5239523b235ed73c9fab6eab130114075a37a8b63bfd2b07a6e2b6c371d38eaf

Analysis

max time kernel
184s
max time network
210s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f32a25d2fab57412202cb72648a83c2.html
Size

2KB
MD5

0f32a25d2fab57412202cb72648a83c2
SHA1

69a0fd3b3e545fa2e2e1a2bad8cd7219d3d1fbbe
SHA256

5239523b235ed73c9fab6eab130114075a37a8b63bfd2b07a6e2b6c371d38eaf
SHA512

69d0ad295ffeba05eef9a77d634d2dd0a958f1c5a7fc328528bb5160d53a8dac219aeeb49ef603d1fbe18d54908af773709aa6e72e4fd8a6727205a16004abb1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410140758"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80260ceb773bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000065b74df0550060da4065c6034681690fdbe7aa719767dbdbaf53e943676b8581000000000e800000000200002000000083031daf9db3f45fdc1b6b6815ce8ce0734cfe8068f3ea1ff06255c8918b027590000000e659f2445d7dbf0dbcb3ff650cefec9d894795327b947740f34d4225dabb164c17ac741c12e182a7eb9b24e945480d412058054b2f7185f1726b4205d999c8fb7b74234ec36c23f85485354a6d231f3b352b6082092f51d972b72ebde058c4a9c299718c2a9a04645b6efa8ba93b3f6ebd723ef6779cade3e12d18a75aab4cdf736cd54d43bf353338827abd50951ded40000000e09a91844c266c01a94814972ab0485d5b7726409cede7f06460c463f5746fd3d75a630c72f49152b282b0ed049a2fa419e6621521894185c61b2006f28e789a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000867100a89b416cb47e510ff93a44bba5af7f2857294d9ad653791355d5a61767000000000e8000000002000020000000a020ad4567e2dbed909989e199efdc741422c7a9a29341cf158ee5d296fec42c200000003ff015d49c1df725c5f0a2896a1dee9169c19cecde92de4ac6abbb28c3b46957400000000c73ac69f0e1ed052496d689f5ee409e5bef56234d15a01436e8ad08c8e9fbae197800c5d43b6aadd4775595d16420dede3955762da0429a7d4abe58f03941fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15177471-A76B-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2640	2852	iexplore.exe	30
PID 2852 wrote to memory of 2640	2852	iexplore.exe	30
PID 2852 wrote to memory of 2640	2852	iexplore.exe	30
PID 2852 wrote to memory of 2640	2852	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f32a25d2fab57412202cb72648a83c2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f80f3b1a10d556df31f1c10af8e2958

SHA1
715e582d3c503fd10737b88475c52b5184db4dc8

SHA256
a9a4bdf235e06cd0c7aea77e74a6dfe79855377aa4404bea33626b62efbc16e6

SHA512
7cc870c818eb3cf88b0f52bd1c9c5f78f59a78f0324f64d29d91593d38e24aa9c3b9fb64eda377fa0491ac4cbc9bed09ddb30bb1362cf04941d9e9b2f4d05a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c463a570065fdf8e70086f54f962842

SHA1
d9e6441106c0c12ce3da04f07e304930395f4912

SHA256
a502d77b2d18a422a8f43436914e79b7bbfb2f68ee473ffa44391adfba207baf

SHA512
01405bd5eb33afb69d9e4dce88219ab05797cfb40beb0653f1471040f7b60bd36083fb1358deac60bfa291daf195d3878d78cc637e9bbb0d39333919248f8c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3c4e74e1cb39e22abc38a6a235e962e

SHA1
1988193c5b5ad37ec242a130c21a17916aa9123e

SHA256
bea2684724671d9f9c97ba84727e2c08ae1d2f4824e30ce700c1fedfc4982c4f

SHA512
52a1344dc3b0e86ea9766c961faa8bfa007305c6d0cfb7d2bf4bc3df0082d06f75877e3ddb705d21f09a185c8fdd033b5c2613ca5085b30c74aec84f716a3982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
495fcb4eb8df1c60f68dd5c196ce26d7

SHA1
70f749fca84276a39e1e089fb5faf1d143d24cc1

SHA256
8c80bd2085f507b873808e90192e4f924fc01e6ca7c408c391bdc04b80e6440b

SHA512
04e5aaa346d88fb7ba22547e769a08ece82dd5aaf9e2a463720ad23f01da9c50989051f21b9a2c7e7fd87b5a88351b1f9505219834944111528a61c8ec4debb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d62d4583dc6377616a147f73d0f2c02

SHA1
1e8cdd52be60bb4ec0aa4727ae6ac7029fd7a5ea

SHA256
9d987666a3eec755bce94f8a02fa4fa30bb6395edb7cd28905a58e06ebf9f2e5

SHA512
2f730378b58cc677bcf6cb413828d4d75c507d1926032666a26a4005e732d9a9dc7169403b61f92c206b76aae994a631e75d463431b3018a0d53f4074d8eaaac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bccd409a67fcbb6584335239db4802e9

SHA1
afc8594d880e6fb6ff3debac97eba76ee3cc2c8a

SHA256
2a630b8f710d5715b69bbc9a4b7eea47a5b905ca67212e6dba6e1dd71e633deb

SHA512
94fd65a2555853d577fd67a5701f72e36c0b035f5e53dbdbfd2a6d495e926f3f39ad79a18a3f100825a93c9022757de6415b287fd569e3959257813455b01963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53be65faa3ef9a623e4f0be880f288b7

SHA1
26307b79415a7d45dfd2678210262d8f1ea182dc

SHA256
fd60f7a032512a03d3b47fe65be68f1caaf072884abef27a5a186451e17bffe5

SHA512
5fda1a8bf79b6f008c919452b81a456085431a812b09dd69fcdb487c28d4195cfb4c44effeaffa7b6c50f18643468734acb15bd2af909d69d8566bd55d17300e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d85d643b49d429e5799a000e759ee143

SHA1
d72e317821a851a17a063057b1031655688d1745

SHA256
a399ed171af774f9379f659b6981fb6e625b50e1a95ea07efde4fd46fc7cfcd9

SHA512
ea61d821d95d34628d8b7f9403fffc707139f2628f8481978f7c60b3857b0b0e9e610c58dcd60988d5ef546aad75f55bc347b65b9d8e71765aad2682776142a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63afb235c0fd57747b27ca68add580a7

SHA1
2d45ad1bf9f5f50d915425d0f801c7565cff025f

SHA256
9919ea6272172cb5a387169647968688ba1e4c7f0951ab3f6b8423d328ee3873

SHA512
c689062775ecfe511c9be0e57efb328022fd38e17716c0b682e852a0aaf3bbab8d5538eefaccee666aeadfa8911ccd7421f87b6ef1614e7fab5f824c4c5b5623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20dfb27606b91c2e8f1701575ea696a4

SHA1
bf047cb697fa305b6111064e1eb4a05bc164a701

SHA256
33a5cac718a1cffc8dcb619adbf1919671cb21d28a3db83825525602771ebde9

SHA512
e3ff25b31ec2f4d0f60574c47cc430cc129e1e5295603da5ad44e7006c1026f386b470e1768ae1d6f385886b6bfd475a91fa8983c0d457ff22d36090d374081c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cd7bf22f31f0b32c3ed2c6cae527cdf

SHA1
c1b1548dd489663a6f22f0865556630bd30ab903

SHA256
519d593eafdb34dd6a6a85a9fec16e4d72c2bb3783d81a5c2662dd700dbc7bbe

SHA512
0b932b3761ba50bb55e747b574ec29a39f742df41101747ac3de03072f35a4e6183b7af2568c7f971386a57d3f2904c77f956c37c8c5ac3e321bd2fbf5880e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
678d2970648c7d3eb3ba80743a3c6ce3

SHA1
ae5b982c7165517895bb6d707367802d737265f3

SHA256
fd35197172c490b990b0d85cfc1f6641dffb571033e9485585e2de0ef5619ef0

SHA512
a9a182325cf357c8ac64508a2024a6c4a1a90342e87edd5338837766c55ce56f805a732f4b6afa16ec5c37b458325455710c5d9818c0bbbca391cab537f29f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e28941f308b15bbb9d08671b4b852bf

SHA1
b1e9cacaa9cb6031a7c1ad89fa8b9e1849d35e95

SHA256
64488bac1a20dae7b9c7059f552f8e38d6036b6ee97ae1bc6ea44faaff6a5e5e

SHA512
655f5e1f708c4f7c9c12cce8de0bd84fc63574ff6546300527a04147ecc0f8aced2037e7efd57b2258503df717039995b638aced7f29a5957995dac25bd95cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c80225cd202b6d37dbc513a28c41552d

SHA1
c1cbdc3920880849ac0e4221d7b74e0a842a7cf1

SHA256
f2adb33413e9946e9c7067bb4cdcc79346cc19d63cf603457d0c8117e5ede86f

SHA512
93d995a8bed1f3e04444b740655de074584b765122bdd105b41b2ab5d944f6559c561acc6e641f2b4899874a7078cc7e5524df359ae4aa34f4664dd9f305ddf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24702d917f5960b384cce6ccf5f2f17d

SHA1
6a9ce6979163ac4aae9981d4ed756bc87bee58a0

SHA256
8513a6bbc695dc5340e00f57b699b0da51d766c67a420fabf63ac4836e407ebc

SHA512
8de8e551789d46317d30c7a45270e5958dfcb6d35e55e1511c6e688724d144ed878aff0623ab9c3a7a229cc59a7c2285c1a1be8e86b6ace309fea829d1e51880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4507c6aedc9bceaf426704cccce65ba

SHA1
13e5c38941e2ed5032908d351514b187abfcbe49

SHA256
2f05c0138a9cdebc3150cff2c9252ec8cc057c831352354a1a2efc8ef9229307

SHA512
60547f3b13136c699e8315d3361b3eb28796c49f9c9683259e8927365c011407d0bff8290c9edc1e74a48339bc6be41d7e0208a85c7cacf867b12b303b164742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd234b2bab4836f5d9a26e171c653274

SHA1
453137c4c68418294079f435217a15a9cb644895

SHA256
1644c6103cb810b08be6a8e02cd6677813b25ca64cb3b1dcad31ac73a2747ccd

SHA512
1094555192e8fa94494c2b557a063f58f583228f32b6ba87661162b6c6e621f98176b3bcef340f5b43d81862632c019c630826804eb33d76dacc59d3cb8db866

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab845E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84FE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit