72eb795cec3d6d207664a3ba1370a736f2408c21fa8f1c325e2d2d58f78d8248

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

122d63c6a6228736685804a7c42316ef.html
Size

1KB
MD5

122d63c6a6228736685804a7c42316ef
SHA1

af4927fd3d01c1268e49340c3cfc337b4737e0a8
SHA256

72eb795cec3d6d207664a3ba1370a736f2408c21fa8f1c325e2d2d58f78d8248
SHA512

33b41632c2ea0cdc295804941e21d9e6f865bd4597d36fc7eea5cfa0fc2d59dc7f2090aea3192e599fbfb70cc41e9bb5d7eaf3414035a59305e92b5972f0840e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000003d3c6b72717346f4a5b6616aa44ad0a64135fa51b15541059e603849f925315c000000000e8000000002000020000000a3f4eebfc044dfda5f45c9856fb46bc7fe1b326ab35cfdf053a8800d1a5ae29c9000000002c7f7dfe25588af2425d205c1142bcd066d5caa4a907ba92495febde8baa0f96be3c9003ec242afcd3c696c498319c2f38305ba92d956133bccc7464786bd59b8f96fc05e81b659ae0d2c189bc1087f65b57a64288f02d8aebc70b160ca9575c3c91d15b709279095bce0d50ea05e46be0a0b08f1efd81848491adbb23e4cce73c4119f1df531451e64bd4c1cdd580a4000000047288f75feb33d0cd565eef07a6c51f8525e45c64016a2ca13d03c4b00becd79a14c83f250b8a193f47179d4781474a0d7c290d5ca2dd92a086e134be0977fa4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0670d77923cda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC7F03D1-A885-11EE-8DE4-FA7CD17678B7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000006a3414baf25cb5aca6abc157fffb7b867aa60461c0f8b6ec87106df3b6528acc000000000e80000000020000200000002ccd4533bb714c9300000a58772bc74c44b68620124e6e100f6605dda934040a20000000a31816925064f676ebfe6950d0a509348851fb6df7039041c7c7918d2671ea3e4000000084b25effcb4a272662f24d55a34e395285bd6465d33218c6872d999da64126932637e70f7c989db73cf11120986d9fc9ae952be1c16ac611a04b3d667c783e53	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410262137"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
804	iexplore.exe
804	iexplore.exe
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 1684	804	iexplore.exe	17
PID 804 wrote to memory of 1684	804	iexplore.exe	17
PID 804 wrote to memory of 1684	804	iexplore.exe	17
PID 804 wrote to memory of 1684	804	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\122d63c6a6228736685804a7c42316ef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1c65bbae6f9289d21657845eae6f1a58

SHA1
d9972279ed5b5b58c4652a8d7ebeaec4bb564738

SHA256
6c3aef30c42adfaf48443f86057ffe74b55e3ea0b2c3d235b9767894574c76f1

SHA512
d07b4812e73131bc84ef9897920129c718b8d32352520a11dca8358aadb76ef415269c1113f334cc58d5ce28c796c6d6f7809a5a41edb61273906dae3f921575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f785e553ce35b557dcbfea3effde13e

SHA1
470ed53c4fc9ac793752d602887e6d3b7a77559a

SHA256
585a2bf293ee696cb92d7bb7ac82ae38ce5861c863f074aed6e3e21568ebc54f

SHA512
2184791256dfe9b976ea4ebba1b3eec9601914810180a30fac76de058918d432a4dae923dd786a9974a9bd0f19fb617afa1ee577a022b14b3ca92a0537603663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d70d88e54fb2123d85cd8c02a2f5fa9

SHA1
199f03184f264b96c7b377a92c5768e65f063314

SHA256
eb9a403584d51057277f09ffd7cd0a814de94569b4af9b710b700c16f77f4ded

SHA512
6bec7b4e085aded579db5336450aca1020c02c40b63eb8d292a25f18f75af21a478fc667a7dfa977be36505f2a58b5de5eeaad6854a6774ed5f1d2e8df9fbf4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c299b8a5ded3ccf92624d1427d9162

SHA1
3c37f383c8a74dee5b4a8a02e05b0b0be0cd3892

SHA256
2ac364baffd9693b15f9cd10fe1c5da26aa7f65e1b243373494e04c055312e34

SHA512
c3c18d561cb87189cd1a0de465929d4de5a8f3001757a08dad4336654d05a358974c3bb5925aab94bc44e787373109949ba9bbeb99e943fa38ecc1722c93537a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd52c5ae20937b239afbfa80b7eee6af

SHA1
046bf90b555c53b16dc7188ea90fad6250e3c7f4

SHA256
462f78afbb227c64448a69667a347573c0c721e707441aca54924d0ea2789d83

SHA512
c904a36d622d12b9f92cda2b8d4b6126cfdd9a3d360d60fca0294811dcbd69b6a991e6199873a3f2ad2a716f17ed8e69f6c42a1055cd9c8832827c1c1aff1fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de9af9a249f40dc45b25ff2d5cb4453

SHA1
d19b4e46f039c8df5b5048f40bfd33520d4f5ef3

SHA256
a37dd92c14e469fc0f8679c14040f755374f1adfef81237adda875cb4bb4abdc

SHA512
6a1b3b3262ebf75256a3c23db48a77fac200721478ba3c298692275bda8f62e83f2c05405bb48118a2b2d926ee5b3b398077f9a6faac050df4d9eda1e4b27c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b9707ff0129bd12d61a20287a94fab7

SHA1
fe7eb51141d9b95ad3e66a7b4051312749a6e181

SHA256
7b9bcb12664a80dce467547fb19e23edb84711e50f779860a556cd5f1179b2ae

SHA512
34613d8942015792e4a3461557a77584e06e2fd9e691420791d7efe710c832fe2a68780aa4b963d5c56d848bf976cae99c7150a337165eb148ec642bef3ca102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3520bbd935e529b38d0d1c9d4b852939

SHA1
b337aaad55f570cd53901644bbf1145084ea74a4

SHA256
26fa1147fc6f58dc6eca7e3d45f221a6b5c7055e6abb43ae655c246cc50b1019

SHA512
060233abbc79fa524ab9b5a45bfd5fe7ed45784e19f16c0c5f6be5fc13c7d93ae0be3659f8e7ff11d2e8b203a9c8aaed2820fadda98b977eafc42efe88260fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a438fb50a3a6e66b3b6694dfe827c50

SHA1
4e1ec3925d03e347516e0d6eb6f71df2a6dfaafa

SHA256
656d8892b946efba1785194c5bff89a2bcd89e251679f80979a760503e4e7e4a

SHA512
abd7ec2b8fa332dffbff9f7024291aaa0d10256c3a21fb55db6d9a5b6de7e2b5f49d759e213c57b0892057f2f54df3189d3b5237dd78c92b22597fb8b3aaa6d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
cbb4350bbb4459e6bf87b2f63529ce71

SHA1
aa94b618d69315232c9658280631978b4e0f96ca

SHA256
4063aa6be35d4841f64fec3413a970bee5587990154b6cf4ce3f8624d7eb6843

SHA512
9bb07832c7cc421c5a6234cd56d1e400a8a2d9c12c1cb5a3353bca4fba0ef4ff7d1930cd46717fe73b916c1820035d588be7f4e1ab651dab59d9131787c50f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BC3.tmp

Filesize
40KB

MD5
8199e4d0ae0b52990ac78fc93dfa316c

SHA1
488faf5beec1abcaad02613394cf8de5f64985de

SHA256
f0d54a21ac03ae93ed4cb34d591b08110e1f0ef9a6fc6a9b62b66561551efc34

SHA512
6b334097d73680c340cff7ea709dca401da01b746be8a23c837579806c9ab39c05e588416ef495909d9df6d565802053fdbb3cba79d22dca74021fa501ac72f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CCF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit