66fcea6af216f5c22ce6c4b35c8539915177ee8bc18155214cef3f06b9280495

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0896632f44dbccc3e805919fa1454192.html
Size

997B
MD5

0896632f44dbccc3e805919fa1454192
SHA1

ca7d982e9c2c6f664170bd172bf8f1f983788c93
SHA256

66fcea6af216f5c22ce6c4b35c8539915177ee8bc18155214cef3f06b9280495
SHA512

9ce6e1afd93d65a70915218cce2bfc436c37c91d44339223b680de462c7962d6c0d2c3f132dc7dc777196cd842a08b7a917dd09faf0dd0069878fee1c0739a47

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42649CD1-A759-11EE-8459-F62A48C4CCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000004e56b3fd46f202c8670b2f8d6652a86f618d9061420c266f9c3b278c813c61d1000000000e80000000020000200000000db15286a22ff2f0779cb24b2cf83f3338f607006185ac16dfa98e4938e04c042000000028124e83ba3ea197ad43a9c4c0bebcb38f331723adc4788036da5f3d147cbd454000000044a8dbc52988c88c51e40414ac3791321db4a03eca1beb466dc670dabf001babff06ab39254b057115d32ce69bf00906e20fdecc31ab8ba5e560072e289680d1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0faef16663bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008f2e29e568d407d1af75d0cccb65c7d927a013fc5f4f4600c77b921964161cee000000000e800000000200002000000050b91a4366fa3104f6c512ccee1b15b19ecbbd9c9bcdccc436194c43a381b96d9000000042b1971dc69806a17e99042574c8a9aea57a3222c99f7663cde8e8bb901ec47a646a09391a97253ec88b165c495b26c89b9c6dc230e9c9ae1c37583caa4054623cad461c3083dfc011870fc0f982884c645a473bfeec5e05056edb16e5540a7c1bb4c86f40a69955ecbf4d7a26cbdea32162a3d5815830f9e1446e3a3e0ca2c4b5b83cba6d3aaf155262bd8281763b384000000020dc67dcb225687b9d5fd7ab4f884329b437b18ebf4630b3461d40cede0f94f62b70751ec560e7b676f8e58a477501967fa2632f33c0fae23fa7ddb7fcdff562	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410133104"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3064	2928	iexplore.exe	28
PID 2928 wrote to memory of 3064	2928	iexplore.exe	28
PID 2928 wrote to memory of 3064	2928	iexplore.exe	28
PID 2928 wrote to memory of 3064	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0896632f44dbccc3e805919fa1454192.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6dd1acbde92438e37032ccc2a9e9f26f

SHA1
3dd217b2ae4d1b0539dd372fb5c7f105d15b4669

SHA256
a8277a48a97d479fb686f5f83bb4578d079f2058dc907d8723f25715449f6bf4

SHA512
202f69daf7c1c64ae681cce22c30ebdf12db85ab6a01c6f054a4ef9434d926369537c39361026b84861401a73b9a96984aed2c4fbaeb6777effe0fac4252a743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cde5ab515bbb718fa58b6fb9fac0d620

SHA1
57efac26c8349c42e02974820803b87bb7e4dd70

SHA256
ee9b657f3b31074ab3a18cd62564039436f22613fd8753df78bf4ed0b2b758c4

SHA512
1d9a924ba57694dfd2abf0ec4fed3aa2dd5a5d9f1c4ced0d080cabea8a19b79ea149438614c168dbf869867715fb7caac5049f221aee861bd3ee54fabfe13ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
efa004717e2778d04f67e5c91e2b9758

SHA1
c2cbd0bfca43c84644eadfabbc4e6df8824303d6

SHA256
8618750bcda2b982b39f968ac9688f794e16a2161e1298ff6bdec18c261a7660

SHA512
3f58edb36c2193803c690243f6bcd2611efe9e1f962b9531b9f0efe7148b2ee06524db014254bdb185c1787a43d524ea7178a2c8987ebaba90878a70e69828b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2e5c33bde732c79654c8e5e49fec1181

SHA1
8772b70de60160412845b50da53d67b2e28dbbdb

SHA256
0b8befcb3dc606ab7e8e22767a20700ca00b4459bdda4c13e037439b6f735035

SHA512
14e6711795f603507eac10c95715c8689ff1ac6edfbd160d579889e0437cd1e9252f70a0d4eee0b22ba5b1529fbc3d488cb8c2749361a5ccc61c58e2775f74ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eadc8e43b6a987e600d4c6c3d6be49ea

SHA1
fec0a312fcd47ace0cc1e2c1f1f0611ac24717dc

SHA256
fbbbcf00a14752acdb93bbcf3ad2e5f68371413493afefcd9a3ccd7a09d80de9

SHA512
90066b8c25f4494129f37c07054f11597155ce1ac448b28e2af648dfff0377f2f89cd6dacb36356d3e9c5d2ea470208587b1e8a7d1ce918a67f2b9bfc4aa8e18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2b7fe133bcc233c407aadf8b7b6ba92a

SHA1
faf0eecea6265d0c2509cb2c7da80739393df323

SHA256
b69ca2c8a334fdbb802024925654f5a637d6fe391c0084864c4e18ad27bda2c8

SHA512
c164698ae99556693eda5c739456067c765930bede904dcfe6cf096c73d9356f5cec456bbbb85a7981892791aaf9911026008a2b5f812ddf05b2ad832adb5eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6737532ee49f43f4aca563bfb5b80910

SHA1
9f6594380d7f9acfc166f88caab83da88cb0a0c3

SHA256
3d457ab9d5b615e7cded4f32a7680c6305b154efcaae84563a86017fcf02aeb7

SHA512
93446c04314604c1ac51ffbfe67038d83e512b90a8f98526eb018d68213113c69d046a24b75f683b6210dba15b738c3c145f3297b51c2d49bee69412ca4f6b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f4ad3de4d1359639771bc4ca7b240b94

SHA1
fc7d234f09609c15d03d08c8d76428784d0133a1

SHA256
88c2235f0fc1e492f9cba0bd564b54e38aa95c89d87fb1ff3e99537c186990dc

SHA512
c463a6c0e8cb7394b8e381f51d622f4de9c722b778aed57fd51e0bd5bc4e2ccf88348b6b910f71e19ae14a3d3dc23769b067554575badcbbae297edd087e4899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
221fe7211a63223b5059b1242a7ed9e2

SHA1
88cf1a0d2453edbfe8463f7e1e5f87e87e4e1beb

SHA256
84e548473c09cfa7616ec81d4c46bce53c03900391fae796f7deb7d280456322

SHA512
299d9b4d9ce1f9f2892765086f07e3cfbfdafaa862ae2a000c8ed2cb290606459bc07d67f67b41956afe8e5e5291b5380d6e7a59f13efb44eaf48389309c5a8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b0705fb8771ee7cf28de723b16b2a0fb

SHA1
6d28a59e1e814b29ace7a3dbc52be7db93ffc2c3

SHA256
330df65caf8535f12547fca708da3d1b40640d19ccdb49611b4bb2c1ef21f947

SHA512
ecb8c1fe0b50e9a653c54aec38d9930773f9689ea45f06e6ff7748c288c73911b342b27779e15980a8abb131ca8c771ec8a9e5d6eefac96dad34d33cae07415c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1208b34e721595e53fc604cfa5eb50c4

SHA1
c91331bbdcc561a7790ac7ae69edb79a570f4a38

SHA256
8f26dc955dd1a75f308d69fd2c64732788190039df2b69976133209dc754127c

SHA512
3f881a25b56371989c0d2701f39f822301950c896b49070a04c6b25de9ddfef2289948bce5e8b14d3ffe42dba73231355cf4d1199969f37952f386b88a1489fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
91e173d48ce40a30d65b187c5081475d

SHA1
4dce8d6498e255ddced916914e030fd7be2ea391

SHA256
868b9d3c3ede0ace51b83788bedbb413bb8e45e0b261fa3dcecf0b396b7dc54a

SHA512
967c6ed041267693ffa01d882e6350fc73cc96a7800329fb6b9d7a793a96ead0b970310a6890975ccac61e93ec2eb8c27505501830d19c4ffd41db3942c441ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6a4b89bf4ae72c7cacea629379fbb6af

SHA1
e226a883f675a0e0cb5f556d3b0014ff1539aad9

SHA256
919930a0f3b02c005de559faa1b7d185cf3549ad403ced2954c1d5a9070de654

SHA512
25b34c567bd2da311a427d44782471ed74332e07ccbd171ff57867f44ae1699045b9aa5b34f32c1e8550982eb2fa9355b6e441b00410167f47abd591433205b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
38a7268f49b9aef50f70e393a1aa13f8

SHA1
daa3e9cb443bba09398dc6af2dc1582a5a8532a5

SHA256
0e980d1a0c17b56a03d82f470d82465f268e99096e1fb4bce5c7f263fc8ee32c

SHA512
5d979e1ac21db708a1de088d63c399bc85576f7b49c05361a49af875b1963290789e00490835f7509da4ab991932f37b782fd11797512630d23e991860a321f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3865.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit