2f9946c479c27e78dab5ae5e1e03fcde7b0dc467d755a9f1a873c9786b4b141e

Analysis

max time kernel
169s
max time network
209s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e7afc48830a07505e8346c8386bcbc6.html
Size

12KB
MD5

0e7afc48830a07505e8346c8386bcbc6
SHA1

ccbc1a0ef1df8397b8aa8848fddaec10211653c3
SHA256

2f9946c479c27e78dab5ae5e1e03fcde7b0dc467d755a9f1a873c9786b4b141e
SHA512

cb167b7ba8936d7a5b012d539525a7b2a7f7022eb3ba4cd5fae638a175c841ea880dd1f04e7742eedc9a4cd49d6e254ff507eda525087a0a01bf501155699818
SSDEEP

384:ch+Zs1hNPNld6rTyv6Rb+nQKrlibQmYMH/pMF1E:mHgyvCAdhi8yfpe1E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000be6ddcdd3f746f71c3c9335c53080bab64124fb202ef6626474ce3008e2b9be0000000000e8000000002000020000000aca7a043a1a07b0f5a309a100b1d95d48a930579d2473f3822a3b45fa05fb3ee90000000320401591d9ca9e23be3cd6b84e2149083362834deca2f1f85df6350362f6e197726ae225d7dc8a2462673933bc5a939cab40d670008f066598042e75dd22a4648f51973cf0543a43049e4965a6042060693c2123ea90e121138cbc69fb2a78a774d882f341f59bbad94663a9a4a4e6479b7cbe91dcd1f0c36c04d9026b0fb8eb7d81430a5b7b1061d27db5655992e98400000006f0d7e2dcffab9d00cac8c0c378db735b2237ccda112099b96eed5dd89ff91cc49bbc8920f4e733526adbc4901b6a4e88602a1db60adb57339e7a1b639c2a72d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410136049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B09C460-A760-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000806db18f7303c8c6e29f5a0fcd1f11adab6c56308fc3d200a88ffc99191554c5000000000e800000000200002000000012708dd82e008fac0089f73188d0435e31ceb30c241be87a7f4baa1d32ae6d44200000004fe073344d15517bf7a2c56679e9c146885869ae6617f5c6e58d7c679c97f5f640000000fe794fd2e1c2b9cd8d7bd0a02f25a760467c03217b7456e0cec297806ca4c5e447f06fa20b1caed2a18b655e55ef86fffa53fc6986e1edde0081af24a2af2989	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706586016d3bda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2560	iexplore.exe
2560	iexplore.exe
660	IEXPLORE.EXE
660	IEXPLORE.EXE
660	IEXPLORE.EXE
660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 660	2560	iexplore.exe	30
PID 2560 wrote to memory of 660	2560	iexplore.exe	30
PID 2560 wrote to memory of 660	2560	iexplore.exe	30
PID 2560 wrote to memory of 660	2560	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e7afc48830a07505e8346c8386bcbc6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3c0a6f56fa902e60ed718c00868868e

SHA1
52ecd09b9d3ad188a8c6ba86c73582ecef0498fb

SHA256
d5a8eb2d4a4f5c80ba8772275b9cc298a8f6da4a17094bef67f072cefb6fe5a0

SHA512
73c10cf989df7da53eade08093db2439184cfd95ba0a0c28bba08058d9d67e45032b0cceaeddea808bc2e93fc89801f638d296918add6287709baa30e61c7d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be326c7a158414f6ceee02c6340fbd2b

SHA1
62bc8a29292372d6a8aeb255c50324b0602adada

SHA256
1ed564de831aefe7b57fb9f9646cd2ee13939b83e51ca7e0ae3bd731c543fc29

SHA512
aaf86ab228c05aeda24ce31ad77b4faaf420be45a32dac98f2b532348f6eb383baf46d58a8f05d82f8386e0e8de8db5630f1b7580ff383c6c7dfd39c864fb3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec03b264862690f5f6c84332126ef99

SHA1
a5c39dfa2da7bb8e94a815b1a5f943b639bef737

SHA256
1298c2283579297338c9104df4e4adbc8ce40fcdd8114dd7e5f66bfb6d92e98e

SHA512
d8a078cb370e27268d5f037d17d337dd7bcf399b71a9e12dfb9ab220d6fdb6a63a2c6a1f14b64287344eb6e6153456b1c6e72df707a9921b0b4ebd6d21b81563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f44c68011c34db129003ca459317fc91

SHA1
463a4bf93b27ca0a2e50c4cf2f4b03a3079e7039

SHA256
40a1b5c300c34a557c62fc704806cf9e9ff44051e841e6df814629b4751512e2

SHA512
42973676cac28923219f176dfef1d25642a2e39f194d10d73e2123c902043355c8871b73c1af0bafb14713a6bc8d313739795910a329453e1a8c780872a346df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f4567e55c42fc6eb8f174c8e0e28c77

SHA1
c9c25980a67e338ac31fe4a9f3014bb8fb69d5e1

SHA256
108b1a123997951d135db3b9ab793c37c0f5ff86eb40be94c4fc9dbc99521209

SHA512
07e5a384734880d9d37b34e020db9ca371ba7e58a02f7f0b3fffd84a6bfad2f3b5fe43fd4411a0118c6e50c17d16d48c36c15d4e084611376683a71d08c4b02b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aec4c7520f4890f7b1e9832f8f347cfb

SHA1
132db693f160bc1aa7c2d7ba6925d378e7eea63d

SHA256
f401f79c77098530295d064331a1a5247ce127ed3cac806159bddc322dce16ce

SHA512
055bcca3d80df9c839796dd4d9e97a3d848ee3996318f4bf42ca59d28f96e3249056bb94b4fd743c83bc0f80975fb96c27e19eb110580db8e70680209957772f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2a55fea1a7b18874add515a56de8fa7

SHA1
60a5a0b5caa9f18b2ae3a6b033460ce77c3b4059

SHA256
7d41ca23f1eab0d7f0f14cc8eb25d0ed18f57fd5a88f6b264949610b62a02076

SHA512
1463d8784c4418a031f22a2f3f0d8b8b1b2a380fd86719357456a08c2494ba4e912894ff53a9abe64ac2755786074fd27b301942cd0f809a85471f1be1d10288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caae90bf207659e069e2337eecd71072

SHA1
ab40f76d5b42b337d360ad9f25bc18de36e1e257

SHA256
e0c4baac6a5c8f1ff742c15f2fcc2c207666bc218a5784f9746aacb0275c32a9

SHA512
7fc561e6481e7e891942dc09df766083327c9decc5605e8f43ae50f52c9047aa9182dcda5ff825969defe3a91f4d4bccab97f32c89bf2475bc178fe765d2fe4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
762ae421e07216bd1516456351766fd7

SHA1
7035d17e443c5919465e5d475cff0aa61c92b413

SHA256
dfbb14bb9ebd6665d65d49f04a1c22fb92ddb5b1102add6bcc4948e7c6aec053

SHA512
706f2ca6c728d966bd227bafbd42b7387349688d3fe93dbefb7bbae2bf030f7534dd42de43909f0511d7262fd44b51b9288f5d6841bc5ff00affa095ddf8db91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91e99958aa57ae865e73282d395b52d0

SHA1
d9faa85bde0d471951af2da7783291148c8642c1

SHA256
b478478ead84c5713a234e544d996ac3155b136a595065e6a87061290f49257c

SHA512
1b14492ccc8a86180dbb0f65b110f3b0970b88e293c4be20753291f25f2a4561d35520d49b52d965a75bafd713e18db32adf4672124ebd1da6b6c8e05e6d5247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7aea92c207108ac889a4f1e6f7813bd

SHA1
681c3182d81e2fc73f76d8d60a36eb9236f85eba

SHA256
1cae7b449cfa6b6ab2a156d7a69f8741d3865558cd6b2343601fa4f9fdaabd64

SHA512
6d384a95ec17ba1e7aeb0b3bef66c2e40fc6cba6b7575c736be39707d2fd320e1d3f12379c0ec2f9d2f3293dca92ace893a328d38f34ed7999533c3e9e10dec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531e8a7a208100346c55ca095a4e53ae

SHA1
1a0e467b180f91ece2256bd9145fc30856f200fc

SHA256
a1c78129aa9853e1ec6e0230a1190023354c67ca51653263b411fe45ce630ab1

SHA512
830f7ff16985ca8930ba45b9621c28fe3f5ee2f7e5315bc47a0930e29b614fadd9fc3f5d36391ddde363b1204b9f0dcce144953220d5a2e27eac9e873e55ad1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8381095cab3c659c7849e7fe3df6a33

SHA1
d7964fb6cd5ef98122656f6c8b7262ccf09bf191

SHA256
916db0381b2ccd02ec7b2d59b8713296b5c065692459da2380618c4228f4f2a1

SHA512
a730fe6a96198e56a5cb661dd19397691a919f6c9d357d1bb1545cab5cb19ddc07a2ca2c3d8c48b5dcd586d16a5c08aa98d50803e3f13c5dc6f67d23ffe45b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
794297c8df434eb336607eb891c4a6a3

SHA1
1d8a67aa2dbda1e9fe8c145f5767cc62d8779e77

SHA256
56e1f4c4b85c37884524b49a6b1db0c0d6a76e05ba619d0770031c5b12899edd

SHA512
e7563a4a756db509aab2d4b08cad3f1b8c53a9c5358ae3e2f0d6fb38b9c5e5e2248bee0690405628cba946e33fcc9925a27a7e1790b82722dfe6567b3f84ae55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf94d25618b1327c20d8246060565153

SHA1
869ab8ab8f032054346646034e90b730e5a3283b

SHA256
3d386a0f9c98e1266782d4833c69c785504c5447dd1493e489b79c2b2c6912e4

SHA512
6ced5323a1b429a2f7b009ccd3fdbc461ca190a638f238df46784b152cf7207330926a8c68f485febf891e8e9003b412a3b46d448e923db12c615f5ed8a35a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc88bfaceec7bc5016c5b537d8421ce7

SHA1
2dadde76d5566cef610e4be4ce11143a42ef25f3

SHA256
ceb23bd64cfcc33fe3ee23183b36c0a170a78a92124dc5306885a782ed7a3470

SHA512
e59ee61a48f44138f5adc8490d069c468986f51fdb1edfd55cf8e826ed3f2c4a050488da8a1fd216639cd9eaa394994cf3d199f14cf12ab8265dad5939666fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF9F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF02F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit