e09ce295f149e2a92e2bdc2835f775668b04bb6dae66a4b62193589420ef0a17

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11b8dc1866341ea9471663ac136e19f0.html
Size

57KB
MD5

11b8dc1866341ea9471663ac136e19f0
SHA1

892fe7ff761b650eb3bfa98cd6a24061b5dfdb84
SHA256

e09ce295f149e2a92e2bdc2835f775668b04bb6dae66a4b62193589420ef0a17
SHA512

23234d8a0aba90e052b58060b6a44a817fdd3bb2c8979c72fde6a564ffc402a5902331ed1bc603cc511ba09e4261cf35ab8ad918232c4d756f32bd47d6827e90
SSDEEP

1536:gQZBCCOdy0IxCWfslOalFAWmgnbERAxRAx4uj8JIi2LHAtOfGXOpUnnQppir0p0w:gk2w0IxMlOalFAWmgnbERAxRAx4uj8JY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5004ca74a53bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86E41451-A798-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410160275"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000041c5a421afab1e6df05e405dfb6d477f8a32dcfbe0413cfdd1a11338e0d170f8000000000e8000000002000020000000ad060e9ffa6335e98031317da70e6b81aeb322baad138aca124066b6673a233720000000daf6322ee8f6bf2018a88674ad335eb6fe626478354b1eef1beb36803cc22b0740000000de4a18a56fea40c4defcc56e3fd312c2fb51bc94d6c7ca3bb4a657e8166215b3cb5074299127300e2cb92cbc96ebc27716d6080a1e306e22a532dc3772011c25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000654d3334fa2504c547516e203bfe0431531749dc5cbbca0110c3165ed132f052000000000e8000000002000020000000b74a0a299da14ed7579ddd17e39e88ae1ad3d9d0c62e4222fc4ab88439a18c3990000000186307dce257c0c5181053b8b86e1d54b8aaea272cc782c804db50780acdedd4a00dec87434a71a715de68304396577d326f8d44f72d84888385377fe8b3f163c072959ea0e577aebc111e7c91ad50ff0bb3a5701cfb4a21f4d22bc375eba4cb7edf5b7bb8839e3180a5e7e03dcf49f6929b9081d7722375aa0395ec1f9c362193a93b4d675c3d06a5527177949bd2064000000032caa5cffa5844e61374c27d0a86d48b26d8dfaa27d914383fab65a7d5f05505a15643877eac15c73f48b7cdaf9ae998d78ee5e5687a591ab900caef5df9d4be	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2156	3004	iexplore.exe	28
PID 3004 wrote to memory of 2156	3004	iexplore.exe	28
PID 3004 wrote to memory of 2156	3004	iexplore.exe	28
PID 3004 wrote to memory of 2156	3004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11b8dc1866341ea9471663ac136e19f0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a64c9e1932f5ac49b3ddf1e173ab31d8

SHA1
c70c536f1681c17f8982b652c5c9bce256787e95

SHA256
9e6c3dca51e80ea7c1502d38f71dc08878cb126ccd7fd0d5629e7fd0ba268242

SHA512
26722d8635387b4f5bf31fac7c1f081f8146a65388577b0d6955e86cabf1b32e6094a6d7064eff0e83fd674465a0074f54d0456fae69dfa372b1aadbaa3688c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98d8ffb9801efa42ca6b1232fac0ea7c

SHA1
2c0e3148367705fb0aed5e36e990cbdda84e9b5b

SHA256
242dd18dbeb50e72dd8b3175036f0e9b2a1acac178d8edb745bd6aa393a17f1f

SHA512
648d996ac6c4260716b0da9abe867eca4a78bdbbb24f26fd141db214b51aea5c4097d21c42336a8497af615822bc9c13da03a8d2af2ef9711d7b422780f2084f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cbd838d78ccb0c31575501a5bd3921a

SHA1
5a1990379ee3f4823314e9307ac352223d14f07c

SHA256
5aea94127b14509ef0a18da281b25e1464be37697690b23010fad8c71ff6bc76

SHA512
1b71c5b3687c890de261efdc00addb6f968e8252dfad9c089fd83ec7b669e790a9c3f2274b97e1d49c04f5e80c7d26310f41d0d46aef11c9cbc3ad99072c0c77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e06f009dedb453a86d7d27b5b6308395

SHA1
f067565b42a590ae35b6fd34bd184b31c6491ecc

SHA256
4123fd18859ada5a4c3853442f26f3a785a5f41efd0948eb8a043dc0fbf1d7f2

SHA512
8f8201e16e0bbe40f8575c1687239ab46874374e0167f3f4c538e590fa545d3b5e7dbfc4813b9364aebb7148791e9075b169a112f8d846c3e8f7f7604009f321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5578f1ada2cd0e6145909b77a572ccec

SHA1
3fd8b2c619406633fd3fde392580906655602e34

SHA256
c3d2ba9dc603c8306196ec0e90e94d9d16f6aaec5e31b59d30deafb57ff479ee

SHA512
210205a451036eba5aa4c4769d694bdc83ec80297ab10023685b12f504db62da9c40cc7fceab19599495064ab66426271e77eb3d31bbac5ce658e42054ff95ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a567a269891e28279bb7f25fc0f321d2

SHA1
c606321d1f3cf45144b307f57fcc758b76a816ba

SHA256
ee1c4cc6e5e07b9c28f998cd38bb50ac250d12dcfea006e5e23fa31083b05ff8

SHA512
85d8b706a3ef7e54f2f5936cf588a868567bd279f09aeadc95192e4f9697e3584d42fb1a13468da161406dbcd40b3acfaadb8661e92c0f34b3c08aeb03febda7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf721833568f8c44e2093d44f5150b65

SHA1
344a18e607ced0e2bfa2db7cccec7e0e63e5156a

SHA256
b72963d55e9ba788ff4c63bb5f7075379870e51689b655561da0d25cafaf82e7

SHA512
03f1ccf88dbf08896f348a73a2d9075509740f3d0b359ccd1ddaafbaaee81939d31d8ebc1ab53c1b5e601bef0c96ede8bbf440797704fee714269f26bf00d565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00e31cd7758c107c556b71a6f062750d

SHA1
7a86367c264f4b635c5ef07a9b8b40952f491d2a

SHA256
7e59fdff67b724610a0dc61dd070c9101b1c15700d87dd1a061986a87a76d4ac

SHA512
68788bdb4cb4a090bb0e0d35e9c0f7babb0f3a0fb18c4d0d7728b318e3cf6a57ebfd4a18413f0ebcae7b8725f5df5370fcb5e987be146f6d9cbb684bc63fc5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb8b30fd02a7496aedc762e2bdc148c0

SHA1
5b927e589d5828305fef8bce20922d76a33e9f5b

SHA256
bbc0f7055b82dad02c04795d4bf837c873d23e6291375f5f09e0051c8a770ba7

SHA512
9ee922a0ea95e3f67182242d967faec2587c23fa5acdf9a282945ed4af62115580111c0e18bf02e1a904e65faa77c91daff0e2691591e42a051ef2f0531f0563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34a9c0ce0fdab3375690c4a24bd8cf77

SHA1
b5375fc120ab763b72df4133c02faef1331f2fba

SHA256
7757c05e2b38e92ccb666a346fd4edce14ed3959169609e0b6289f872a82994f

SHA512
03c97ad2c624064effc8f8396df11cfad7f00cda1d29c254c4d6634448ab8c1d0e0a7c9ae73c5b261e77ec35af8d25c29b2150d59c1c7d10b671b74b16ad08ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0d9b1fdcd8231aedde6decb93449262

SHA1
3eca0e175fc713471e7f9617a6fbb55534993593

SHA256
9ba1312dcd1276e74c751c5f4b6e63a7a4292a9ebf27e5cda2f9c809e47fa0ea

SHA512
1aed6bb14e50b77867bffe0e0576a6d8030c4b4b5a913927f5f7ff81830831d2562323438ebbceaf2589fa0948e708cde8c79e9ab992289894887f63593fcc20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efa85b5bc00c446e0b6216eeb1167eb7

SHA1
2b5c18a536f637daa79b19f1e3b2ca5b70dc36cc

SHA256
a6e1f3bc6a6be51a7dd9977f22b8799cc8195c21be0d971fb368bffd4588efc0

SHA512
2829c960b4faad6e60ebf9af0ec6e5a57ab66f9c2f5192f6c234303597e0a0fce7e4435b3930fbde036f6be04a6aad95bd1bb6d887a5552150e250ff2e7c3ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37cf8ca11aae0edd3c761e0275210e88

SHA1
b8da102d5c7e26c1226d8d94b8a61790c0176752

SHA256
42b24a78752dae8158c43a8b2bd2617e16b92dfcacac2b64ae21a1721dfa14c2

SHA512
ff15b32060c71296b59fe67684f23e513a4bf22c066b18426a4b5461e331bd08cdc824ca73f1fd1ead7fff8bddcb6491524952e83dbeb62c6625d2d8ccf4515e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63e24be08c42e2f3606f3a0c0c1dce6d

SHA1
c3010db2e357a8cfbf6e9b6395f18312fe2839af

SHA256
0998d4e2074e41878a321ff1db709d645400030b74781e8575b75546fc69406b

SHA512
7a2f7db329f0ebb32aa52fbbba7c38ff74b3d42504355fa6ff3473984c36214962555a939dc518882244a07e3bc8ac9bb4a0be19bd1067f080328e2aceaf1a84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0db505a130916244133f78443b8d1d3

SHA1
a8d386f5314c32c805da7c95cb66fd829c7a25bd

SHA256
ebbf566314bc04ba53a8745f08a9fc9b44036b147a3eee1a70035d54c37c06d0

SHA512
5ac3ac6dee15c1bfe43052a35e40502d095e5afaffb2a68dcebb1bd38cc5c2f0d8e61d0fac7635dbca5bcb0a14cff44f41d06d17977eafaeddcde0224f61e0c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5585cc7c7f021bb67a341751a83dd7f7

SHA1
72eef735ff93bb15cca2212a757e51769b15e6f5

SHA256
9cecf6dd0cd90023230ad7292e2937814c1cd1c07974205d7e8092eb1b2b7315

SHA512
e91e7089e1f89ca74defb4cb1493243130c2f7286fbf3233250ffcd837a1fc0c5595f0c8e0132e7a9594206ed529ff7bfb9102795f17538a774310c63290e744

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC20.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC52.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit