ffafe0da999e416c8bd98e0427f2a9219ba6cc869cbdfc6a6544a90696efe33a

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

087c837651e5f7363e4e651844a48299.html
Size

82KB
MD5

087c837651e5f7363e4e651844a48299
SHA1

f9f07db936c6bdbb34066319eca559d5848ec9cd
SHA256

ffafe0da999e416c8bd98e0427f2a9219ba6cc869cbdfc6a6544a90696efe33a
SHA512

a25baf967df27effaa4123339d8af57ee2b748e8ba99ca7f2d7824b506769a882a1b2ba5c3e0cba9706757dc106426a758740313724c3ef2cef2c36e00b9030f
SSDEEP

1536:H6OpdsUSqicypP+/M3W6uLRe6yedeCepe/eU5jpMk2wFIfe8e9eViFeBve1gQ4e/:H6OYDqiciWMe1M69fMIdfrdc2xJZD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3084e824633bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a90b9d0efe6db523fa54e3c35c16e9af5478478cb3c351f8ca40bb27d4b3e1fa000000000e8000000002000020000000c871ebac0f8a32e6237b055912390c49b103a554492e72f115b174a13796aabe20000000880b6ec933dd81c591d5138474eea6a4e8642981e4a6d239a8e2b1f887d84a5740000000262901483c18d5ed87ced08680c1c4ca4696429d9af235a7bf0da927d60820ff8499dd7e1019ac2ad3dd7e33e979a9ca3c7f6ac2fbe9c41e006d51221887342d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d92dac48d09b2c01f6837c66cad4be346fef3801f348dfdffdea6c4205af14e1000000000e80000000020000200000004216f91c94ee128878be8e51c598d076915ac5eb287f0664228a986ee2f7ba0d9000000047eba1c85aa3cdb72e65f67ef70487ef063b0c69912c6c0cf2657756f6a27317c1432d92215eff8f086570d90073fcf570bbd955de00b8b6d3cadb4eccf097cc3c52d79276bdb9f1cd615af7dc9bfb85c4e68f12e55dcced61c08f32ab84602fd8fcd6e72b79f568f37db9b80b4bbaf1fcac54ed94abc799229154a9f35830e0236e5197bc547b1363a7bf594671dabc40000000339517e470302af8a60d6b8d2e6532e3586ee8148f4f7a01894cf82c612ae0eb8d54f6474f7cddb33c54699bc99a34b735fd22925e401c782468c7077836593f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410131816"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45B1FA71-A756-11EE-9131-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2024	1972	iexplore.exe	28
PID 1972 wrote to memory of 2024	1972	iexplore.exe	28
PID 1972 wrote to memory of 2024	1972	iexplore.exe	28
PID 1972 wrote to memory of 2024	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\087c837651e5f7363e4e651844a48299.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c75c475879aac4d82c0fba4e91f8cf

SHA1
ada551f64c0239a206541095e090491311b705de

SHA256
13b1e889e39df705a065583b4f22229a6d2efe0d521b1ed9045971b1a8921eef

SHA512
b93737ae761dcd816c01c6f2ce022c49bda9b1917f347d6cb8657e6a877263f90f102fbcfef0de88f1465f59e17cf7ec2e9859eddbe8ad889895d26820843602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0074bdf6786c56ec2b0c58e8876f765c

SHA1
1386c92580dbcf7ae54fd448d312c16cb54140e1

SHA256
cb4c19ce4ab4dc450d26cd4aff31b9c41586a00dbe82c2c4c0fe2b1c03fc6317

SHA512
d57d612c511c98242255988ee5e61246c3d0ca491b60eb0450abe127af943a02add4e44e42f9ee7b63bc133b51f03e7cfea2ed4342781a987ea9e354d61e25ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2aaa6c22f793865fd4ef44f8df278bf

SHA1
aeb204c6b0d59f5492f6cbb273f20efe09fbf7f9

SHA256
a045f4a686635f416b11445fc1b244e014c62cddfbaa8eb1737f270bf79a6291

SHA512
387be3640da02cabadbc798cd325d5470d5bfacbeeb273c19bec624772733eadcde86831697f649c50a98ef1dd68dcf1a4a3cae047c226591c11980f867d64de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bbe815b77af5275acb14db1db37e1db

SHA1
0b0d2c578dd713a3975ca7f8335d5c75ef2a388f

SHA256
746f95e1ef872f2e3e2c916f1c32be6d6d7c69382278415642a24b2dd0ec50fe

SHA512
bbf99ee60781352d610141cc0b3cdc911a58ca64fcc3023a855eaa20f3126b28d2a171566e78e64b880e8afab3b2ed432063df83edce8ec611687ff682d3b3f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e1dc852c6f6c11a43579634ae1f8ab9

SHA1
b82bf82e0fc6c9e71cba98d3beafc83fd589eafd

SHA256
fd6646649757de7df8cd6b8a65de4ae8606311333377eaccf8d1130d4df0d29e

SHA512
8e0cda84239a4e642e454dee6587088f38c616455dcbc7bdd988d06aaa3ca9584a545bcc70d6343e552d30bc007bdca395aecccbf017b2a54f7eac295f0f552c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0ea9d50d4c0df063801865b87a4ee69

SHA1
001b6be686defc6e2dae8ebde5d771fb9572e048

SHA256
49301a0e83ad84e35d7a1e27b98f2dd1f95a107fd145bb0bbcccafef3edeb2a0

SHA512
9932b8a1755ef2dc31331feb8c146fd7c7de04f9f70d52eb987ea43a5b449ac90d9b0b61c910495315d69a8a44fa63420e4e23b919a8ea04680e4c92d90dee65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b822ef0ff260dd712ebe72d134bcca8

SHA1
c209d3bf1fffa2e845c19fa7818bb9f7d6a7da44

SHA256
8242e2bf838d81b32f46701859b478fde4a81737491d7c2fa1c2c933f67d2ad8

SHA512
fc8a2903e346b8fc4575e75f9de452c65d5a398ab61ec2846ac2cde677270bfaab9798effbd0507d51b7a60acaf58d002294b589bf8dc95c7ca3f225bf47f042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2c8ea9c446de286fd5dba788a74dcde

SHA1
1f837586f8290596f6b8fc8f5335b23d4a476b22

SHA256
31367fa81f4e8193678b29211662ba98c98d6fb4c98b8788a64d10f5ef8c4795

SHA512
24fca63c7ab02bbf999803503ebe38ea7d24ae88c082d33c6f2c7d8c1024dd79ffb041aa922d40a4b98f9d6838850726919e3b9f9b99bae0d8e84c1a7a863449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ea55cf7ba365aa580f973179fa5eede

SHA1
bb72920f39435ea440761f2915f2f72c9735a6b2

SHA256
763319688543bf47dd2ad4954e124c3b53f0e6d94113b3dcb29186dbc85d365d

SHA512
528ed86b4b9cd54f6eea146c4d50eda2bcf76ceddcc6b639afe1165b879d116916d8b4fa50987977bcf9ce59c5f252ad90aa8767edbf4529107459d8d5ba6211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef8c933bac07bacff03dfdc0dd6520ec

SHA1
d0ccb3dda493206a6a021ce55f1de60011242b4d

SHA256
1874a51caa7aa77dcf814a285d3649e3587f644994ab5a49f5c8c958e6c81cad

SHA512
64131c1c9481f5a57bd0394155d96b3991998fe8821825913d3222bf9937f4e8767bd2a23117319f6208771d955cafb903875255c44228500491eec0e1ddad44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
298cf46edb1df4384bfc008d5ab2eb81

SHA1
3253c19387a4511c514cebda71aa95bc8aa8935d

SHA256
685a4dabcb63a8da01bed8fc63837d1a0d24f5013f099ba73e8aeffc27191123

SHA512
e3385e90774f83798f8789894afd658791c30c11058115ca7442f3c865b0dc4889a51d0e772a15f4465a1d770a31344f1c07b3bc519130e50f67b888663450ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
ff0f7cf43cd73693a0face0e2c4dc526

SHA1
38220fcdf9391cdf8d2c0508349738b293a08d76

SHA256
1f2bc6f6505ac69d502f45f2160bd5ad05455e4c4a69bec0be9359df175c87b8

SHA512
b29108d4203a48dc69d9b69d3a5b2c058b80e587343e06fb24df375a1e7dfebc7af4b67b5e7d3223d036310d65afa4f21a43a762bceb80d26568a99e8463426b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1113.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1125.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit