ebb2f2bae3bad7b38d7d9adfe7500ac77d6d5b179182cce895a5057cabba45a7

Analysis

max time kernel
121s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

170606937eb4d24c8206ad3ea1841a74.html
Size

99KB
MD5

170606937eb4d24c8206ad3ea1841a74
SHA1

0e41acdc3e4f855b2a48b83ea53cdefb58c71a7b
SHA256

ebb2f2bae3bad7b38d7d9adfe7500ac77d6d5b179182cce895a5057cabba45a7
SHA512

fb32315be8d70b8609d454767324929fb6ff2266b8234f51eb3fa26126c06e09ca6a180387223b8cf1ebf39b8f3ba9c54f0e93216625f1829726102998256225
SSDEEP

1536:TI/L07ukvetn2tnKxHXVX6p6rwIuP/IPpX3ojU2X1c+bbXGj9k+Tp/xSukRcB8CN:u2nK5cp6y/I96HGRk+TFxSTcBcG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000bccdd7d4ac2b58139e32c834cdb476f5488812fd063dcc9d7fb533099349c6fa000000000e8000000002000020000000a3867e71d126ccb383e4d48637633748526f54985dce57ad86f8507fa74f564290000000f772401f5dee8ddc33fa46b51ceecf53875416e90680631312b2684927defa496944ed60fb9fdebcc04445d916a6826814821f6801cfc8743061abefabb8e1b54c2df0e40b43a65495136a653fa464997a6bfa8638d89230e30423fb57fa3ab99ddef2612a7e2129bbae2b450a9c3f05515c218b959d7a8f5ebc968f27a3ce2b169f7c2b91dc282458317020f3df91fc400000008b9494438d5603ea88f53b5aae8df975393634735c2c0b1590fa7f376143092bc529d7a9b3be2a199953982e88a07cbec30385062d2eea9a50f3ad570cea019a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b381f1173eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{060AA861-AA0B-11EE-89A8-464D43A133DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410429355"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000a308a036ad764e11499e9f8e691252f2000735d7af4ef23d57e5f6e54f0df9a000000000e80000000020000200000000f321ad3cc8bd5d5f533678640b3b8b0592e4b02ee2e46ead1c54dc910563fb320000000877095c9734835d5245539776d061d61972ce28eb9fa1ad2008d9d1dab19339a40000000f9dc5e1ade2a5f05798c247ca9ebf4bdecab81e4c699850488fc7080c1258273ceb0f6f6af2f88a3ff7bf427584b5359fd3209310c2863fc9604d7d5eaf28ef0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1312	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1312	1704	iexplore.exe	28
PID 1704 wrote to memory of 1312	1704	iexplore.exe	28
PID 1704 wrote to memory of 1312	1704	iexplore.exe	28
PID 1704 wrote to memory of 1312	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\170606937eb4d24c8206ad3ea1841a74.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f1127263d0dfa72fe26b6e78675ad6a

SHA1
104fb6bb497e0eb88cf686930d3c136754c4358a

SHA256
425857b90de3ed33ec3b8dab5663d174657a6865cc8a779cafec3cd84142ab39

SHA512
492377b69540a3d689a38a2eea148f0f7c2dd42744d760ab339f2f48fbfed0244f46af3e2ce3152a0b15371f9f0795eca03e822b217c64d19f9dc5eca7c1d316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94a451623d403f3603da007f395f4df9

SHA1
61ba5d200b00f38acb898362111f1f97e853be5f

SHA256
7bc33937f04e90e6e33dace28cd931d242fa9d626ad8c427fe5876524e2e376e

SHA512
c7244e93ff71d2a373078aebe17ff83399f141b3bf35b32ca13a1593eef1da7d9f3510a5ea126fecb1562b93b633511a44ca679ff15e885d0576c28ae32dbaae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e835556b07da0eed36c8077ab51a185e

SHA1
118a21e4cce06668d24e4f4aee1f0ab7469a6997

SHA256
764443ba16e327d040e967c6f5564436ec7374aebf764c3d96bcd87cfb90c639

SHA512
700cb5646ca4b3d02da423f761cfe322d36ee0e28824d20d9a3c97479b66e38d6c5be99311d2a7bcc7baa27c83e8d2e810ec0328199e4c9be36b5e8491a525b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20d04633bf8a374c6d765fa906f9ee23

SHA1
97ffaa818826d4b0008460f9c439c9584e4842c5

SHA256
a6b7309ebf7a27523eccfc88ef580ff86fe761d32804419a2a613cc9ee0d465d

SHA512
9765c4536882072f0fe3f1a3cfe191a23f33af5e4f3f915fa44b313176098a0831102d6ef639a7ca888f7c3bc64f7abb12d65f9b00ac95fd21bd7f24bee8dce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45122653f78c4a1050662d170a2d6b33

SHA1
6b99d6ad31c5e2afab43ba53b1459d1bef8f493a

SHA256
20e1c28765a396566038000f320dae05eb97ab9efd79615f083f4ce4cb549423

SHA512
8bb18fe639e8164f8862f8100a64f70340d118ace5c993f40edf678352017fa9fda4374b7d4d79f0d3c1b91d0c76d230812eafd18b9794e3e754c85769c0c855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883d2b5f9e8ae4ab8501b6c7c420cd73

SHA1
e3284a6eff879c8bb40d05e4d596ae59c9990132

SHA256
0563579bf4f24c6599c2388b6ebe3442d449049ffdd0fa8b57f7f8629fa1a4a7

SHA512
7f4978ff6ab22712734451391bbd20660afa17a0e448eb565f35c5e809e577cd3fdef6330d22f111a2dea882a5034ed8144883d684b054704ed90d6ff4e7799b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
405f9019393d63daf922b2305f477e4f

SHA1
394bc07801c3a459971fab8ccaec49fec1d00dfe

SHA256
0f3da393fc2115bf711a8d68d96205b2fed0bc89fe154d5e185754101af4e158

SHA512
0e38e8b0bd574a1f895edb9e05e1226ea5337fbf7eb9b485b3690d6ffc6b086f32422a1e842877325b52106eb494132469b1a0f28582f2091ad134562bc7efe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af6a9e1bd0a75e9e48168c0fdf743220

SHA1
7aa991ddc1a3e7f4fdb1f1725b595db393c6f3c0

SHA256
7ef04aee50d0dccbaffcfe0dc0705f0905b3e1b721dca66cfb8aaff602c612a4

SHA512
c3b801549838010eee000f1304aa7e956d6bf3798893cef0f46c94ce2c857bccf218b39f038c8e655990f4d5d130d0858a02fa208ee9dfb2a218e9e4862c6fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e044cf47f517c4e0e90903e01bedb19

SHA1
21ada12c3caed6263e0f6370d31ad6a4837ccbeb

SHA256
32778beb414a5af79ef0e2e0be5293632f582a5b11f1f5c1843cb550b01f8536

SHA512
669666be39acf3bb5a4435b164c4f38f61499184aa2cdbdaad252941a546ab98d8a17641084753bf0d1678407df65c7f6da00d6ee5de37aa8869d11f07c044dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f6ec0e920aebc5c84b2fb79534a9f2b

SHA1
428a5fee942041578351e9f0690622dccd71b72f

SHA256
fed273ffdf3bb0643926c718b55308262d8fcc2dcc1c2d8c0b22b4158fc03d10

SHA512
d382f31a29e54dfd975e7fa0c2b34953b13db30989aebd9fc142ec9bd160b19563a6ccad5e5ba7fe2ec998b1cecf3dba00b7c81d6da196311b3f12056af5a82d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4b3d90c7088ac7f16e1dcbd6e4b370

SHA1
52dea9fc687a8a776b0056d7893423f7ea42e67a

SHA256
fbd30b4eb6e54dc27e750789782d29e27f8af4a658d0e3fc65a1c07740a1e88d

SHA512
3cf403d1dd912bf31d20e6eafa9a974091496bf112037e52262a24a67a2cb4b53fac807c3e5f177e2b0f81bfa3fd0cab6fab2d4b13ee5338040208d64f2c6979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e000b4061638161841bf1650abc29bdc

SHA1
1acfb3cc0ddefc01b23fd1cf7e9b2da347165dc8

SHA256
a4ab288adda90922ffcbde83d2ebc0c7c75d1650db97f75f409cad543cad5416

SHA512
e83b33abcd915af12b8070fb49829aa84480423d4155c059844077c8892567e63036af9cf0a05912d01b17e6db3bbd8b017cd7a66813ccc71b2e7225b46e2d40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d692614aef3110dbf2177964798ead6e

SHA1
50ee1c6d769381c9e23a56cc34e61b558697da13

SHA256
8552776c2a204a187ef171181333179ad9d1788b3c1375c5a2e4d1c2b85ddec4

SHA512
9784cc5159d819b4e37cac6e640937c9a7a06315ec5ca4451a8276c0da1581f25b4a7b28a1d3b8cb80eb0c71836f6a6613065beac905f3a5f0739f10e04fbeb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4808eba97f75c2b492c47631cef0b6b0

SHA1
8ac93d424d6c2ea4a01e193d0f67cfb47b856541

SHA256
29466f4c67b40d8703c8d080f032b3b0c3cc931ab6c1f2d163ff6b21c982adc5

SHA512
16eece12f73c1606ab8f1bdc56f5c741708dafb9569a7c44f67f7d494f63c9ecb9c223eb930b54ff0ce3e28e18e6963e6146450b176f569387caec03b17172a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
5e9f365074bc92e32a9a6f1dedb18c42

SHA1
acc24d88d4fcfb97fc23fbdb3189af9da683e96d

SHA256
c3aadc0d429af6c4a7f1349761b9bf1e218f59cd8863363af4ea177fc4b424b0

SHA512
bd4d34d94428e6500cc276189cb6765d1a44788de203bf125ea7f7b68f81f75db919ebbc21d3296603739212cec23aecb407ee14d87c8c291378d0329b7bf6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab741B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E04.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit