dde3a6f10c547ff71da40059f02b40d7e265ee34479df2847800c38836a7a493

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f9e35334f28f7d47bc1b782bcfe787f.html
Size

57KB
MD5

0f9e35334f28f7d47bc1b782bcfe787f
SHA1

89a559f1f1853d781373e1fea860ada84927763a
SHA256

dde3a6f10c547ff71da40059f02b40d7e265ee34479df2847800c38836a7a493
SHA512

5d5accc13fc6558897f3405fd6bc5c64aba6a369ccb4c7617ed02037c41cc00555e0cf0bc31ff2149441aa76a1372b01ce83ee82806da6f29ba6e224212dd7ad
SSDEEP

1536:gQZBCCOd/0IxCthaUfXfQfcfqfPf/fUfAf6fafNfWfrfuf7fKfgfRfSfUf1fJf6x:gk2l0IxcfIUSX3MYiSF+TGjiIJKsNRix

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000037f8198e1e5d1a6eeb6dbc12d9c6214501aec039bef1c8a8cc305f4ed6fde86a000000000e80000000020000200000007565e62a4653a4254a7f29d2599e957bc08855dd51cd520eb0325d2568b36216200000008ca195966c12b6976c8994ec1d0538504384672bfd624134adaee269c9213208400000009bffc17377974782a5ba48ff1a0cd340fa8d4a6618ded00e8a932e200b7610dbb2610805295a23a1064a22919fd144eec267caffa16f5e2e2c89e9833cd6200e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e72f665822451693d35603c3fdb8ff679541530d780b7f570d99844036cfc105000000000e80000000020000200000004b0543ef4b2ce82bfc5f91d4fcff8b68f9967a386c8b6e83eed291ac68e3ba0c90000000a40760a2b240510e3548bde12e0793135a7d7d4bb10e178ef46835d5bf2637d892567e719f08ec3f09150d33a1d9fb497aed472ab74520c902ad10736260911cd87e5ccc37e8428ac01393198fc460ca0175bb6ba4aaff527a6778697a8b4891fb7914b76b2633b5254ca712a3ace949053f1c0e6f39fe4bb1322ae5813fda56facffa62ad97f6dee817cf3126c8463c40000000183209cf62f41cfc6c766948c3495f816f27dcdf2546a4ba5f720b189d4e745f7dfd1ab830b37c5e5597f31b8ff9a21ca063d9b2d16fd0f4ffab2653f792df4c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5422BD91-A771-11EE-9C28-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30946b447e3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410143458"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	iexplore.exe
1988	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2488	1988	iexplore.exe	28
PID 1988 wrote to memory of 2488	1988	iexplore.exe	28
PID 1988 wrote to memory of 2488	1988	iexplore.exe	28
PID 1988 wrote to memory of 2488	1988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f9e35334f28f7d47bc1b782bcfe787f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bdf89ded181a47fcf85a51ca2211cc1

SHA1
f4e5860987298706198b2bcd418c40bf587112d1

SHA256
685751878fee083002ed6a5cb5a8d047eb02839de059d3ee5c5a4824050be98b

SHA512
fe33ee1dcdda83fa3a06264b0d97b2ee0ea3b13ba3fd4510ac55db8060a4108fc6a2de88a5e40a0b9a9b53d46ab72ec740a583b515459b272cb6bcb5b852e613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c197db3c6fc7de2e3e1e9e63f03f123d

SHA1
9fbe7ff2d20ed986b253980d667da6bdaa27d573

SHA256
ff86f18364cd0141d1b221f93e035bcf5e142c72ab2e819f566c3a1879486473

SHA512
9c6318d173256a8770720c212016718276e4b2193d69d98d23dbe169cc0bab30c3c570141695e219adb436094f31e8a85bc1667d483723e397defd5b33f39bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a23ac2d3b4b43a2a79a73a7cd8d8d582

SHA1
a3d82670990480f78f2cc05907a1129447101167

SHA256
21e3f02a875e9fbab3cb5250ced6df0ed6e6dbf6a18360f473d49fdb60421d3f

SHA512
8186f809aa36db6d86801352c6ece8c27f7ab377e90a1f88a13fafe075d921ace3b76a3e910526b63704052ee16183c6ff909091b90c6ff0635febe80f3f4eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0933f76df6a24422e0bb23443e2aaaa5

SHA1
bc98da23f91e74fb303ce4037f638c5842f332dd

SHA256
751c711f8ec2f3f51d8de5bc87ee5fb7ff11d8b1cebf8dbae673a3438a4a2d88

SHA512
da8f9af6c1cb2b76e50d1cec30168dfe41c8e1976d64da2d806ba1780417f28b2a8c73b4815938301c0cfd677f5422fbf16718bc2f75ec40123d51d77d0d5912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd775bbc50ea48902f58f0430e5fffe8

SHA1
a7aaee71c15387f832b492a79b471b531fd3e1c6

SHA256
219e0912ba337bd3e0e3e1a72547fa634fee7d1c7539502de64eae68c2785076

SHA512
9b1e8989c9d97717df101a09553c5c6f1e0c904f8272a04aa57458a4b4a3a79798772045e75cb538e6f18a3f40da2ceb9404b1626e3ec5865a613d116c220461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0bde9946d7a2db19a15932f31bdea99

SHA1
a19fd7decce02ceebea7e4be2c63246665aaebd4

SHA256
d15d8158cf8be6a90fa1fe66c95992e014c830436c04741e7b063c8d704f370e

SHA512
bacf4ab78488aeb54f1477e7e4ce6ab72793daa9ae62b1941a6f66d7ace092e48b11e443e3f191749554930b5f63ab2197d26f2aaf77ab633170c3543da2ff12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bde1fee97716cb5b0d451cd8fd23ed3

SHA1
8e47f776bd2acda87453dc99b3bde0d11adefddf

SHA256
17f8f4575e4e3f5944230757ea0564026ca4f8d9b0eee2b7dd42eb15ed6edc88

SHA512
ae44e13ee8a4a3dafe10cfbe350654301313f4a6ca8ed7ba9b6c83e820a667d742efce3edeaf0cdf09089a7f38de2e6792055bae7a36f14bb9e88ee84a3e9368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3d70b4dd729e8fd2ec0225956c79e2f

SHA1
e21ef5c9ea8a4d3afde586869a7afeee87133799

SHA256
f93f55ae61168f03216bef31048ba95b1ca037b2a5a05a778d628ef6169938d9

SHA512
8990ba598cdf7e27d32fa57fe659ebefe50af0c5abf328be7ae9ae81078b7b427077839bed07aa315d7049e7740b80484f1dacbbbb75a51fabd94ab42127de19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7001c951c29736c09cf514c13b6869fd

SHA1
993a27b1d44a131375bd464fbf4295a4c53f45fb

SHA256
19ed0e7678864a77ef14f97e735dc9c7eb8a0bd73b9149c9053fa5d5fc4f7018

SHA512
c23dce5f4bb65c5b3bb72772202a8c0774d3404d3727618583690bbab369ff157a25fdc80ae38ea08260ddc696d313f3e220be2f4b35639c6a9a6d1b8cad3a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0388a5dba70232b7d3f194c819613e41

SHA1
9b2ec8818f44c2052fe00d829e75dbd7a18d8a0c

SHA256
7ed4672e5952dca7fa943ad376a224d685d6fd0f0fe5a17bc69f79f4f5765d6d

SHA512
89ad6a5efbbecf1ff3b3d046b381cf2b74ae617dd7cd68aa5de8c4903bf8914d5c230785d1d6c70efedf675996a5abf1f3dd5c331f4c8102db174cff1677f87d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5884c05de2a37998b5d3651ff9add55c

SHA1
e2ec99043a7e05164a0b10a4779129d1e81029cd

SHA256
eae1c0031ef2ac8ecb608650494b8bd5c8bd6893af5937b3bef2a1dc8f8cc0a3

SHA512
63ea0f6300ad649fe2e87aea6f3e57c7d51311c11109cd312bf1a6c8920cfd3007315615eee7779595618a20781c7e7666e702b737b67284928db7c658098dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307600a5ec27b6303c8833c4de536aa5

SHA1
2a54523cae523f0e6f464fed8bdeefe8a399f6c0

SHA256
44cfa0649da345e2c75b1599575414ac19ad629bd4fa4ca43a68e9bfa7acf839

SHA512
3f9764b7ae94f0fdba63e92684d8bf7c1c98adfb4798215884ae1af0b1214348cf4d782b6de59495ed5edd78a20bb655849a0b73a2502efabc72783b4868a136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
482a05be26aa05a4e4e7ab55f624654d

SHA1
39246f6b93e3b4d3d48ab7d28c99e25ab06df3eb

SHA256
d39ffc6c2cce19f689ef90701aa2d2ac697ed561b889834be015a05cac8a9ed5

SHA512
c03d5315d7b1b6817d81a2e7cb54cf0cf56ee29eca25b3f65ccfe16ec7e7da3963994023ba50fb8dff381e36a8f482059da1bc4d22e2c0cd69d6c70c3556137b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2de79be8d4bdaf056ed8667d8576a7aa

SHA1
844d5425111dc5d089b85b5806052e8c14a77bad

SHA256
86896a19350bea8982fa8df274e2b3fb765d91d0edf06789ec392e19aab71592

SHA512
be8104c4c3a185ccbffb07fcf5e3984161b1bd8587f9e1dea77a402d79ec7fe5f86f35511ac6b8000528db103f13858eb71de6354cf956f251ea9ab1ffae7af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bbff363cfacc18c15af008d83d568ff

SHA1
5a4a343b8fbf39bf3dadd55ca528294aca87876e

SHA256
0f3da3b655f1a420bf29a26a208747865d990e3c4d4cb21232b233852d238788

SHA512
ec1c72d82604f9a9ebc445e0f004c0126bfd6b3a312db15c4c8167c6cdfde22fc599d5c8e9ce823ed188d3f66fb2f8895eb0439aaece24ad1a922e8206021af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96adea2e9973aa2eea332ac048a8c591

SHA1
ec00364be390a820af14d647fc7a2adb0d253799

SHA256
15a11cb018e7745f27708bff1f4bd2d12413f5acb431f3c95c04eb4cbf759487

SHA512
7b40f5386d2bea830546ce0adccab0e8861fd628f5089298fbaf0d04eaaa725eeb25530c92ea2fc6aa5157b75b6cb3f2b0e9f0ce710708d95e30e364b191afb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab511E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5150.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit