7c6645710bb74196510daa4cc13c253ab097772925a1e8516a511ad8b0add061

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1685a97e95a33f5f3a0b95e78d48fd1d.html
Size

16KB
MD5

1685a97e95a33f5f3a0b95e78d48fd1d
SHA1

ef6621f79b59ddc513896b61fa946ed25d9e2ff5
SHA256

7c6645710bb74196510daa4cc13c253ab097772925a1e8516a511ad8b0add061
SHA512

f411e9b1f9ec7ad22c43eabb5cf1c654279948d6e16296ac0935e8f9f9bd07c3b51c11426e515843bcad6c4af57830a49a47cd534e6a75a66204ef741d64cffd
SSDEEP

192:l5UlkddWTtyoN5qcE9QdT0um3wdpbJzrtVmzTFpOTOPHkYpZRPcVaRh3g:AYdatyoP0eL/RtVmPOTaTpZR3tg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007d55df6d1ce7464e3505c8f0f7ee0d1a541c6fff25f4bd8ffe895554eca7dc39000000000e8000000002000020000000487445f90ade10456eb37a349f78eabb81885ac626362207b78905b712b0db2b20000000cf0adda71d9efd50c42890b4ebaa3ee455ce4664f92d6e6214de8887571630cd4000000074532be38700da152b5f04d0186d43453bd8b4c81b51c4f97f386025c849081f5328a404710171b42b0e7b533f01b9318eae694dfcbbd3be301dd3c0468500db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410424698"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b620fb9c7be7d00ae3dbf767f45f408076da66f6086d4db287a239cdccd18770000000000e8000000002000020000000ef92f0d0ac551c6c790bbd4521e795f969886bb28dea81a72ef2351d6bb021cf9000000049c3b5d0831611d45819e2b3b38e18ae05d1469b039a50e77d43ad159831d2046f5e62d3eb17aa683d296b46402a8c9a57041155358016b4de3684635c8785aace61235c53380cb56a48d2b50433f4e865900c75dd6ea5b5595405ca673ca0147d26881c203456a8ae5c11e8148d6714c2cc95ae6810a9c3a9238c7ea66f92867c002059c665b342bb47cc8cfe94a121400000009883459147a3a205f014291900ee32e547eeec6faf174d1049ed7a1ebfa3d9ee042cc29d4d52bfe49934b93bea31f8194ee955a01953c73a8c76e88c5b1008aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a036c8200d3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30581181-AA00-11EE-84BB-DECE4B73D784} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1088	iexplore.exe
1088	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2248	1088	iexplore.exe	28
PID 1088 wrote to memory of 2248	1088	iexplore.exe	28
PID 1088 wrote to memory of 2248	1088	iexplore.exe	28
PID 1088 wrote to memory of 2248	1088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1685a97e95a33f5f3a0b95e78d48fd1d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e1e306f131c2131a5403f81051e96d3

SHA1
4f034fb9b4e9a76b198d600a5030709a472e2e25

SHA256
2b3fd60101b2a39a628e1f1705029e3e910b2124340ed877c716b20790e93c21

SHA512
b033867943f6052f8e8d466be1e35b52cd8fe8eefe3ce33a13ba3b7d82dc5d61b4dab4ce9cf0cabccedf9159534ec63b9f234865070936ce2c84c9fc8b1423cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a6e95fa17cb1d64114443bcd031dbd

SHA1
919ba11ca7c678519fdb5f3536a1588b1de09eb2

SHA256
a7fb352c902ddbcaf45a5eaca23af37dbe481eff6682b4d801e37002e904b001

SHA512
4fb4fe090e02c3aca9238d1543d79ecf10bcc9dc2ae43ab02b5f99b23fd745107ad4e3b9d66b42d230716f61ee73caf567f6fdf45c64c88fae855464a45cc6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a56046ed25654ca94af72b49f3a24349

SHA1
70aab52bbcc2d6564c0b9c1c161a67ea163acb69

SHA256
a4a583bcb25a3ad6e2289415183373e5bc2936fb84d95630f9abec97600bdf63

SHA512
456b8b648cfc88ac82c8d8137bdd3903811473322edae4279a5ad1ee87904a0bafb57d3a3ab9489ac941bfe0f0fedafa985d364e5ff9b89d74f194bacd4f1478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a412a57a83e356678840b1d39e37399

SHA1
c80c75fe1a1fc0b203cfa45b75c1563ce2fd0044

SHA256
7971175a2e7d46eff7a558221273c470f56aac6c66cff383b5a5c438b338bfee

SHA512
71f7dfafc506603f715cb1e71e6188d138f356a533846ee337c0bc3a82af0648f18f7c497de8ed35aec12b2b4184b2510a6f3bd1700412c4578c6822f406066d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9385ceeff5103e27e68e881827e209a9

SHA1
b1b0d9529577c8faa5ef358651b45d129c49b00e

SHA256
800094b1c6ee942b3c2f7b8966c716f9d8d39330ab59b426292c0d4c42da69ac

SHA512
1d6b13da21135ff95dc2e4a70b07c329572bf61df0c2ffcac5be62c14d3b9a16317f4c845a516eaa513926edeaacf911a408dd579bcad0a309515f669239033f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ba39d1bbe02b22078fee5639861a464

SHA1
8bc82c7f909ff6e481bd8d9d3463013750d55018

SHA256
97099c45e2a132c44ff152b15f4295df06fdaca987542eaf489353616022faa1

SHA512
948ff8b50cee83a1263dc103a542cd40dca3a2d7cd0f129f88f446d65732bf6f9cfc3f37c4b4e9d4528ab6ba8198748cd4be30b92c14045d844d58e3f98573b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbab1d8ac478e92a02158c35aa3b751f

SHA1
691cc0eb2e956f650963a5610bc388a130099e2e

SHA256
0b139b3ab35aaebd398fbaf2abdd8f712eade69f7f41975c15797b67e75dae0e

SHA512
8addaab445be88f0cc066d3a1e3fc8b5f2e99030f5ab37e18ee8347aa50c4c023a552a6d076b25c30aa01486964a93b91b700832086eac69fc259fdd1c2c319f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37214a32739645c54aa2c10389f874bf

SHA1
16c6c190646bb1b66b41a3d67db5ae30c5f4a8f3

SHA256
69eed30a6f1a13b76d3c054ee60f6d5775643c3467c69e79d7cb1fe537140138

SHA512
fecb4f4f69496359221b53502cd4fae8824f638231aff22ff027e076abb667fba5408e5d922670c33bba10de9cbe2438c0f5973425f1646294a8c0daccb1e124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f895676d248c16a0e2f4d75acf4e1c

SHA1
40acc516804c16a8aafa6009075ca7fbea8ce47d

SHA256
c22d4d1c8e2ce1d59f1e86ea9990749480592734c5354ba1ad6b0f41c9352c81

SHA512
ed96cd84062acee482405a0218af8dd36c542181c452fea5b649d3de59b79029fa566c1faf2dd4caad1b6ee8ac33145023c5fa0dddc6bdd2738b3815dd3f1da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee7a581d68d2f65ca7d6c2ef0f9b32d1

SHA1
cf462cf6a824ede7821ffb6f71b600569561316b

SHA256
5c5be02dd08f6e63226632b24d7fae110b3b959f3021bbf100528f9a4e8d05a7

SHA512
3fb4bf5449c1092b72c4b2b4eeba2a78aa7f940a63d5f2bf190fcdf00af2f51932423489203994c02533d9ba7f0b1c98218af66a768b8c6d712197aa098bbc7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a021d5ea0d12b98694d44bf1b740c3df

SHA1
6f85abaaa8780d632175d030682d2dba477894be

SHA256
220be7a1401fb9d84442a72c5e595552bcc2dc739c171453b2367ecfe799245d

SHA512
8957ef5b7895b0a11b5b35fbf5ed32f033d81251ff0eeded7302224e81e25768b93366bdece52f404284fd9f3e62feeac660c1edc5f95da616fc2bf49eb64268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c085c8c7665f36fbc9eb7d45a873c430

SHA1
78b5d04f21f9d8147b55e4b9b52d454a58ab6636

SHA256
6b1601a54edf04276453bccc29c361dd364038c72646a0d310b257e6d9bc253b

SHA512
4bb13f06c6b412f4e935da8fb478ff354aa5915f126b8c6308335cf98ce2a0321934a06baf661dabf10d613dd282ebeb40b164c456407e107a93696617a80210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
def7851e85309a0e3ca95c8783ba1c37

SHA1
07502c05396302035e7c2af54a3e4ce4c66a4938

SHA256
09694f7ec1b27101a6cf0cfd84276433d42e2dfb045c9e0e54058ed0ff06ef90

SHA512
f732c7e32d18ec0be92a52bdb1ee0ae6dc0b5fd59527555d7d5985c3e0074283c562ec64059451f1d159eb2a92441f19451cee1bc89e3f61065222f47083e77a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b41a85933208562021cc6212ba031228

SHA1
d26789f546bfee08e2b1076fa2ceed70cebb57c4

SHA256
f769e01e41d6c81468c78858fde3b860d5df022d6b864db3e18e360cf503a283

SHA512
49dd8d457b996f07718590847ba0c7b7dc77150fadfc71f1acc5b4ef8736ebd98a55ece24a30223d458d8388fe13861f3eba624749a7e17fc5dbc626d59a9b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b8e04a3e0ac32d3d08e5d91f5ef7ee6

SHA1
f21949fc659bdaece2a3691c8052529f695b752f

SHA256
199b2ce82ab6f4331d1fc44deddbbee66019cb2771d7a7298f9be3a8d57be382

SHA512
c46adcf9acb5967a4d7f21a49893ea3e1d9aadc973998893b2ad108bbb941fa6e36bdbc3dc96df81c5c8d972d8023e343d44ee15ffa8457c53fea1146593ab85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C8F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C90.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit