9ea7602d95f3ac8876954d0bc5e54edeb4b5a53c1b78e26e9d56796e24ccce39

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1490c6548577741c12004a178cb35ba4.html
Size

342KB
MD5

1490c6548577741c12004a178cb35ba4
SHA1

af171d841cf0cd7e968a939d9b4e70ae4eea2b90
SHA256

9ea7602d95f3ac8876954d0bc5e54edeb4b5a53c1b78e26e9d56796e24ccce39
SHA512

1f380ab14f87b152de643259e9f94cdf91dffe4020b8278e0893f88cccccede4f6813f19a927881faaef05db081aac9daa6beed1360ae03b202c57da150d31b6
SSDEEP

6144:S2sMYod+X3oI+YWsMYod+X3oI+YqsMYod+X3oI+YI:V5d+X3e5d+X365d+X3C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e084fbf2e83cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410299252"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006fe9ff5133bef0954927340bf9bfec5d0e1e970e5fcc64ff0036d8ef2de82663000000000e8000000002000020000000225fdac83ec13a7cb07bf67a768e62e23b898edd14dfec150cb5a736d2f9848f9000000030b5c95c1aa5dcaa54ee16d415faa30558b252598bd15468f5c720151a99c045a01bdbeae1527c89cace6650d2c124390d684d06a2563e40385898f0b98644d2f22941cd0581950c0df55bd282e64fd204440e92341fad77c1c2b94219a149dd240ca5e1a3ab43e399eb1e69bb2a5a2c964f8f741883d1e778a0c6a430727bda7a95f109cd30a5cb3f91dd52c87a2fb7400000007f07f31e198fde2486f7df8bbcf9590d6f2480421ef647ad10889ebf39504d760ada42917002f515cf2af519815553c0ad4b2b86121fa62919f4ece3f005ba05	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CE306C1-A8DC-11EE-BCDB-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000008c380a702398d4fb8c06d79d05f49aa3f2ee819317854a59634463edf1d577d9000000000e8000000002000020000000666866dad831af5d5d291b95983d5fc3bf8328a85d0bc6d3c09d6ca44d58c37120000000c66fd6ab6313fee8460a03a10c8eef4f4e723f5c486be35e20d1d0e870f812aa40000000615717a96381040240a4444e89fd5566528aa67cc11c03d6bac84d69475ed62dab7f6d8baef76afad1fec4a2a18fdd0c5fecf5fbe403896c961850d1d463eb98	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1756	iexplore.exe
1756	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2716	1756	iexplore.exe	28
PID 1756 wrote to memory of 2716	1756	iexplore.exe	28
PID 1756 wrote to memory of 2716	1756	iexplore.exe	28
PID 1756 wrote to memory of 2716	1756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1490c6548577741c12004a178cb35ba4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f48738ac5b9967f3b62fcd273b7824c6

SHA1
ff512844e765519cc98a84efdf14bd224c632ba5

SHA256
5dc60394e0e7aacd250d62c6d03b9fd26b3edae6d35fe66d845926d8ad8f4820

SHA512
d94bf45c792a002b1dcc7b2a07657b7ba9efde42e0d1a9d5e2ee90517bfa1e03224c122232d9e5ab4e61449665b67b75566d43b227bfb0b94969db41f10f508a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22a81008a04897a78e36f3b9dc0415df

SHA1
419f8ac408f1bbc09ee91ad09709afb00c79616b

SHA256
b39242940b6e9fdc0d533f64a073e5f463ccdc1462624751c47b91034db37c19

SHA512
e8a4d562e4d27bb7a44800bbe3c2850d398b0992065820e411a5b7eefefc819f0e07fb46edfd3b4d7c8b32776c6222e91fbe6acb95e8ed0a9434cf4ba553696c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e37b34992f673f2e92bd1dee8f3ad58

SHA1
f000ffc65455dc33104c074b78a37f2606137f20

SHA256
df91f3e35a34e61520c149c378c382b3f21b5ce2941b475f01b64f618071f8d3

SHA512
96eeced06bfb4da92582f7268c09658c8fea587055c2e40ed291321bc20c6d899f3cbacbaf910a828e43bae5126811f7eeb57f7df5c9f2348a17d64bccd6f390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23ff593f3234e6e825022a2ce689f231

SHA1
0170321d28e039e78dc028957458ce67a86b5d01

SHA256
b7e12117b13215c8b166a04a94605cbc5fdf5a990c85b921df288bbde5708aab

SHA512
825476455d4210a21312c25fdd5e8aea35eda46ffae9f72346071900cd6923b61d5e2748d9bc7d2d68fd7d87cec98b21f4b264069e983292c98e95154f4d154a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b418884d0ff61e77bb9bcbdd9c8a113

SHA1
26bb3dae2b6ffc5689384e3900ae6fc69fd8e6bf

SHA256
13c4178fff9b03cd48d3160909cf04a34bf1171ee098682c1435b1f60373bdf3

SHA512
50f706f71b17471e25ad9990eeb409862ac876b649c91117dc42786532b4623c7aef9fe8be17d7c218ece45ffc758c7b8e6e6713921b16bd65adc49b4b977d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eb01f115cb7af4cea50aadb1781385f

SHA1
8c647ee4502ecdb49d0e343c3ee04a041ce93603

SHA256
e1ccae489206f5c78cd47025ce5f91137430f415a99047df776a0e3e9d56834b

SHA512
a7bf7f6499680019a5ad9c67385da6726e3c4d97b140e03860ccb92eee24472f0d92c356e99bac7b110a0c35b8a1652ef8d7107d18263a1d4ef5873f95feab0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08e0a0e183b75aeefc778320c6f2977

SHA1
d56a4c298eee9f59a03379fdc813a845ef874b53

SHA256
1e2793f9c0039b74bc416a658a5b3acb83f5d873cb21bb4ff85748f983f03705

SHA512
57b332cfeff1a59c485b1c0f136cc0f5614fb02016977d857886ae8c2a11752fbccb31b7fbf06d1074b19a58ec0021da37351c00f2f96a661ba2dd2e3b059c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f5e69c45f837b49fb95988a503c80bc

SHA1
e966ec33673a75ffad7cc676365f371f8f337f55

SHA256
ba92e0f07b251ea6f0436572e34091660eaad5549c40f2386ae63d3fc9044103

SHA512
208c6bc963e3e84730f2b627d1e7f61d967de8532f9b57cb6a7aa087bf4e035b9178208e86c23f7136ee122cabcd5071f61cb78b341d3bd5fb30485572db20e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7946e692a2e6b550ba46b4515b2ed461

SHA1
8c17e2bc63970c6bf1308b9bf26c034f6b70659f

SHA256
018f3537e758c0098d2be7352d84473b9d51334578b5d951acee15ec819a25d0

SHA512
127ffe325650490f5f21f3856af017523ec7cbbf83438bc6386fb77fbc2548b8b4bb9972e126ab08921c3595086804456d94f7f370e9cea4b7e07bcb6692a0d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c416c47fd8e224272fb02a649eddc61

SHA1
6927293a3dc09ceed64cdb2ce93526af7ebab096

SHA256
2507869c2fbcc1f6d430aa2f39d369254041ff9d9f9228f943e7278538aa585a

SHA512
5d33f05e845255ea8cb84cc20e21b0900a7e1e01994ac894f146cc85c8cbc9a4ad98b9399f38d85296a327f9f81546ee18d8ad3dc4ccd658b15de0d3c1d190a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6d116579702e846de632ada8a3b35e

SHA1
5cfa12aa719cce2859a956cdacc9445612b4d2ce

SHA256
b15d77b54ad2cfdb7e97da3af77996ea75b7c46a92804ccf0c91a5acf6081c7d

SHA512
7f07f86832259996b49c930b15d17bb14ad37dce94ea6a60bce4e1ad8272613ab4a546f290fd5ea5d3875e07b5648ff70cc3302a4d668368d407a39fcbe8a219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27267ee8f3fa062aaeb5414f2f05be82

SHA1
f7eea20a5d96e6de6432e152342255d6e6170bc1

SHA256
433464b47cf823142e243a23843da98067bd9e3a52024eade6c85a48dbe85724

SHA512
86fc21db75726ecc5b3cc72a28e0ad2f75f59a112fff0767410c8d6b3c3896446de5225e1e61ba5b08659706cf753309f4489d85e58a3c2802bdb41bb2c080d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdc246fb57b48483c01bdeee157f512a

SHA1
be2aa814a3cef07a15a1de059e8e9ca182ed76d4

SHA256
7686b53f8493d134953aea0c1b53ae78beca0c0cd71b6543b2d389d6f90de1ed

SHA512
c71f5cfa31908a03d90c8965b73022055b47c9db028d974e587f252776612d54d0f58af27557eed7f497465480f0310466913661f2a83c5618b67fc9818aaa2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e259a29da591b212f3e581f5cbf008c

SHA1
1313e0d2370e8db707a4df38902a1698cb4bcc6f

SHA256
3fddf9d98e16a16170f0ce6b84cd88bb06e90a33ef55d5bfa45bcd535a3a1a61

SHA512
cf8c7403ada84ba85cfd94d51481cbc7dd28c2d5d94da6ee07f3a9fa20ed432430ba51676a8843c59aed4add38f691e092fe8096801010fc16fff6093e51d9df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab96D6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit