47f87c3d481fe4f83a7df5e0e39861710a590be51d16ecdaedc444b0677eb7a6

Analysis

max time kernel
147s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d934aef1df21dee263a3ec4ccae91a4.html
Size

14KB
MD5

0d934aef1df21dee263a3ec4ccae91a4
SHA1

6f2f24e4a247d185beac2f966a0d76648e568060
SHA256

47f87c3d481fe4f83a7df5e0e39861710a590be51d16ecdaedc444b0677eb7a6
SHA512

99566e9b4e2599b24dc23bb120e9aeba0e9eaa275155bde150b0db0f512edacda1d777a3704a2bc3106e227c01cabe44585a7e69c9dec04f3912cf27d1badeed
SSDEEP

192:g0UuoWO0kzC6yDoTu1QUUoETUxYoEOK5MYf50XFmFh7/VCfkmkxuM5Og6v:gE/kzbTiUyYol601zv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009474743bb5239c94ed506eabcc00a93fac041a37bb16374f93e001ea49808aa9000000000e800000000200002000000057c26d30c722e9c3913303694d811736d7dcd6889bf6810846bc99cfeb6863bc900000007309a8adb39bd375d17da38476ea878c1a176e5bb60b23f37488ac36e445a49b757f35d77b19c746968381ba1ac658c78b460abb822a9efbc5d945d9acfe572be6b45e54a425be6f958122b022f2391e6b756369d6afce88ba34184dff0c0f2f68c293737ebe9b06e4e2bc25f22d8d8781aa971b2db8c53ce354996077e4dd8c3764f3a3bba7714351cfa5a9f6d9d9f1400000001f31fbd09034ce6691a31b8e91bbc4b0c00386a205454c13966a577032321da0725900e7aa38673cba4c9c3b8bea1a118f1cada0cda2356e220e236f550bc9a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{527F3CE1-A751-11EE-A2F4-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06997275e3bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b6f3d74f1580f595559d4a17e008076279bbd81d390c5e1f8a85e93258227e24000000000e800000000200002000000040d6b0d2003250cb66e2365faa3ebf42ca04b84a09e74827b811e68e37f3212a20000000eff96d3cac2e02c0c583fd61d31b47694416610be2e2ecda7850399ccdd1f779400000003d0dcda9479b3b5e09e5db20ff60a4fc369ac380ef0c19ac96cd986a95878b7ae9aeb31eef2c6342c3eb204f38fced485f7df2ad2126b3a6fbb8cef899a9877e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410129702"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2780	3012	iexplore.exe	28
PID 3012 wrote to memory of 2780	3012	iexplore.exe	28
PID 3012 wrote to memory of 2780	3012	iexplore.exe	28
PID 3012 wrote to memory of 2780	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d934aef1df21dee263a3ec4ccae91a4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25a73ab0ee696e0cbcdecca6860e39ff

SHA1
5a2a737e4d49b2ad096dbc0ceaf4ede5cab4df6a

SHA256
4e035ce48124789c4f01cb6fb66e36bbb3247567e97be8c2ee1005dcc47be1b4

SHA512
174c760de5d53c7f016ed9428fa0d2435afb0f9bc78ed24e0e8582d5b204e2dcba356ee377d9f1cfb13c4c6a4ccc078fae6e87ce226b4fd719c1de7546b5115a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3f6b30d8787251dc5a0c72b55bf44bf

SHA1
184da7ee56b0c3051b4ffb9eefa1cf0fed112fe3

SHA256
1b815d533fb556eef941276181dc3bf40dfc3b9d4d0e77a79a5b7e212c22d8f6

SHA512
bd3144fee41b77ce8be361f03affd3cb84b75116cddc9233fa0c6015b20be83cd526c70098ab223ff87c3ca3179924890bc328bceb4aa0d727e884607b342415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8253c189dc86fb66d9e717ab9ea4ec56

SHA1
b081afeabadbe0a192c2bedfb911414040d6fef5

SHA256
4a06f599130bfc228c88f87bbaa70f75257997a2f2d523ace714185588631a12

SHA512
688e5e30ff8deacbb9d4911c2b276b4f75fa6bbbffc62bf06f387121c3c495b39a54e6218faaba40aeb898cc4bcc54673ae4fddf17a3914529ab9c55bd406504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db64db8842c4660f6e2f55fadb2879fb

SHA1
b631ba1b31323ee9aa9891bb037d704c90aea74e

SHA256
2295422ec4a93656420049db957ab53b9fda3200a89c5558649322b886675f34

SHA512
0a034d790c2a60b99a2c6a2a10a1c2157f84afe91ebaebaba675755856b08fa2e4e275eea8e7cfe169d6f35bcc76fd854a7e8d213be7716d7adedfef1a8aac2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44b3f33a78b0f62835012d02a012f38c

SHA1
7b9dc20169314d6c1b9edc4261302d77781ac28f

SHA256
0e543dcbe3f86493d93484ad04907dabbea73f36976b354103a1b919a6ea5677

SHA512
fdb17f280dbd832087092898e3f8688202331087fe042e517faba0b9a4c8a4a2ed832428693e8cb2480043af6c07e0c0da53b1c4482cf56210311609fe37a793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbe815249c68d85ca9750b83fbe31fb4

SHA1
e4b35b20b065a1265d8cb7ea2fb483c53286e04e

SHA256
c829e76fad20709e9e2c404d9f50120f73d9d3a044b2887d70a88e91bb1297cd

SHA512
c50977437d6b345dbbf1ed4f666cf4d852f9d405eaefc8c7d03ec77d42a62ac78a866db7bae8dc768b82ae0f79f080b9b9d946cadac5d6505bc3d69b00dd5bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f482257356fd745a6c44ab2b801bd351

SHA1
79c372ab57062731b07292334a2190923965fb0d

SHA256
ca0dce7cd8da56003d0f30bef97d8799ed492ac93f8011733e518d64bf5ed83d

SHA512
625ec695470456765159b8407c52d24eda2b61a5208488ba1861fe8a4c55e1702c41ead2675e3d3e1ee0602236cf7c4951aa995c0bdfdbe0da6a94d13a9ae283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c12bf649512451a104c47d04a754a854

SHA1
2a8f9f6e60a5d3453a19cab4397344ecd21ec540

SHA256
1c63cb60efb31b9ccc46b5a6fe02ead4edc4e049e0032231e0482c42055bfd18

SHA512
d4e7d57c40d043fd6b620f076a3f38741d6a2f2df1409650c3479a499ee2d0b82b3bf7face872c1ae299bc2476349b630b7657fbe1dfd63e2e0d5061d7b4ad32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
453d982012835a61e0987115e76b0afd

SHA1
f521d8aab8eda818090f74daed5dd760da3e0089

SHA256
2f027f62a09aadcec185b2c25ad64c4eb1ce790156009c082fd866b963f19f9b

SHA512
d58fc2fa5ff1fb8ead7db1bf375ebb9e4cedf98f406cb3332a9608998dd9c6193d71b67b5acf8ad6f746edbc01081e59ae141a76a6a1d8be28792c2a8c978218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2adf872e7e1dae8ce77fec7349ca1e4b

SHA1
facbe4df5314503ba803bb5d6562b8491c1b0680

SHA256
1c499277ca3612afc2a24141064e767128782f8624b59b029f1ade181fae6a08

SHA512
0ad0d71248c899253068dfa39d17da7afab7fcdd72a33fd53a82560867b909bd8a519841d5f061598f8870f39eda83cb830d86a9a2d8725a8283754472dfdd5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87358afa7eea8f60bce870b1932f8ef6

SHA1
dfe18773b0e03698950037bae879faecc6e08ad3

SHA256
56639cffd85614cef0aff9d75f4f23b864747e5c3486b7a1602fc38f09bc2b51

SHA512
e7b9d7b200843c60033a60c12462cd7375c8339f8ac59fad9d0c6e668a90db9886de856347370757b27841fcb8dd85ec836b63fc8389a78d8b84566d33e34e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51210ed9fa2af7ddddc46a0185211e5d

SHA1
fbf10ea7df46786729080e190ae25260375ad274

SHA256
601e384760ba70f2a0d78cf09098914c568ef7283508c4f0f2304f4bdf8f7970

SHA512
f62d8667bba0d20c46784100a4676694acbced556e8832761925fb37175b5472de371080d7be4b0bd237a12420af776582401e856dbfd3b71b1a66f67e3b1e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67f0b658003f8f3b7e16365bd172fd3d

SHA1
7ce071449ce1766594076a5d8e99bb2aa845cee9

SHA256
5dd802d24cd4770c7c74daf42c973c7b6e4e01fe3a8f439355a6e14c655c0fcf

SHA512
4d4d9d318cb3d1251e028b46e2ba593f8c884cdc67bf49cdffd60815074f630b7a5d43317019022c710ca1269a500b6766838661f1098268377d31f49c6a0628

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92B1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar939E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit