dd80e718410e61af4d8c5cff4df4ecc7d48a3dcee392cb190d4ea3847ebc4a1f

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1814e677cb46e492f245e5e01c589cc0.html
Size

58KB
MD5

1814e677cb46e492f245e5e01c589cc0
SHA1

4053287f15e7cac0f5b68b809ca6b4df7bf5c9d5
SHA256

dd80e718410e61af4d8c5cff4df4ecc7d48a3dcee392cb190d4ea3847ebc4a1f
SHA512

21fac43539c972d6b28c9f79a688302991641e1b35aab68e1c69028dc8fab8500ea0327a5c45490b824c0eb7493e2f5b54c0b52c3f85687a2ede7a05e38f287b
SSDEEP

1536:gQZBCCOdV0IxCA9VhfdfdfYfbf3fPf5fLfEfAfWf+f4fe8fufufXDfzf+fUftfDY:gk2r0IxN1FAzvHRDMYu2AB227bm8VbnY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410215076"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FE38531-A818-11EE-89A8-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000cee734d94185707385cb6f054659f304a02001b56fa122df1cffea31fa397584000000000e800000000200002000000019ec3e55db49b79597b8986cc65ab38a79fc2787a2599a281294f3183dd43f6c20000000f568a474d2fb93c43c5facf4091bf1573f7696e726696272966131ce888aaea540000000d21e4e2be2f65da61dbeecf9f369a200a40bbfd1ae9526a064267bd1003d726f5dc72cab88b966d98fe089503d2976c8d00318eba742888db760c04bfb3dd652	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e62a0e253cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000004b957b6b3f8a2af42661b3e463223b56b44e98607765fa520d9e2eb86ca371bb000000000e80000000020000200000009d47fdf307a7e9bf08f5081dbe21d835caba3c29965aea4889a21670114b7e0690000000d42f30d82ab878cb59c769140bc81dec720dfe22763f3717dd886b8053fd215cbe2b8855b00c432e1decccb44f56007fa766d85c4f82c23bfefbd22cf6f5ad185cd75f32650787ee39f654cbc6c33f15f08971263058933fb5dde14b8f54cb9260a2d029eb5d98e99d03ffe6d478639fee8af9eec18088cd733ef331920863acc2cf681bee5eaf7e722987cc02c6ba8c40000000f48b9d2c55c7c4b939f1c3a93b82c941a886a87b797196e3e6c741e06a9d9f8130c5b9b571e3df82a0a888e249fb997681007a59e1229581d52bb4841e08ddb6	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1040	iexplore.exe
1040	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2108	1040	iexplore.exe	28
PID 1040 wrote to memory of 2108	1040	iexplore.exe	28
PID 1040 wrote to memory of 2108	1040	iexplore.exe	28
PID 1040 wrote to memory of 2108	1040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1814e677cb46e492f245e5e01c589cc0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cda4525c16953567dd9fe042a3f030c

SHA1
63d728f4708fe2f80d01f58f9f1823fb72c70c5e

SHA256
6fc730bc293eb1c84bfc2a60f1cadc0cb825b2cb0bd78df06e79d174cca31d20

SHA512
ccf661e1cee72a02d512e19f08ce76e7eee2a0622678acf7a29c5399f7cd66a72fd9717c87a3eca0193246d9e782b245a310ec2a9805f612363f4b187ba3e65d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e009b11a62e65b884b29e5f2dc24cdd

SHA1
14295e85155cf4aab382b575593c794b0fae2ed0

SHA256
038be69950ccd3e0deae418ceb25c61c83ebd40c7a219d8a94d8af75ed64c2ea

SHA512
53e6ee1a6e65d33904b9392726e98585b554605948a7cef2bd6d412bc458eae0349d3228d8440e91ef69ed97a0be1ee92180bb4027038b067473b8741b053d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fcd3797c6d3e0ffd85405da8764e041

SHA1
8724224eb98d3e6e793f2c538b4128a8a7adfa27

SHA256
56a42ac3643999daaa597b6b81dfe335d4056ab2c7dd9d774b1ea56163dba2ae

SHA512
fb8aceafd49293eeb39ba61a40542bc41b843d19309ca3b34ddd5deecdc9de77d4d0411046e1d4815bf69ef4625661d2f4315529549d7ad282fe1c87896d913b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4caa8fffb6a98b9d65940894419412df

SHA1
b4bbe4d05dff9627315c33103faf38beee4fd8d1

SHA256
911f1644ae2fc6b1970460b609d833d21c87fe18236bc2e00c30c9afbfcc302d

SHA512
3045a0ff0d27b044fa4171fb6eaf7f3f588fe42ce2aa04e11d9c7b3c50a4e409c6e67af5f6eca9c56af3fdfb94d7a45f26e114e9eb0c274b4be3893510db8863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c08c34e4262f1185a763ffad200d6367

SHA1
e4a38a49c0f655fa99bb5bc905ed2f4d1c7ef8cd

SHA256
299273d648cb0dcebe90178877abfbaaa119d97f4351affc8788d730aff2ae36

SHA512
1dec322030b36570307dbfd72d73448dbfaad6f286d73aea685b95def42e232f79d0de2806c4c51eeb349fe8039fd1f7bbb50f387bc4005bc54f760d5ae2088d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf80719257f555bdaafbe1061d33a5b1

SHA1
b520bab89fb85f4f91729af4612975c551ad9132

SHA256
46dc7aeed06b0e2bd330879a711c0624199415585137eeb1623657d253a9beee

SHA512
24aae70aa134c4e94dbe4ac12d7e91ed0149ca795b143c354a0460b2ff51d00848f0f3280ec5c8e0f42f3b83f0e7882f4c7ddd880e6f25ad249fa40a8d21e97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e4c20efed95cb6ed83f44ccc65492da

SHA1
f71ba6e8c1bb13cf005abb976a7210d368cb2d28

SHA256
8840df3fd3561c451b24463a3c19641dce78864539739140c5e457ecef2b61d8

SHA512
036185a7b682d8f5e91c4aa5818e41a8e814e4a7612baba85b4a6ccb97f5ace6d341545ad3c382d741585bc727ddd02e64bdcfa45acb75fb1a28b9302728aab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b03f1e00da181c822489a45b8235d26b

SHA1
bc4fcd7c1d4e1749c9fd83d36a45db8d6a803aa5

SHA256
eeaa5ea07cc324aea965e7b683bfec9a8d6637d676158957ad241a5f4b91f930

SHA512
9e4fd171401fc9d8ee65586f6207b1b785d8724711a6d8b2387c79697fed79318eb4e3f1bf6e9018089afc9d14eb97a81fd8177d430c245112bf12a25893f0b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1832085335d4d86fdb5a5e04572a65

SHA1
700cfac3670d21e2d74d5737de495d30beadf8b8

SHA256
335b5b1ea1b1704eeaf38c23ff7161a74832c2c3f864866e313502fc32229757

SHA512
f9f5fd81483cb77e34602f6996e83bb662a645a759af286ea04073a9c5fdd2458390303b09b72efb94e80c31f292654cf9cdca9d0eeab29bdbf92d019eda52c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e2b241bc69137967eb16f6e6b145ed2

SHA1
77b27f28c11c74c1726197e23e51a1519b077eaf

SHA256
05585ce6691048066ba622843ad367819676b6a12c9e1cf0d995e6c8219a4b05

SHA512
c3aea9caa03fc095912736e8680414c76fd7d393cbe2c10a71cd0e46c28ea59151738749155d215aa42efe31558c46e8bf8790b3dd0858a4337fc0325b3679d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3219c6dcd01bc91d019907c95514c06a

SHA1
fbc7a8746cd11896075d575623b3b4ea9ee43772

SHA256
1b34f42283254d6742e19206df92960e5a2e83f393a9e1ee05521849d03f96fb

SHA512
f008fb0e8fda7b34067223dd31b470ae636a2e1e56727903e3fbbd72ae7832b5cc5cf1b0c29b0b68820158eaf7858f4a94d7a6f72fcbe4573638fa261dfe7b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6bda4646069ba695f99dec7533637ec

SHA1
d0802878b19d4dff6b3168e59d4a1f463bc8844c

SHA256
781244783e61595137170f2edab11ba7751cb4e30c89d53a278cd22097e8d6a2

SHA512
12b0eb54669bca5115849752b7406e9970d65dcf3c395ed369ff60bf6d1ade3a42a8cf6f0811b3f912abcc1afabef773a1671546bbd584c8d7b90a30bb4d3c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63c1dc5ec2f6eca4b306d1f626aac981

SHA1
eb66b3da8dafb1e001dffb470e8bab29053f2d80

SHA256
fc3f228f1a10033bbf537dbbd74587a3a51e83d737351748b3f373ee95581e25

SHA512
531c74b046198909f91a64c56f78f1954724b3072841d95015fee69424f9aa98c425ad27d21385d8295e619ef9be9b19e234a3d63de9c877b93fbd89fa49553d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4710.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B67.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit