83b8cdf9528dc271d32f1e4d50f6d55afd81e05ed0f771428a811dc830787182

Analysis

max time kernel
159s
max time network
165s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12149b924c6276fd9de82f428186c3af.html
Size

842B
MD5

12149b924c6276fd9de82f428186c3af
SHA1

10c8bd514914871b871dec4a670f37c662168568
SHA256

83b8cdf9528dc271d32f1e4d50f6d55afd81e05ed0f771428a811dc830787182
SHA512

70c7f0d210b80dbc1259056d21e4a715a2e07a93d85bba2033562443f2f3fc3d4d404e2f77060e61813e9f5f0d3d634fe6ea70a19207891444afdee27361d8a1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410261043"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22EC55C1-A883-11EE-B160-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f29bfb9ee5f985184e4d600b23cac779cc5a13da5eb1bef9767657235d2570a7000000000e8000000002000020000000a07935bad8873c8249d1ed923d3a283eda7032bca27731429fbfd16333cbe12d9000000096ed4179ff35cc8f14e859ff5786515fcdd21b321c293df20f2f72cff70420b0b35cf70070ff1aebd343477a07191a85c23e55b2487a83648356a68d78315a2fe5cdf83cf4f8184748ae9f185f4a874363399d98ae653c8b82478fac14c9e460d05f3e7752f1781edc8cfa600ec5640bf95093d8e8697817d9c18a7e0804b32c285b54b2796e928a3c028d8fbf2100b040000000ed4d8af1d6b66fc2fee156dba7acc933406d746867f6f720d24600e4a7ebff4c3e9158725b79e104ac43fd47cfa12b6530a81024c95799f98144437832f45d8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000467b87388b55ed5be08b361ff86b2635467ee5c961dc9ed38aed5d5d73666906000000000e8000000002000020000000a0ffd5e8fd0b2f651fac7b69f6ff57ac62715bf81f99bf9337a8f82bfb84006720000000f618185ebebe7c99a5dc86c8c1d9e9405de2022b70a886b41e48f331d4ad8647400000008157d5e4f13e28890770eeb4d0d5c757ce25b11254719c790e88a17535d7a1e13d3514d5c14cdfbe15f8eeb25f9e8bf8956981358b91511d63bd62129eba7342	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50445feb8f3cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2780	2012	iexplore.exe	28
PID 2012 wrote to memory of 2780	2012	iexplore.exe	28
PID 2012 wrote to memory of 2780	2012	iexplore.exe	28
PID 2012 wrote to memory of 2780	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12149b924c6276fd9de82f428186c3af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7790292964edd4361b8ebec460f91269

SHA1
246a6ce70f9b5c2b936d4cf58c72be579c53e72a

SHA256
879f556fe2c8303b2fddbd47f4cace6439340a600e8d0783c1f98baf038688db

SHA512
fde9d0422c07988fa2cfaf2ee2e4a15a94e135761a0a63bb877f7b067c2c16c5a316dbd549de524e0f69a9dd38318a9665361f78330c20409fa322e4b8c0c447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b628101638c2ba6e9376a8fe57413ad

SHA1
c2cd37062c232100545b209cdc32d9efc51a0cca

SHA256
e93488522bf2e1912ce60973a0d8e93db10f5d9e9817a6cc0095ae483ae5b523

SHA512
a16b3fbd52f9c25c6b8ec5a50c370714dd8102a9563cd30fc5dd1f18a736002d430c9312969a1cd0d87c516c5651e008a4e0f0ca182eda4e3dac417f1c8c57c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
107cdfc501e1b33bff4ded61ca3b91cc

SHA1
bb39bae1b03f1590da9fb97fb2760d1aa5144209

SHA256
74192565899d66164335cc68ea67e7b995677c18a10651ef8d27013021f35a3b

SHA512
8eeed8fe9261b108d15e5c013a6488eb3bab2c523bd03d1178faff9ff4d057945141e209b9f793043276ca637cc036d9771a9b346e388f1ebd2b9c63fc62459e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc510be99df8b71081ec5a8b8bce47b

SHA1
42e434b7e6e800b29cc09acad0e1992380afa66b

SHA256
1859db28a3cdb50d83195219fc9678236b8b9a555c4ee6d78f14290ee3ca34db

SHA512
645bd702797f6cbfa99f9cd0da1192b395083e831417b0b0062f54a633fc43e1d1c7f9d096d35fb141bc77622bb8b3d9dfb6a281ce1276bef319c9a380bdffd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7e57e364e914bbbb418e7bdc2b8d7e3

SHA1
45a20e93eb42cd686fa9a82bea00fcc25e2b8225

SHA256
62b14c3d9f890d6c2541d09aa08cca2067242f4eee272c5b516fea6dd9ef417c

SHA512
f88652ea64f5a0d1a546ee7ceafe969c839ae2704f4516c0537b3728f74f9ad1aff1f8521377bbe9682a7453ebe633f4b87f40c5b536123fbcd29843cac570c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9650e011481179db62a2d122d0e1616

SHA1
2ed03d43b548164b24b3fb6ed249b6e5c50f6258

SHA256
bddcaa8f667d5feacbbd9d6c5e749f5e5f6792660d4faf5ba772e064ba390c14

SHA512
bde6d9b1474dcfb8dbe18d71ab51a2c5e1bf0569a9bf26c97de5ae8850627a53466758329c62df67a074328d382dae9520717467bbd593fe2583d90864f894a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
535de28b2a971bfe164a59570685e417

SHA1
e53aa37201fa3c55085e831360115f299815ecf4

SHA256
44f21b3b9844331fe90914db266e9c69bfc724332fb32a3d20a8fca3b95b2268

SHA512
c868e3d4515f45557b13cb422295e5c4ff3bb6ff5d73e01e9c3e85292b06e50c4e6b43ad1af9657a7427763aff5acf10a129ed15a98bebdcd0f8476a3ca3db94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc7efbf05998dfd602677d8217c1b8f6

SHA1
b44a86faac097502d01435889491f245ceae1a9c

SHA256
cdb3d262beec9438960be91377c02cbae8c2cbfbde12dca0cdf2e9f538c6bc1b

SHA512
9987aa99656f031b9c5e2d7de3bb0fe82ba4c7db1c6dd8992792d4eff1799346883d35338930a8e1a2a835e52510793faeed7bfab3807c4b48f1325398716ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d8ee5836431174d2e21a39d69ba01ca

SHA1
dc6be1d23f2028fca5fd57848360321c6bd38824

SHA256
f7bbb23142f5730bdee358a1a74da559c49228ebb357ed9151c68fd72a07f3cb

SHA512
ebda39a1e1850b7fc39e9e005f907022d96bdc68982e210e2bfb30d1143e528fea8d1077b70fbec1f9547d158ffc96947ff40dcadf4211eda4ac5e9bed1b34f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19ee52bf9c467924b37a3baa3a0f7746

SHA1
25a724da4cdee7190f145e21766ba2f350eeaf4d

SHA256
810b73216f3f815d7665a6d4e9456f259ec3ec8179780918f259cf833c541604

SHA512
7bf1e52c92d134353ea82d67934f9ad8a5a0cb96eda9e285f6fc387a7b73b83e36fe994f92e65b19859e20907f3760e8a4760fd13384168494de5a9a10c36fb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de4f8db1c4b923e0815e6e24776dc56d

SHA1
437357c632b584a9d80ad70f8dd10c6f791647cc

SHA256
3246f101ea7ddff9afcde376cf80b2ce651d75c28b2f88e2a0ccdc16193c2b3f

SHA512
9183fb10541c8addae8c08f8533ca5269820d72f854e0bf2434dff0f6af18bedf045f7be6149d973487741c585a7d7610514525965a4ad64009a4388b3258a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
555707dc09116d7b1804ae87fc2679be

SHA1
31f5c818c1d109a039be88228f717de3458c3d23

SHA256
4c16e63831757993322d34eb7abb51bafd99fff011ef8910181d8761aa8f35b8

SHA512
12d20f3aa480de067e69ff3559c3ac630526f586ff3876a37f93941a28773839306e27aca067c8690875ddcfe49f9fb39ed38fe615a712b93e28185f5b1bdc38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
543c31797541b9ca5c92f7d90ca760cd

SHA1
f806f492becd9adf252e5a5622caa3b3e852e863

SHA256
adfd8104a7951a83ea4b0ffcbd3c671802059ab4eea48d8887fa1a6f75baab6a

SHA512
59e252ed3b0a5b467d3f1a51832fc136906f1902e675f92422d68ce82f6174d0e6fed9a3a6c1913b57739ba22b94a83c68d52a3f7dc004378e8d02573abc5110

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
296c995deff4c1d7b54594e341afb274

SHA1
a484f2e5166972d6f0bbe158ea58a1f30cd08ec5

SHA256
27aae398229c38dd6e49d044ed70d066dc90c75333b364f4d2a9a3913005a177

SHA512
a6d960e0bd8cc254ae57059ed2ecab474453a722e083713463114ef33d12f3bdf5400c82e6cf188f1e69ae66390674b4c7569af25a1e774a4954f54315193333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f72c8a8728030fd79a7b4f619bedb31

SHA1
dc6d93246a92597d4f2b6b231476c4785c79fbf4

SHA256
d3553abd99178514ef0ab4e9c20058766435ba33637a91942f23b80c4769a317

SHA512
37d4ae9e094bf5652207aa7e354e981d4c1d5568aad92d6deb93240955e86f1b79a569901fa6cef00e5722db76c9a49e6cc1bdd4523ca7dfcf7a1c011a887d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e705ae858ba69e91489c435d072f474f

SHA1
ebf99c078f8d16e198ae68bd9c87b52f9d8e913f

SHA256
bc52907f69098564687b3e2c17028d7922bdf93d0f2257bd1a9eab872b197d01

SHA512
f800c5422b7fe2740fbafb48e161915f36f23c2cbbca7864caea2a98d23d7458aa573927ab1112606e1c0e5c32ed7a4d0431a59b2b110e31d88be3e7e88fe167

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0F9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB975.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit