a8bb27078779f1659cd1de0a427d5f35ba996b7cf9647ae9423f3d1d5ca951a8

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1052125cfe586f2fc0273b0168a541ff.html
Size

40KB
MD5

1052125cfe586f2fc0273b0168a541ff
SHA1

780257a6a8cdf8c65ee374b5a623eb5bb305d480
SHA256

a8bb27078779f1659cd1de0a427d5f35ba996b7cf9647ae9423f3d1d5ca951a8
SHA512

add61750579082d22c160b9613acaa3442820b5c23dfda43bc8fa62b38ac5f3a7af7610056a90efbe0693c7a5e28ee922fcf389ed82b122affb7e9cba24b6251
SSDEEP

768:LNd0x3aq9tYnoUsupAVnKIWn/hxq6CW9t0Wh2KqP9oxibrSmvPt++VDwPrOaFijc:LU2h3q9o8YkY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC5686B1-A84F-11EE-890B-76B33C18F4CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03d9e935c3cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c3f987f7562fafe71be2fd54e2514444ec7816cee9689e53bcc933ee0f4f38c4000000000e8000000002000020000000a6ee9e81f411c793e8049cd022381db8e7249582bb3c007fbedfc750f098a6749000000013b51dbb69ca42dcd69a3e3473578735ceeefe0705dfb8e1caa265827c2cc23854bff5375a231cd67903d8703c224fe79e3cca16bfc88264ef008ddf4f32bec0ed55ab452d51613cfb313e296c2a5994a03925cef02cf76318f8d874da3069580a8048cadeb6c45c0d0add5c094dd4a1f4442c1a619d74297f39835576b4d1a34794f365b4942d54d63b819d589e8ffc400000008f97e25a002d87bad7c45e1d04d72f6d2f21b4ae5ecb12968ab54ed8a72d4e9da86a8e1c5d3b88a11b25642f8b49b036aa8176f698d8126fc5f0bc82d49400f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004648070cd7c8a4fe50edb3e78119edb33f8388640da5e497b50c91e311fc4885000000000e8000000002000020000000c8859b9a4749676463d68f91f7fe30bf68ac7dd6a545e73d3eff47dc5c0cc94520000000757b8ecfaf6114fe6e3f93de6d6c410a761edff040c21b8338a3c7272b5637e240000000ba6e0a16ce903f81adce5b16f231f141c027f03d90fd6f93a028553e1f8339881789d9d4dba59df2b990cee535d9bb87236f23c485ef629617f1971b146ea558	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410238962"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1092	1964	iexplore.exe	28
PID 1964 wrote to memory of 1092	1964	iexplore.exe	28
PID 1964 wrote to memory of 1092	1964	iexplore.exe	28
PID 1964 wrote to memory of 1092	1964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1052125cfe586f2fc0273b0168a541ff.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8896707e62c4a96b0fc384b1e374679a

SHA1
6687f5fd8063ec2ebadc128986ffe2a6caa1ebfb

SHA256
0abe9fd4688a163e77aef6d674b6f7b64469efed616032635abc5dd942f2dd90

SHA512
e71695abbe760bc65da6013292c9f130ae3ae6be7811146375d3788657f8b4599d3481453e93ca7c8cde6cb577ff16e3bea50e8692b7f7504914921b99e3c1ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd0b885987c43164e181a4ef39990e3e

SHA1
e8ba200af453a8f30c92b4f724b99b78d02b035f

SHA256
1c7fb96de7beb93e335f101e3b7954543a321b64559206ff35c40769161166cc

SHA512
73777aa33fa92a3cfcc8a56b70f2825c93f4b9bec8c3b79da1a3182cd07d48c199204300417d3aea7d98549492c7306b87e520347370e3b68a2e9018fdb916fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45bccde70e8c25db70ae3939af7e5d3f

SHA1
f012377b81cdd209468f56165ddec10e712308e3

SHA256
c53faa033b919b1e51333358d5978b90be61c21ee72f21394ead44b1a8e1bc95

SHA512
f91b45eca260a25d2cd1a7609d9605acb0f8b18c34c35d2ee209f61c0a5484a2bb5e78229f74bf25302fde9db9c4cf54784b587bc22a2724596e22fd4e49c607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
740bcbbf68c5dbbb611b76849af086e9

SHA1
0cf2d0072a9d3d2ffdee6c23fa9a747edabe5c21

SHA256
242d5411d75b3f3fd9be52ec786c38b2f6dd82ab84c05cc1511bb30126e62ad6

SHA512
9638c8cec3efbb29d5cd76828fac91b845c289e00f3833dd57d30e8013641b78b51980077bcd9f455dde8737ac617c2b2f77627c842751651f0f723930a9df7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde53413dc7b4afb7d7100d9e032aa5d

SHA1
5266635500d0af5ca7d57dc2ca327a624408e5f2

SHA256
3fea4d9e1db36e4c496285095b161815ed0e833e7a0f4f0435e4e6e646ea4c61

SHA512
8d567d1e4c377f9f6f7958c2e3a598b7a5681e75a905f8edb04c981afdc36ce815bdac9fbee94e468d71bac4c86df2f9e194b884bdab119d659296922316f0a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3c642474bce46f680892c4b81a53cf0

SHA1
deac7a7a875a4be9884cd3fcc1528921db61ecb6

SHA256
799a05a92a45ac0afe83428ff2f98a92c3c7002146de4fe8b2973c27b5c26efc

SHA512
2f6eac28e0cc57b509d7abb60c8b38ba2619bf45e946b31332faef94b91ea477a134c112c181df307bb0e5e8618b4c366b34c46d0b8af0965c8199161bc543af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d95e91c3b2ab8b69d7be28baa1560b2a

SHA1
90ff2000c55c600db35d9016d4ea487a6a870727

SHA256
d4fcd529683ee556a1fa986f67c8f4a289c015ac04cfca90d3926a55700b67c6

SHA512
150b127db36d942bf45949ca74c7a301494181c946e39d00f0d13c8047adf88eeaa4a653d9606ee27319ef5be290e7e847379e3dd9f72f05bfc70e312b57ec03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92ea8592a76b5f6501eff64b52de46fd

SHA1
f2ac703746b194ec351c9bb90f1df1f2c190bcfa

SHA256
613aee8a1230529452d152dd03b1f01d714c94f1953c3c7bd5c0566e275710cb

SHA512
79a777cba994a889c9564ebcb7e3a07de526226231e19349545a3f2396abd16d1a77481a671a1cd17aa802fe0fbc4569ac1696a454b6c803d13831a6bcb4e622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
858ed4e1add39f572e8dd6fc039e734b

SHA1
86f5486ad0e8c0aac7c1d35d97cb510bb6f0ae91

SHA256
508e002b52ec21145855567133f321d071bff0c7be4ee2c7ff594aa6d9b4bbc7

SHA512
b49242f229ca06a0b603b494b96d453f8fe0eaf0679e8dc13299e55aaf8b765ab3a5bbc13ec6e1fea3228a40c27654dc7c69d15fe9f0a9016664bd3651ec3475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
331031fac56dfc9b25af80576cf06208

SHA1
49bb4d53cd0ba75ff607d91a6f3bd0a0b487dbfa

SHA256
c6c46ae11ed76935a4f9b9c842545f562ef5ffcb96a25fa3700eb0f5da9c0baf

SHA512
f72855904a4b345623aa58581be26c8c274ac64009165e9906278c2d9859c341c9378f7d12f575a133ba8e3de11024f5002d007e4ef727b02c9d022e39dd1853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d16aef06720a1fcabff03010e29aca0c

SHA1
423af0f4dc49cf41fd27227795570854b8a14a4f

SHA256
cd396f1059df978f6b052a1921a446b1fe69eb726e1a98dffc9a81e68132bd35

SHA512
973bf6bc81be1452ea65fb4206dbd31b2fed2140017fec666074ed7630818427245bffb5a8bef17b166df6e30866535346fa09b222c380d5b2efec54be8e4475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
097a235d685453fdfb685333afa8cf89

SHA1
5f75c20790b0ddfd3819a252e02c7ac380217a72

SHA256
4dcc2db883683c31410deafb1c88d60f8936669c34344692060a7785da776ccf

SHA512
42689fad3e9a8bca3e1018672eaac63972e54d8a4dbee7d1b33d78e434843d15f81e0a960e7f1231c48de2f1d2bc79e10a40961ee456164616e801771098f32b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87a2fd1b810b466063d6dcfa75a28c63

SHA1
006327966c4dc3d120e2dd71f169db907ab79128

SHA256
c38231f7b40e0cbe88d8c28055b263543217cb3390bbb183b0cf44c9538f51b6

SHA512
9edd7a269e725a493eac0b2fa57f23fca40c870857d7db9dfe9c46601a0261bf0d5715721604f8981becef58c1286815c9865af00b741541d0794fa05f1ebb31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff20fee57126c5e942032b1f0d54098b

SHA1
95f4132346baf55ab2f10b2f3d66ef213c1203dc

SHA256
b9a718b76ec037541856e22c38452f381501f41c63f1ffd0a6e43b07c02aa4d9

SHA512
8bbf916cb14f2f5810e84f313cb22b4a6881f2a84d9bcdb972950a81de380172f27382648431fd3631dcb199402d4fea4d0c187b491bea7ae6ec4182badf1e39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e2b5b1bf82b7223215a2e3021fb41ca

SHA1
7536c88e9c61a5e17b51777aa25731d02432f774

SHA256
95c91bc694b97221821c4f90eb7b9895249d762d15297323094b995620ecc231

SHA512
46b399729a580efbdaaa1bab424db22d36d4f6253323509ad8de5646cb53c921af24de621f5bbb0238d9c2a151eddfcb91a8a8ecd85891107c9209adc3e287e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91342a132bd924ef6251f025995ea28d

SHA1
41d8d3172dc93b0b8b900416b41421c27b02d520

SHA256
d837489f31dde464adeadda6e784e86616e16d390e7bfdb37c5fe72e36714602

SHA512
9f4eacb4ca90da6823f076dd8c0bf712ebfce0568862f222c651715fbea120fdba7133fe0a61c0f1b4886cc99c2fbffb6b3821a7d7e1d7ccef0424cb1c7175d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e0b8732e14870dfb280be7d809ffefb

SHA1
388805ff3cecd26fdb7e3a326757296a82953b3e

SHA256
58081269e68a5a5fbca7530ce91edea7b7bdfbd7911728a93ed45f3b752303b6

SHA512
821abab51bc9cdc93332baafd0dd82879d9617edb283874ec49d725a54dbd6e801d9fdf567666428c861cd2870742c6304e8d2b9b1d1d2f5655c13907add85c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7254.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7285.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit