA256
df9edb10dd402ea0385cac34f1eda4497bbfd406e9326e0f62e1ec4382b53330

SHA512
ccf5662be960aa844d4281cece59076516d7fabee3491632a8df0bb7b352f4aae01e2b5b9d17f2ae7c5852ac78944344d776dfc927f38097d8eb6d2cae73f5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63ff3606f7229849ad66c5e7db72b10d

SHA1
be8132b241ce2a79df4bd1e49d36adf606a7acd0

SHA256
8007a8f58792be8f96b245b2c8422f906c9b7328eb98d33efc4e05974a3090f3

SHA512
7ae7de4dc9922f42343dffb06262c8144a5e410210ca4a57db1cd9b0fc43549ba15c172b3ac04ccbe38987864c744505af71026f3293b8e715e4e9e005555de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12e7c1ba9ce40550c8e875ea889a550

SHA1
55956298636e902ffe45dc583f8912f1e4a11f60

SHA256
ab04329eb486b5a676092a6e40376fc93f19ed71cc41f2244197b4b67219cc14

SHA512
2cfa00887f701d9d3309a6bd92ae7e8a2e24163f3657e87675f1a0d024dff6b616ee425b013ca52c20b86416a40e685e2832df77b3ce843a1025c25d9b7027c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aabd1c383aa7c72159560c01c29ba0a

SHA1
5e3396fce0128b239f2490d4dd55ca4fc51e0693

SHA256
8602aba1e09ba8bd8e7e575a1d48b9830edc6f3d9025d676a6dca61b1f3c0510

SHA512
edfd2e54ccabe83d583278a507d62c7acd4d42f25fbd818806ed8a0d0c9113ecfc5d5ae7fd98e7b0bf0aa6579520e5c79fa14a6e6ec397e644c075ad087f9962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
299ea4f5e59d5000a8a09deb6f99b475

SHA1
31fe7b14b2c28b89f609f1cf15cddeff02ad9e55

SHA256
4c8f4e66069d198487c4cd7c744211a269e296cc52ea084b84c4890e108e1e98

SHA512
c1182e5cd8d598d37d404214bde6f3323eb88b01197d5afd6c7ba49d2604696ce6fda24d0f83777b1943fac0cf593da4da4799427fc8c89ff3c7dc1f8a598017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
da33fcfaf27aa9d91a920abad51734b2

SHA1
1d5e900d1b7495374e3c92009a02f02a3e185981

SHA256
eeff67e815ec103d6c0ed75845f0631d4fbe2695d537c087f226159ef2b17ff4

SHA512
8e2794f3a916ca38fb21fa4654cb9c5b29174b501c3ca0c0df76dc6cc135dffc5b5671d1ee63f03b0d410b8d570514052e90e5efff70877508d1b6ab2494f156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B55.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit