a46597e7bbfed0ad371f93c0c9caf279482bfdfbe5b9b61253da0bae309c7593

Analysis

max time kernel
118s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17fa9ba2467fe60464e05ec99a1a6c79.html
Size

5KB
MD5

17fa9ba2467fe60464e05ec99a1a6c79
SHA1

72a6ad830d3e73997b9974fb338f6d339e9d237f
SHA256

a46597e7bbfed0ad371f93c0c9caf279482bfdfbe5b9b61253da0bae309c7593
SHA512

6aea2f3c59a3c759d758f4e5763bff06c55cc83eaaa345a8fc244562e18c144fc9a0c88acb4082a24ec5d6fcc343d1419a57c1820bef03b2f196f9fb0c976e8f
SSDEEP

96:10VLzgsB7c4/FEHgmW3mRqvQHHs54d0td/3dElySLsQysQlEY504exTdgpvuT7Mb:sc6r9mSmmWApQbQlJjuTihUUOYLn5h

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000000a3a929b783cf6dc7a936869a51fa274d3c8e0e750b6e10cb6e9edc54c94bb22000000000e8000000002000020000000d74ce5fdc8a8aa3eade2b97b255f4ba9fbb4e28d9d21344df62bce6f5498fc8a9000000020f2952d67c365c0e606dabab8f449e065dc61106bb8838cb3de4b127642e71aa68e721ab9ddb322b8e3c9f78d02dc6171b420c7cb212f5f3ce4392571dabf4778ad95b2e7af903c53a6741667c24956ccda7b65e72d86edf35842b2ce534dd4849f12e810041a1d8e1d04712bd850b42b3ca35d18b9454ae6228d215c23e5ff21e754810cbed627b118eef73c23e680400000003f6273518d3f71f9f4c203d2472d774cfd879a5a2bd438512e3c9df35e554e57598f5cff08aab2bfd91b9f9fda66594b6f171371b942f06a8fde5e8fc3bde390	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000003cdecf38a1bd8ff349c65d5938eb2a3a7198bc4d0d513373218ad346fe77566b000000000e80000000020000200000000ddb7059fdd4f20d0e726d089ce88971debda5cb2fb7674ce35a22af6ec2d29f20000000b4443f03bc2f45338a95477856432f33c995537d12f5010609ab694f6d91a9dd400000001de8ec69aba0d41f1eea88b6444b7397a7f9e2e27b2c28cdc4dc4f85ba13600fd647b21388a8d46f28fbb5e2a55dab6c71a4455d926ac2bbf87a208a00ba4e4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410214301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{473F55C1-A816-11EE-9F2E-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e46d22233cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2848	1644	iexplore.exe	15
PID 1644 wrote to memory of 2848	1644	iexplore.exe	15
PID 1644 wrote to memory of 2848	1644	iexplore.exe	15
PID 1644 wrote to memory of 2848	1644	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17fa9ba2467fe60464e05ec99a1a6c79.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1e58fec1394d6d4029290ba6f8ade2b

SHA1
cf24a15d47f33fb3cbd2615b0fcbdf10becd2cd9

SHA256
6021d611ddea4f3ff50d35c147787c28f23fbcefebe0ffda8c585e4fef281c54

SHA512
a375d9c3b66e9e45cd15ff528edf3c407451c5ce4c1839c5ef9085f4ff5af770e90f6d43963a6fb1422968766c0af2cfc28dbf173c532e67372ccf34b2c02763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e63488e6ac1bd9edb7ec0ae42efd81

SHA1
81a584a971826ad797ab56e4e77e364ce699a9ec

SHA256
f321b915f82bc888083a3a2df70e0ce370aeed6fcda6c0b838d2c75e46213594

SHA512
9de888d8ca8bfcb998fb4738b300c49608154f23fdef33b0c46cf8debe85a865038a052e91a4dd9574e691401515520414879d0e192155e573b1b425a7a7b404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
902e1cb06947cb2063bd554de3d44cb0

SHA1
16ba8d75821ca85e236a7295fb5fabb1d58fc770

SHA256
1f742db7d868fc0bd4f70d3777749eecfa677ca5ce12e6a031044f4b22a66814

SHA512
e0d0cb6f9859286019fe937761d676502da23544e8dffc019cae22e1f8b22ed1589cc0db350304e42cb64d5ba405557fe37a96b4491abc91a62ec8979f9da204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02d8aea5d874280a160835dfbe1596e7

SHA1
1e32cc2a5df05546c72a709a4a23f0c229172da4

SHA256
1beaff14fbc93b5c549f68ad19995bcbc18b9906ea893661e7f1e92089648a88

SHA512
88b998b6f6b423f946d87f6352889590fd7d3d8d315db9185add558010f4f7ed32e6c2f4a61b82cf6cfcf1635d4cadf1db3727d2938d31d70be7eca2d0632f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d32d750248f58f7d702f637298f1b4d3

SHA1
ef3c01ef230da04659f10773f3fce6c6052403bd

SHA256
b4ba2a6e2f46d4bc6d14f582446bc96b5d3888a0d9ae7fb1d326fb7164ad3325

SHA512
c4918ef7d35dabbfc58a317dd36a5ceea95ffdb153e0692230f85cf90035a5408d27f40508357ce59dfd07349a299f87e0f0ac01f42b04901acae656984060b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9423c1fb37f54ff1bf7cb10a14d426e3

SHA1
4b6bb3657658d75ac0ef70ef34cca66e16db894f

SHA256
a365c0f90b02e81b2138bb426e46a2dd5cfb3aec5b12f0f9a8d100d435563f10

SHA512
bba085fc6992a5dcef5d9013ef6b576d3d23cdd93986caec4bf4f5863e7ab3c368f619f691f68034a2e20c6235bf8596f2b05061f782d3541fd4bc51b9ee2e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8af8f8ce723025e5dec5180557bbaa0f

SHA1
e68ba05d30a3c371faf2da3bd00a253ceee21420

SHA256
962c2cf3589204d6bab0e046e37259193cb4a38dab23c0dafb80250c9d3fef12

SHA512
d505c327ec708dcab16f2cf874706e420e31067a53c95cff76852b75432c8d271fd59cbebfa36ba82c6ca4d3429fcbb991bd407ca8fb69f251ba7da57b0b9bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39ccb6d0ab50ae721876852e839ba3f2

SHA1
108f95b8d2b4111711c64d734200093bdda3d32c

SHA256
0e435d5ac6c248aa00eb301e5b105dbb784afbdb118e922d89f988ee415ad620

SHA512
7310c95598e80089851bf713e420a0fd229f68c49e302b75d102eb070f7a164c42665590a2dc093b40d0685a6c0a600e79853d5508300fb8fdcd622b3e8fbbdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a01e6197aec10c1d4b201a95d2f20d

SHA1
385a3eee55c37604204ed8779e7306faa72d990f

SHA256
08f87af3da41d428ddb0c4d3cc2cde216809eb6ca08fa4159a0b446b9ab66fad

SHA512
3547d13be5f7f6201a0f2de7c57433ea26492c67ba076413ae95cb34c1f23bc6ca394e61f2cdfc326d3403309346be62b959bf232d40a24c7eb67d1306b4895e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c118361ffd6891104a86d5271415b31f

SHA1
8f0c81920cd7b6e5dc85b061d3fb30c57c1b83b7

SHA256
e085ca2df9f7c1924a1c2a07d346362794765d8f7214c1ed2641fd7e2711aaf8

SHA512
3e56f49887823665b4e0bf36b072a8865b0e1c304885288b8b783474f53cec5cdc97ef2ff43e057d3c5a3250ef44d1c4fd0f8fa92d98f8833596e8e54ef1358a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d8d7de06addd3199a7457ac6a5bedc7

SHA1
eeb82ab8fc433ab1c18edf5131392f72af497ad5

SHA256
b6574405c97db127f18db974d3ddb97ebadc84ff08a67336036cb9f4b1dfff41

SHA512
2bc45679194f4b371bae08da10bf6df55424276d536147807d2ef87d562c51978ea5958d554ede401e2e43310747b4ab1a0dd3f3fafaecc2c602ed838cfa8666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f48cfe5f0f93c10789f8d4c775d4d57f

SHA1
e3b9e679e9205e2d0a052f6a27c8ea9e44aee7ba

SHA256
d1cb04d84ab470c4a6783908e567751e8a86a3cad3fc46448eeb46a14713c4fe

SHA512
96a34e57967035602695dc6bf118c4869c8a9330b240578f07304995dab082efe3861d27adff318d6c42c390387f2b0729cd67baf4adabcd19cc76909ba0f971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3d85bfdd6312bab5c6c8739cecaab0a

SHA1
1bf0b525e5e6f230798fe17fb179c23eae12ffaf

SHA256
aade80b80d760156757b629bbf2aa48cb0c03d609ca5163c456b93ae96389571

SHA512
1ff83080bf07cf455ccd0682334611505be9d50598e82a45b2d94a247cb8ae0d393d346a49bf5aee257cdfbcb689e8fae2ac9c3c204e66b4d65fc271e3e9ec11

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF90.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit