2482f04a6700aee35548f306ff47bbc5334548611ac746ae880a7407806a7768

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19046af63a717067f3e50f881282a3cc.html
Size

103KB
MD5

19046af63a717067f3e50f881282a3cc
SHA1

af683c558040e71822c6cc761f055a4ed37b2084
SHA256

2482f04a6700aee35548f306ff47bbc5334548611ac746ae880a7407806a7768
SHA512

376cc98355a788613c2350ea7653fb68526c0dd8aadf34d8d986de15df6e862985581e14d17b62e95f9de029b48bb87b29add4e85fa17abbc72d546c68eceb81
SSDEEP

1536:+R5SCeHeVeJeOjfeOv+1r6ZiRy8Xc7SuoaAc3N:Zcr65oaAc3N

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410449071"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC2A26E1-AA38-11EE-B754-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a093d3ca453eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000035354aba04c8e51cf88d41afc1fbe6282d5df19bd3b605ae363ff7a3c7444bee000000000e800000000200002000000002e366a3c970459b688e84c11bf9d255eaeb0d4fc5f9c6d83ecd8a9e22a8e994200000003b2ef4b0e359c87d26f25f81ab8a6779d5ee496d6df05120be44141bd00a2f1a40000000baab90e810333efaa9039e09e5e44934a54b6d5f48e700487825f1d42821e9ee022f34b8277e1060b8bbc506e11efae812a58f1cc90d73de1324b190ab54e89b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fc545ca0027eee4acec5cc34c7267f569fc828fd7fbdfe5e0fe65c41931e8e09000000000e8000000002000020000000083826714f24079dd391bb893a882c326741603a7ffe631031df06a432e4815790000000b056d8e7be7b9e2caa8e224589e35bfeb05904c4ddba0ba6b71c4b7bb9e46e6620ff5daf6fa3277bbce027a78149183abb6cecab05984650a5b74d20244bf3f41b120f3c27c60193ca72df0462c8e1e177a9bca214c83ccb2a37369ffa04c1724b01b412a1876ae94974b371e227271f07577bdeea6734f2222d3e36b7b0cbe0eda1bdcf9d2d0f2cb0dab51eb449880f400000007c922590d8ce81d3351b23c851baa13b68e8d8919519ead31db5c0683c010875371fef54bfd37320724944ce020acdf5719c8c6923b225e4960853a471461ed9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2988	2236	iexplore.exe	28
PID 2236 wrote to memory of 2988	2236	iexplore.exe	28
PID 2236 wrote to memory of 2988	2236	iexplore.exe	28
PID 2236 wrote to memory of 2988	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\19046af63a717067f3e50f881282a3cc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf6c08a9da7af3d08bce401a993a7c8a

SHA1
c019f4b8a0986978df93c152d102e7d1a722591c

SHA256
1480a25e0b09c86d866cc1b1d0ae0c9dab6af0eb3386cb404dd8344b6d549dd1

SHA512
13d791bfb40710b2b461dfda812ab320b9744f24a52cbaf90eb80ab66edd08b3de5009cdde079154b1aa7da9aa954b62fd785a6a89e048627649a4a374ace711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85c61ad46c949f5d565a1652572e7860

SHA1
ae55db25ef8046787e7a7ed2885a71b1c61475bc

SHA256
912e7843ae526ab0a3592c467c6372e4c07b1f90630ee2d62f0f3c636099ae39

SHA512
c12a155525f0fdec7c941e1989789ff3ec9cdadaffbfb8257241c1cb97889f833b978cd6ff0fd08b28b602ecac7c1f1dec17839c6d907d80f1ee5ef3eef55550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03975513496fa836bfe6c2adb50af528

SHA1
ec1351a6cbdca6a8b23c6ab60c1b898980fe0965

SHA256
71ac3da3c0cabeaf7da556385ba4ed6f9794394372242b28f06f3e2407cac525

SHA512
71381a4fd223634614cdf39c1b623f7ad38ce565488ba8413f84b3b5311d36d83e6f0dd2638759e0245d580a56bd0d354a1f62f5e2038b338faba0a351091926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af94464f476d498e612114d1e658234e

SHA1
9077c90403d08d254dd3e2624d9e4f747e948328

SHA256
fe880824bb94f6c72231f2f3e4cf850f7d268925fee576153c6de7dbaeb27e0e

SHA512
9381313865ea455790ed14ced9e635166d751cfe2aa3b6813dd51e7959cff97f91a87cc5abefd11d5f9d9479ce0c89d9c46961cee1cc264053ee337bf66379c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3619c323026bc75696b17fbdde9142d

SHA1
2c5f4763405fe93c495cc61dd82e30c958b69ca5

SHA256
1f8dc71b22a1098a79e002fe6ecbdce202bd638d3ada2e7b94ecfe6f2ba18077

SHA512
feca8e11135f7117914c0ee845f537c129b09e1f8ef5c1056840852357c2f0376e73af138890c0f248ba756b438ce636ea7f6e521d7379677fe2b25423ab48f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c853d9834b21a0c082a714f8d7adf93

SHA1
edb6fa43d4896a2016f7d885e48edc05d130052b

SHA256
59aea5c0a11dfa90a5ebf72d8a0605d1e3fff693a5c605942b327a693c5f5dc7

SHA512
c6ec400fce6f57b580c02143ca5a2c5f689c2cfeea5536992d177a132c56370e055451b31c2ad5261854850b4cd458dce3819b1cb58fa87317b87ccd56c5eb00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3318bb23f87f08390d004129a664233c

SHA1
692165abe79966bf7aff882f90feb8daed4f0250

SHA256
d84fea209af23ba8e4b76b5758f5db091b5874f8e13fb55e9a4e9f0aa828e938

SHA512
30252715506106282d372ef153aa5c57f92fe3d30a98a8f9b3dcdf850032c48f44f7c8c298f3954430da2ebb37ea0b4f5f50693577172aea0cd8b81c918e2847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b09a8e3bebc151b25a955ed3f34ce0cc

SHA1
2abd35b072fe070a84dd55417792fc82fe9f7afa

SHA256
6c17148a63961ca88077cd0f139c8bae899052c056aef1adc0f21f4ea6fb63d0

SHA512
13dd10363d9ccb207bec8b6f7e4c0e5e28bbdcf221485839b04e2d456354c508cbfedb99324843616b42d96cf41ad42d07a8815eb0284d30c802ae199170308a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fbf7b81d1ff99548bfc994d00399935

SHA1
ac2dd8f7be932725a3a01621a039468d053c99ed

SHA256
0f871e99b4e7b0615be030c6a573da271cbc67a246da1c196b63c7df5e2e8232

SHA512
9d6e0e738fcb3e95d66c8c5e6852b2a277673708c00c17b3e90b428dffc4403ba8fc1c40e2674a32c04636b326c5b6fd1988e70b205dabf711356094a11de5aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0024f6d8ee6b1be128940df66e62f01

SHA1
689b84fb2a1fe1fca1a614fff5661be8587a206f

SHA256
0e6fab05dd6288dc20951977bb4bd1eaf1e7d1d84c9b54d4c56ebdc24a1f19ff

SHA512
03d316bddf4cc299ae3b42d1b46eabb430073bc74e88aff7ccf6062bd1b016d0476e5bc2a18b673a41322b19f6c739019282fd1395890bf6c5e3ef262e6f0c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dbe2975851982d78f225b3cdecda466

SHA1
b9674968d481c6135a3c97fcb44c12d9e06bd6cb

SHA256
255d78c5c9e54ab408758e617f347fc8c42138c44491023541f24220d2f261bd

SHA512
5c15f91340097670210cae90754d092c3e95823606b811b660e1eda20ab11623d2729c194a56a19258708f05256008579bf675d457a818af777fadaa9ce5ef38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f04da385efda413e05cd60de460e3f

SHA1
6fe49a7d83630b42be0cde9f86414c9866ed3014

SHA256
5750636cc74518455a5688e80cccaf9f2d483703bd2ce496058c87fbd1a1a3bd

SHA512
10a4ec2857b335579586378f4572a88599162265b19941a7fc21d378e1858b4c050cfe3ce22b972e79666b5a23e64b9cd040c12ed3b1652b279d0a7553d8098e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6de6345acad8dfe2605d671df163a380

SHA1
f11b4cb319eb9fc25c6e492a646acd9b039c0b70

SHA256
477185492e09b02a8935629932597e2793021ff9ecdca2e2d16f5f50c70bfe4c

SHA512
5be86724462c04f6ddd95ad061b9e3293b4b11038e5427e0faeac09c2113e27c1ac68567e13d66a7ee6e83feb3290e856790011622286a6317370ac940a04c1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f879d814badb397c072caa8ef6222804

SHA1
fa29f98a2563e0ce94792add647fbeba0cb70267

SHA256
c331f1ef985cbcddfd8d4c9651f8d2164c86bb93dca9005376afefa079f90fc7

SHA512
2a604e1af5fff7bb4fb83c71728f1eab918606b0d39b54afaccb74cc23335be7bd2b2acace4899545343aaad3fc89b6d3fa4c7189f34f87c356994fd5df1adc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21f0239320669d9abd13899470483065

SHA1
bf8d3540c4ebca3c84af82eb02b72da215468b0e

SHA256
582e420a7a0ff5fa7399efe7b256ec3e8b4de4e9f541d380fbcb3766702e9424

SHA512
ccdc4760273d83adb9ff948c0f8b72aac69e4c5b1d0124093e1ce4ac587b0a6166b08e3823e0d67274832dcf21471150a2f2868c7d5c011f845d04699b0d93cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2deb3af410fa7d746baa36410d147c2d

SHA1
9fa951341152a6e8f524aae7c946ff4cbe0bc64c

SHA256
a2172d808888e6b904468357a3013ac52c286aa2a1dc6bdf1da85f54c5c182ad

SHA512
7b5162cb33a773f5ad371bac06b7ad6ce79ced500f555e6ae0589afd2ee85e27d9ea675e07621bfd209d062f9bbdbfd3de8027a2bfc1285430c15a85d5a68719

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF16.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF86.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit