6c37d9e5a24bc0c04adfe4793b8859fa90829d92ab648d552f66d75e7bc64ee7

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0887811190089d48ab05e25c61692b2a.html
Size

1KB
MD5

0887811190089d48ab05e25c61692b2a
SHA1

ae84151ab4fa37705de721bf68e7e6f62ffa9c80
SHA256

6c37d9e5a24bc0c04adfe4793b8859fa90829d92ab648d552f66d75e7bc64ee7
SHA512

8e0f4f0538b2634178412cf84e52e4be8b2b4a0eb0ff82d063cc6d634313e302d4a63bc9bef7fd2a6091821905c246be9fe785777ee8d71bd7e9bc98c6dab4dd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d7be6be68d27a866379a8a8d5a31ed8588f05fcbae4a63c3374ffbf398d05312000000000e80000000020000200000007bcd17fe611b61413cbb11cda47ba9255c353500ba300d78075f2f93bf05967b90000000b248215bd8b15da0ca40d1dd7e5e2ca104c31ea5746186522cc31a73a1f735de604c05b13ceed8e2cfb994304a5723002d6b61eab7be7bfce791536dac0d36c105fea65253c6f1856297598dd0d4e62866c188c425aab884c6799fbd5735df0deac83c22d5060d49a4657aa011cf339db4b35c6d1ff0a6869cbe8f0fef871e23ad7ced062df9d0cd11431185cba6d44e40000000ed55d2df0fed0b7fe5c9aeb46b50ae1572dd6651734ddcdec1307be4b3e799006a59e7bd9474d2be26ad4bccbcedfe3444e4a2cab4bca7bce93f35aa015d24de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410132376"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000dff4ded946acecf0df6591a1d13d57c40d623b94e837705bdac4c90c49c2cc01000000000e8000000002000020000000707d4a91ec9b10f111d16a33596e84659c3e3daa5cf572273bc8f99d7faf701220000000a3bfc0962c1283c50a73fa08ad13459eca1d89e6802f6a3f3702e030467b5e1a40000000f279c60c2be7b21368144ff63dacbc7dfaff302437265fa9a7540051f521423dad1f8cf3cf459e6f201d5b20b35ce18b0a21a1f3da2cf41c0f64fcac841c6b38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9084AEC1-A757-11EE-9D5A-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303bc468643bda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2796	1996	iexplore.exe	28
PID 1996 wrote to memory of 2796	1996	iexplore.exe	28
PID 1996 wrote to memory of 2796	1996	iexplore.exe	28
PID 1996 wrote to memory of 2796	1996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0887811190089d48ab05e25c61692b2a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfa95365b957eee56bf952c1880611a4

SHA1
aa9fa94aa6b3d53bd3faa9048405e02ee80219c7

SHA256
a61259004374f9fe5b8872299bf7f7ef9689a13b0ebf815c85938d57cf1b0b71

SHA512
2452429883728708b35d4631c713657251aa9f6d3a75d9c9924571a50595201d2c947618346c913b92de2104c2af7fe4596baf30207ceb3c756d2fc7940ab9aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0be5c587bd07248159482edaebd8495

SHA1
d9e3ab08c38122e87018bccd6c3df2b88d731ac4

SHA256
ed7d7afd62231b1aa083fae7dce499b9557cca2de173e7ac62b60032dff10e3b

SHA512
15f8da5bb722037324cf9d9f1cecf73d210e5931a56bca45ea89e8a040794d0dfba74f15ca056d4b6413a8576e81da791df9e63a1e38e3ca23b291ea2e6ca437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1f79805ef68fe9b80d5e6e1e392c1bc

SHA1
4f14a8dc15a02f53d40d141959874949ae5b3c25

SHA256
b7cb4948386fd8038d8db1911e4087e354b6ab3bf9a7566485e028c6cf887982

SHA512
7bb5ae4e59a96579d1bd22f18603018ed2612f7ce4d14c97077e720549cbc80193406786bd46d4e555d5770c3b8d281fc389224412d7b8cb00e2b94d13c24e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04706080dfc261fa0d999ffd4df0723b

SHA1
38af868cf14977bfb07d47d17c6148ccce96df14

SHA256
a5230343a869d5fc3fb796efb48e6c00ad41077afdfa04e11da37bcf870795f7

SHA512
6bc50a03bd0779d4004e73405ef4d295c98eb47eef5066a3c0cbfa8ffeb04a1cad9a762589e3d71bf26a97fd6e0f6df57d66d2b67a710b132de88311fe81c8ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4450c9016012c64fd9aaa1105f84c16

SHA1
1e3c645c5c6a17ee263c0222d87642b605a908ff

SHA256
3a15240751a33de4bed8c9e1f7003a2d9235ca792c791f3579739c0601c94bdf

SHA512
67d9047bad976a60a9f03b58c8a4f51cda1dffa0223dcd60c887b31923b3e27570aec6a023fc16ca17b5498e2d58752f6203707caf46d73491bfa7e48e9fe734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d00a404f500f847f71a5cf20e0a6878a

SHA1
b229452056a764813c327785acc14fa3fc8b3b42

SHA256
5ac6e62f31124505271a7750c075a133c065b2b1edf68696589ac488df1d9ae6

SHA512
95eccc67694bea07ff04d4f45203b2e8126ed415a10b3dcd0add290fa82cbf1507028ec8e95c6d6b80f98fe73b768f4ee24d6ac64f974a66ac3d0bb3151fc8b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3d08478cb5b98f49ce550acbbe82284

SHA1
a5677857ebdfcb0ba49f2dd7dfabbd1134455d42

SHA256
5adb965aa0d28c2e071aa8209b3bcc95eb7d7bdf24ab64ec32abbef896cb9022

SHA512
4195bc8159d5172ba74538e11f60351efcc0a8b3b9bacb82ba547d9f1f8527c45216dcf2842e12918c3cbef827d8725efb20936cdfd2534de73ab40f3c4834fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f90052e7d4a7e594b9b990a05ea33843

SHA1
e0e6554b42c086579179ae198422c0d53ae0847b

SHA256
e36ac656104d06775087252a3bb342314772f6037f91da538d853cb4e416c73e

SHA512
018205a66b9dee19df1ebf52d8a24fd2c255bfed705692b201ea6bd1bb6af85b7443a303c1b53f5bf4a85a17ddb6e85754d8ecba0670c151ee977dd33f43aa8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca912d38854573d97b8deefefc763414

SHA1
b5f387d566f8dfb653228770d18befd31128aa33

SHA256
125020cb09c327bdc3383e9c272042f58cdd0bd76743aad2c8471819f18ed338

SHA512
088c6fab1db8b87e2188fd3bd54b7932ba9f083ea2eb990244715580a9527e5d749288de49fd74ca6d93bde046ac6500f11e7b35bd3f321d45e1f96e78b633b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c06e1778c53cfba7dae3091d200ddf99

SHA1
56c4b1add6262050cad53aee48609889dadc6fae

SHA256
fa8e8c56da29a12c18ea5d9e5283daac154f0b8be0ccbbc30703d04c1719c839

SHA512
6bb8e5f12dad572131673455c82d1d59fcef704b0cc43d7f0a2f1e4fad670a05c1882290862f8f860e3add41c98d10ba22b3a25617e1a27c6102427bb95dacb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c4e6f903fce66a96ef7e90172fed1e1

SHA1
3e00f03fca1be022eef74b97be1d9efdf80e6e1a

SHA256
32b162bf7bd9bf47bb99dbe413460ab0a09d140aebfe9df54747c43711257bf6

SHA512
bcb3a0474043eabe5656f5bc59aa35f69524bb102465bb8f60d8b5ab836f66db7248c013877ca941aafaadc8d5492556441d87914aa5490d96b69aaf85848ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79950a87a3c018f2f3bf5c0ce1323ccc

SHA1
12cc763d9a9ad6b93c9e9cd87b8b91ba5994ccce

SHA256
0938cb7ec20c9f999f770ab256cfb7115f196f6ff77dc0049690a057f0e3119d

SHA512
f888e90d5d106d4bad52599ed6678a1dd4bc9a5b37c40a302a63d548dbf84a0b8d048a5e76c4f0516920b26b1860ad6d9d87d2807d50e71598e05725d0736b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c515baec555f6cb0968e59900b7be52

SHA1
5ca25e17ab499870f45e52c4039a259301ebc042

SHA256
d2e5b8b752a27a2fc8b4dc4bb08eb4e36bed5e6b965e683ed8663636751b8fbd

SHA512
191aa5e03349dae42fc10b8cf58eaafd9b5775de4ffe80c5d5dbf079f3cfeefc96b9261d11938af07ff8c4ae19ce22543eee032b1c964b89bced4a05d8d54b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA7C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB2B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit