b30e27665cb3d61989cb24bada1314741fdd118e3d90461248d756e77e0485d2

Analysis

max time kernel
140s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

193fd66e260becdbc42f9859985f0402.html
Size

432B
MD5

193fd66e260becdbc42f9859985f0402
SHA1

ef8c5f097b176beb8b688627b32aba8cb492941a
SHA256

b30e27665cb3d61989cb24bada1314741fdd118e3d90461248d756e77e0485d2
SHA512

c4ab7465dd1c37f9f63916ae54e2fe015fc344c13e8e7664691fa8811a3799f3cd9796c020390a7ce004d56b4ded1ed5182266e907fe3015c4f22a7114f21807

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e17453773a7feb46dd2d0d6fbe2426359a3818a7edd82c1ac7199a36af5ee503000000000e80000000020000200000004f71d8aaee016e5e18eca87f547f805a51ede523f7683bd03c4577aeb7d54d8f90000000ad823f5472c0da0bc387731b5b8c4dcf3c62f75b5ca24c9773c05013f30d8bc19c394861455db9456593092b198c71ee1dfa1d143edbe22278ac4a246c67c0f481ccbfefbc563c471ae3b66d937b4da594d195dd2ab6a4cd4938c4c4389ec1a649edd82467e34b5bdc2083eaac7a72f33609d8bf2f070e9417306abf61b2348a9ab3a9db71a8120e44662a73d63eb10c400000009c1f7c18559ded2a85b51359b573ec3cc498da01b5cd3fc499865f122f8a49aec5d27687e43496ea59d74a8bc0247cd4d7b1ee4127a82371c807084e9ba247e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82945F71-A82B-11EE-87B1-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000041a23c5cff4aba2f48b1ccb5e29a5b105ee00f9de4350a71ee85df3d0422dc43000000000e8000000002000020000000049d3e1a83599d3a44f530e07d50d4ac16a09fab6e5c6547c1da1e30c84f4db22000000090077ab13417b6a010a80ec81d3555de127eef808e45e2164902dc45cae6634f40000000b8bba0af7312616a0ca0885032b8ef6c6d168985086fb8eda97c514c26d1decf1ce29a1577d5e8209a9b697c94782994a0dd4d07d5751d4a7cbf274777ab7271	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410223406"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70754048383cda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2408	2300	iexplore.exe	17
PID 2300 wrote to memory of 2408	2300	iexplore.exe	17
PID 2300 wrote to memory of 2408	2300	iexplore.exe	17
PID 2300 wrote to memory of 2408	2300	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\193fd66e260becdbc42f9859985f0402.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
955bc09e2d5978d440a7a0e0dbe1951f

SHA1
3b077b246798c95517b15bce3f8fdf28c3c7de0f

SHA256
4642cd69d7228d827b867439811014bf3047780dd10db9a5a6006136e6e6cd94

SHA512
75bd8f43450b34705e15de56c37e6b95d3f9f004e4d51d09968a21b4a1588f5ef5006604168a28845d9e42f0c65548451055e34f2252cebdfc1af214355971d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5947ea6e5416c875e74ce189147f88b4

SHA1
9b5f36d0e561ed4cdca2f83c513fccaeaa51d06d

SHA256
f801048a0e105b8a22548504f35eca4a2f5138bea3721d35f428755b2baf53cf

SHA512
7f65eefdd7490614f5b88d055d7b804541e0ade1ea367727c7b631b0862ae957c8a92271977bd92dc751df99c3996d6660820f096caabee083ba72748777c5de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb35a3b9010cfe446693841287ce5324

SHA1
c521f6ee308e1c2e344819da5ff8d376dcc939fe

SHA256
3d95ba97a673bd13ee0e9a28f150e38ac236026390178f61b88448153a64bf5e

SHA512
107fb28c2d32d59738fa26a52d31381640fed855a88eb365ff7030b9dacc1e0ac41a8ed7241fffa7e7cab067901f5d478811ea667457921e846e24a05955de43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8bd8990907048d743cbb2218444b508

SHA1
bebd6ff1cf3ab79c4004d2c0a9e2f0fcf167e29a

SHA256
0614d8fac91149e2a20f9c807a7941386707009994cdf4c8a180f0358b3607bf

SHA512
925936036a0602b75b55f09d1a96b3616a13de84eddaf7f84024c0c7ea2e97194ee17e9a3cad6724bd685c4e4b8ad0725446fe5a4392054fa84ff61627f37bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c20fb5f2b5a930c33acaae04b01377f3

SHA1
41c486ccdbe31962a596d380204c09ec03c94b94

SHA256
96ff3fea3b8565c446cda5ab4660fa7fb629c9bea12f2d992a0e83d787085eb0

SHA512
b8369d5abfebce2ff369d3a622efb82cc54b0a55694b0b347451038791594c0d2755a407efe138d09d4adc39022ed86e808d1ea36fe7dd2bc5e5a0c8ece8ea47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44835ba986c72d270bdef7f6df9c22ba

SHA1
59f94d81c7fa5130effd8aab9ca522ca7e8d168e

SHA256
671540b8941b24caa80fc244700ec686ffaf690afde318ab1f262189cb2e4a65

SHA512
0352e95aced7c9ccd30d9aab4b769e7136d6887a88fb2d9b3786ff50030da6e9c4992dc72173ce453f4c33a4109d02a4050daec3b5bd7267954c28a8a311096c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1adaf2e765cc9cebe786eb77288b8f48

SHA1
f706bb3b466698673e810b1773c8e08055777864

SHA256
8dfb1013ef6747f985d46cd5d247ef0a1dfa147dfaab7608ca7c40e44238fa1c

SHA512
b4d16827a6a246568e071a9caf75b2e25a268219657b4c6f1e1a868a0f976bea43348f5ef15fdc63d1910ed7dbc1b36d0e579a0b3513185d59efa4d6373ec5ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
621651a514293cd302167afb7d2ef045

SHA1
48c2f13c9a724100aa2763b9c3a551cdc40e4d97

SHA256
049fef045ab65562143be6ea2e72704ef58e846e55c423fcf875cacb1efc7dfa

SHA512
4bc86e2827661b2acf9b7a6efeae70cf308c9ad44ce6fce1d5523fddbfd2f1ca3b67ee101df9a5aeba46153536d90e52cbc9481226f9a51b1ea5fff1dd36fef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4afe5482e2724ddf56f077b81838796b

SHA1
51de9c4db7e0508356813ee4285dac59300cde64

SHA256
202253ba1c726186fee6f1c33be65e3e98cf0b59dce92998d457c4c7d08b2b24

SHA512
3517a23d888da4fcb8b2eb61e7512f5ff425c95fb78a95819b2dc87725447264fbba796c63d8125f4de5eb2d5520d5884a7287a2cf67e3d96d685dc31ac875ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
384e412484f790148b61efacb4b77721

SHA1
b862ad55b5aa695045a44d690b8e566719cadeb6

SHA256
6d9c487c2b259d9f203cd66d3c55d99837a075a880e40a1e55f487930eff14e9

SHA512
cbf26e828252c057623135b190eae49c312e27f5beb4af23136742f17b2e5f98cd821b0cc413ad4f4714f5b914b921232fd1029c5bb9f2ea3a18b15179585dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e2888d43ce97271c3c488f3c01329a

SHA1
d7c7bd29329d3efcc6cb12f1191cd1c3299dd693

SHA256
5954657de9bcadff1e9b685e0edd0a37e176241b3590ffeb0fee8c0940909e60

SHA512
b384eda5ca6754af0f82376e36e6bb896b1cf543df5aa0f53eed42512d076e95dbb6322f3cd78b29dd7487f463a3f140b60ca3aaefd50e36a3cc653b57e1bd7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abf17dd7bdaa550d399dd77355e51496

SHA1
7b29ceb5990264a5c3a6c95a9969f92f77d6da2b

SHA256
4d0292ac5cd739feabf8fd1270b5b55bfafd9a54a611c5212d7c86711c6ed373

SHA512
0c054a4fcfe7466bda531a444ed63897356c376efab8c2bfa8d10ea4e90bac8088a4c8bbd5e61d8523d4e3c21232b3815199d3cdc5f3a05ee12b1d07979bb337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a135609297744f0c2e56c00247f43aa0

SHA1
b58d341d673943f380489071390e82ad40278e42

SHA256
914753768aa16f166c65daeab9e6f39ea9f1d5eec3c0fc7b23b7528d22f7f7c5

SHA512
652216fed8803320c6aa1424eee5830485383946ae66fc0f766e08bf710a4465179c70ed0635b90531a7efb50ad4fda3113c222842b19124cb5ac7c490552e8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9399bb62b8638858569be29c042710a8

SHA1
2133a6634cdce1c9edb5cf64a1c9b632b7d53089

SHA256
b73f3222b395af61e78b74eb5266bdcdc1b1cab051ca3d3fb33db1cb2ecb2b31

SHA512
28a619d76cb8ad59d27e2612c1f368c679600893b0da6fadf8ab2fafb26a87afb093ee88f820042934a333df7127a121e0bc3cefe6672584416fb44c3b56ea08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a785ee6f899e9886182163d3b077f6c1

SHA1
ca7fe7167cc5f6a9be052cea3e2ee7dc73d37770

SHA256
ed8f8f332ebea57885e69e6de43c58013daef8bfba36c9521020906eaad7d054

SHA512
29c53600564a1005394b60a098b6bc744af9559c3f4385ef1971bcdd941e4a12a93bcf37821c4e3e3f39546d888c04ed156cc68ad6896b577e92bb8ce2d1c7ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab235B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23CB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit