ddd0c99dd2d5ecef65155bb243aab7133e9eafac5c531ac02bfb076e3eca8475

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20b55e7a15650aca4ae3596b94f8628b.html
Size

895B
MD5

20b55e7a15650aca4ae3596b94f8628b
SHA1

3edcea385a16153c4187047f782cb3ab9da29416
SHA256

ddd0c99dd2d5ecef65155bb243aab7133e9eafac5c531ac02bfb076e3eca8475
SHA512

124bbe516b2c2171c1e2c09fa4966784fd7993b36808769401dd7c702706dc10c5d3f54c163a1332fde4997672f995ca0e1b957cef87ff52b555dc5fbcf11c2d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000084d17c767026fe1aef9cfa8f3a6939078f6818ea94b0b243ea09852b63a442b3000000000e800000000200002000000069da7b91f1f5a2fb8690d00590b120084e8079b1d3952cc9a2edc8bbbcbfe814900000004707cbe416dfe235f531ec07d28dd7bfba785d2ef792f612661997ad25ee9c7d548872451cbd036c117779d5e0014dffd9ac06f128a781b3083063bc0d03b0f7a4eef1b59029ed30a6972ec0fa62af8a3243aa44485a6b4c8726460c3b9e8edd13ea09975040a621b92fbedbdd58d934c4f8664c4d8622d62472dc70a6ff9c86296e0791fcf9756c9a709e8a56bf78bb400000001345950e9bb1b9885a91863f064dad65b35218631b300b79097637418efd2e2c209a4d7638eba38803b0e9e2661ab7cd1d856706a20f26426fd9dab8c6697d99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410278097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2062959fb73cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D990ACA1-A8AA-11EE-9AB8-F6F8CE09FCD4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000000f8e3fb5e084216e1c09853c0910e821a921bfad9b262427bc5256a0757f389d000000000e800000000200002000000046edee85516bb7514cec6e487e883c5c12cc84835e7b1a8eda37f84f1ac2df362000000043020b341bf3b067453f1c86f5235d5ff2077dc65dd9b017e80f36efca9150d2400000009bd20bd2d0ff9232bf89fe5f01027da81aa61ee9658a7a19ac43ee98e6f2818a8da80b1115e1a6860c4974efd86b6fc03f6be5d68508ea9243721df0c6830fe7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2792	1732	iexplore.exe	28
PID 1732 wrote to memory of 2792	1732	iexplore.exe	28
PID 1732 wrote to memory of 2792	1732	iexplore.exe	28
PID 1732 wrote to memory of 2792	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20b55e7a15650aca4ae3596b94f8628b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9f1b9cb2cc26e541e4da1d69c55f8cb0

SHA1
b2d128b96ca2e371832de1c23a2025c0e5b4aba6

SHA256
9315287a79af0e209fd6cc8aeb294da644c250ba422d1a479a6330670ddc42a1

SHA512
3d1ce229592d6dc7d52ca17089f292252ecf035d39624f02a0bc25e92e9948f159f7a5a0474b92e37c722bff2f3ad62517df7c0121681ecbca50e138c93c5b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96f7cb3fab433583f6d0ba1a57078cce

SHA1
678dddd75168a337c8589e23b3e951fadd438201

SHA256
3641e095ea212394d6e19682a4dbeaba53b818a48134c6ff7a07868d16dfbf0f

SHA512
2802771b1f73794dd59aa12dd8929b397de8873410971831598b38aeea75159754314db4beb9378588bd3172dddfffa3f60f9ea0a442bf4ad78e49e8c7d04f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac1591ff300d15f5ba610da901c57088

SHA1
3caa5af0724ec781628c7ae0776ea0cc9676ffc7

SHA256
8b99be5a009daa8afa5dbdf75f429283e906b616f4d7ccb1fafab640c7f81782

SHA512
f585f5008aeaeba3ab4912e2f02dc8202fadc9ff37e4f7bb84203e3421bde378ac2100181509e2d79468cb24a1c58fd2d52f319a6daf7ad3a11a5f79c0ed77bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41fbb9c56acf5acb6162d6eb3ab900da

SHA1
9b617a854cd6fe3f4accd2c0012fb84e0240dba0

SHA256
3eb163ed565ac0e54f0c1ca5ab117b5afee35e61556b839f5810ff4b20b7c63e

SHA512
e9bd563610821b52bb0f2dd64e2eaa046d734ed7df76f1a9f7f862793f06efc9a20e0fce3bcf00e8f8541e477146486773eadd0c7bd5f89a5ba36986c65eb3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a880148a95c4d7eb97970d05f1ad4f5

SHA1
38860d21f5e16b61025b856beb31524cf2349dad

SHA256
ea76fdd3359e43b4b50c1836dee286fda6c6ba34702b676e0e3e1c1de8052b29

SHA512
330fa897c5506b67dcbd039b683f39b7b635fea3660fcbe121aef82e9746779991c789e0c214e48e2c316100966eaae8bd5e86641dedef92922902af82596bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09d1cde07eb79ab6915df127f232ab35

SHA1
441855194dc9612e21746afe82520d6acb18e49f

SHA256
cba317784a36b587a0a17b57471a8bf0be0b371061e04b087a1732208db9cba0

SHA512
de619770c5028fda7b47490f30a4adf7a0a4e194c0f993a624d82cf559e66785710698593909d8cc3069a4533f6d6b6024b2a145227a9f40edcf8e10bcd80dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39b8fae34525218e2249315310c24ef5

SHA1
627655aaf816da83259b402027ed5e8ade12ae55

SHA256
7cf1155e6bbbcd6ec67f34cb0826e43409c821d50a4a55f93d72a8f7a0eb435d

SHA512
97446f952d3a5524668c80a8e9825283725b616fc194a335f180dba9f3bd8fb8f8ee8f2ff7d2b2998e0da8f1d9a7f8aba3d1041139cbaf9d8abb546f76b1bcdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
361437e1222eb20b699a6eb02f05430c

SHA1
d5eb4e3994683c1343c066c8977f8581ee7201d4

SHA256
d50c539a47adb1716cbb036340c05f407c52ba49bcf1b90f2772bf9764ddc28e

SHA512
8c8ea6ff8ab8a0a8e2c97098a6fab8f7c3bb5fcf4816bcfd17d3cf55dedaf11d46059ef1782e1ca055d3a24440e4e870ec1512496b8f9dc073d2449247d61612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78469eacd13b4070afcff931b1bd9058

SHA1
efa2b6e7e5b77b069463a788ce7558224151aaeb

SHA256
8562f5bdcddff6a8d01d797f8cd77d7146ed184f3917f74c14665645183f243c

SHA512
b9af802e91027c36184291775ab96c7561e443702d9fcb195e95f7555a5b8e117e0e34d82774d13364dcf2f63820e0549c1774323734ecfa250ecc545aa47a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea4c06f7868078a382fc65198eebbd4b

SHA1
164daa13e3b93507677a94570008cd038452495b

SHA256
d80f2b3bcd87c7208f0b7b3229e2e473511b08349fd3100f201cbb1312a7be81

SHA512
ed231e61504c1ed4d5794a0057fa329abde2fdebaef353c6e23a41d57b15a08a1b2e2633faa1d5e0b9e8b2f5ddf6a175659f1c814cdb4eb17537d98105db5edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fe49a22630d2f235f6ee2b737e4ef6bd

SHA1
fb7a18ae8883123362c09413aa73ce314348aee2

SHA256
3f327977b2a26e39505c7f0ff9f132bbc98d0c4d191a285aa0a74b49a1c100e4

SHA512
6894623477a15e83559c67df8dd7cfd51049e3bb5634b3f7efd9197711e86eab9c406cabe182a00e9ab8f790d230dcdbf9ddaa802343a3afa0ebd92f4e4f2bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n7bgnbu\imagestore.dat

Filesize
1KB

MD5
93c9990db6e16c1ddadb91095a799d23

SHA1
6bc966278bdbe7fdd160dd2a30bd0b7f2c37bf42

SHA256
3d0388faa2035153ca742f47e3a3f73ec9a105b699ad5a2daae6af6214983fe4

SHA512
f355e2f06d76495876656ba77750ff9ed61db245f2637a7dd9056113948035aada285953068d4142f1f4bfd10db3351052ac6492f8c7934781c82ee8738a644f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GZPHNAEV\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar92A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit