6c145fa6de4fe8b60608549a54c0c90062cfd301171a32585b78b73d2a873c22

Analysis

max time kernel
142s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07fcd0f2ac51c302925420b48f358771.html
Size

10KB
MD5

07fcd0f2ac51c302925420b48f358771
SHA1

5e142c9070e78c8709dd681e7bad47548c06c586
SHA256

6c145fa6de4fe8b60608549a54c0c90062cfd301171a32585b78b73d2a873c22
SHA512

e8c09073eaddd091f2acb12884bedad338cec7ac6a2e23f28e30197336e76fc5e7918ac66961ed89ca764f66031d96d550d88dd9f604b1afcac170fb1b3edb3d
SSDEEP

192:YwPbXLJj1qJQq39p0Pi3gHS1z09lpk09lpFr8soBBE4G:Ym7JPPi3WSl09vk09vSso7E4G

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000ee414ccd17e95c5c5d8dfdbdd0f12562ba818c5f1d42f1058a4ed20f45c0d030000000000e8000000002000020000000752cc40a4ac527828a1ef48443bd2e2d90e9d42e916c21980db1baf1bbb5d6a9900000003fc33826e3cb9ace29a25e145911a12825b08958cbf3bd8210fc494e3d519a863f9956463cedc15970f89f36d48045baebb8e6839cd35fc459da276e2f3327d12f0493dddf1946fd48368b7ec24d71378f24d4859546851a2425db4541697fd3a092276ca43a38243f42def2d352d2a0996afa9d37c3b73d2b8fba08a0eb917fabde403f5681ec5d912e96791d6b75d7400000005092ac7bb71b2a32042e6858161ed9f7607f78672634d5c22e5cff6af284a13aa4be58dcefcbd8e005e6f8e89e46096dbbab31ca042f6b86fcd57956d511aec1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410090328"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000f697d33e6bd883b98b628ca3d7e4925851bf2636ae9129d112c64b576d33f4ac000000000e80000000020000200000008fe65456b96348c7536c59d4c75f3e4dc06524b2c89c647093d1e206c38eefb520000000f0f45ed479556ae448f569fb7eeaf99cfeaf82dddbf0357f30f9087f37fd94604000000006ae7d4b396e7cf0a6b96c5c86ec3189673e7f099d4fa0a12f0f88a93a733bc0cd91e24c7611a0424c0054575c3cd0b824cd8060518fcc4225974a60150a39ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6F8A741-A6F5-11EE-A2F4-62ABD1C114F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709bdc94023bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2988	2224	iexplore.exe	28
PID 2224 wrote to memory of 2988	2224	iexplore.exe	28
PID 2224 wrote to memory of 2988	2224	iexplore.exe	28
PID 2224 wrote to memory of 2988	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07fcd0f2ac51c302925420b48f358771.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d08aeafb0d2a2623aa0d37f2e49c2949

SHA1
6da298497637a9dda9cc20031807f7f03353f396

SHA256
1f736fd24f99c07df0539c607339161de34ff8271824f1c9c1a45c36f968f0ef

SHA512
baeb16fbe0086e1cd723e0dea101c4ba718fc7921fddf4aa7f9f79d89b99203d1100efa56b92f9cf6db709c3d5d716e2850d02e8d6d4c1f81e6d64904269c86d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aa7b8e9f83be33a8e0a1851a1b29662

SHA1
212c44a3986be9ee71cae1d6dac6afe413f6ecec

SHA256
a81f19f794b45edc32a808dec60f768bf0a8b517c5b08c45ea072ee1911bf4a2

SHA512
d6a578546bbd68a808ad654d87df53522afaa9fd658f1ecc958258f23977d2e50da2cf723a50f508fba8849977d4668c6b2e4c32c9e3fdf07455ccbdf9829cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5586401dca83e9ee91df9bb37b856fa

SHA1
23423fbba99028609c3eac6bea61a2803e2da3a1

SHA256
fa2b94efe22a8f9972b4e8a0bb49804beb843d96f53d210ded5b76807517eaea

SHA512
353ad8902d528ecca966fc31a70819d7e33db10cc36f449b62c6a1694ff8fb57919f2dfaf68b323c6983feedbcf6c74ea99709ec34a4058b0650a9b37848f149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2dc14f0091548d8a9423019873425b8

SHA1
bf948fea38f57098e5deca75a5ad55e72380f081

SHA256
4c615d842c590f3c02cebbed8fa865a68d864391961e5197828140a3ec469fa1

SHA512
411d8f5af2246177b907dca1dff1a04e39de7e147fc88c969385108193e99c3aba1ad1160820372536ba2368c78d0dcafb64c0b0cb01c9e8f991ba9a6ecc75c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b66b7e7df95371aef11a7e0c95790230

SHA1
2f3b1ee416474909a2df718e49455efc7f46f3e3

SHA256
9fa58fefae7774dcc0503a620cc004bdf95cbb995bd2405e14977531b747bb82

SHA512
6d22e345e2f9eb307ce341a8a2fee0a93162ee762785f5c0c41f1c88bb7cfbe91592e2e645031d4acb6fcd9ade7a3c336867c592cced23a4f5e086b9ae780ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9a591aeb5fff51d6cff3868f6693cd

SHA1
15b4a451163fda4d89268934de698eb083d17b0a

SHA256
29892e4111c892c800aab835d180434d02adc454857bf278576a77a18d575c6d

SHA512
8127b95dcfd03d30ad908f316bda2a71872e66057a210e26d4a2cf5e7f8e32f85f508757c3559cf66aed8c2f81bdad179c4a0910c54d594713da90151febc797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dec5f1f4740d9d9cbd65de3fede93a7c

SHA1
f8f1260c0767bcc9be6e8591e9aa55c87dabe7b8

SHA256
7fe32238bfcdea36cdc3de764e1bc44300b66be82a2052fd788c14352612415b

SHA512
97512b6366bda619adef98b1eeb9fced1ac78bd89b5e0fc2a1d91a7084dc797058dc438b5c3fc39895803bea99b82e4e825192823b41b4d35dc3e1f8790356e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9383f47de9f46b966a49f854d1bbcfa0

SHA1
c3a32587c13dbfb27cdce049bdce43fb452a31b3

SHA256
894e30c98334fb95cad9205b0aaf7ed4c98b26dd2d340047269acad7c56a4da8

SHA512
e5f7cdceb3214247b936550be7b0f0a801786fdff1c14df38ead8506cc0a5b997c3e6f931804a3056ad7549736e3e644bce1f5de194424a6d2810494333ad007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdd8277e5b1b237adc7939fcf0259889

SHA1
42e7ca99cde8b3d85bdd12116c5632585152cb13

SHA256
87c71e16c7a369b0058e8f0303ec6459a590231efa1c127867a7e1a2bd51cd77

SHA512
006e810139723b54191dc1d48757663113d36d7ad19c25b7022e19d80d04d32b260fa5d5d4e90c3d65352939092077747058df5634414cb23741d63da33d97bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
87c8e5b783856c7f6168e9a7d1fe6fa6

SHA1
897dd97cfbf4be7daeba8764204808fd3dae0e3f

SHA256
48cbb3a6f61c41acabfaa6b17a9252f34ecaa0af77bf3b24917f75a28ec6812e

SHA512
778bf111565084f8259d36a281bb4bc58d0b7000be65f40f99ab99c9611d23a63dbb06f850bc7d8ecd8ad7ff7c63e168223fcb795b98b613358f5d720ca79c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3355.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit