ddfb82e483bc1fd9d35d9498bd6fde7f5c416eef503d8cc4284db7bc69c64d88

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a7a3c6724d55d8f01c3561496077b97.html
Size

6KB
MD5

1a7a3c6724d55d8f01c3561496077b97
SHA1

acca7400cf070bacdd0ea9a13a7a45adbc64c99f
SHA256

ddfb82e483bc1fd9d35d9498bd6fde7f5c416eef503d8cc4284db7bc69c64d88
SHA512

bc0843ebf590010c8853228dc06382631d22e1d14380cb76e65d751c88700a9e2913fcbfd3550c2ba4e9e7a8b779fe19af247c14213d14414f80a09288720db8
SSDEEP

96:uzVs+ux7nYtLLY1k9o84d12ef7CSTUFdOZncWZ7ru7f:csz7nYtAYS/FnD76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200abe814b3cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000024f727d894c0a3016d473d39df3c1b9764890da5663e5cc63a52d7f7635b9245000000000e8000000002000020000000055da849c5754f63df32af6e13dc71e6bbd3b5c8e374971128af0c42eba14d649000000084230a2b65c371f6f39d7e2953ca06f590da204d1cf9c485dd4f306a0c1deeaeecc75e35546b4a4a3b6c55826c2c60c7867530a163c3b4e0db8ae9c1ab32295c7946c07086e5a021a3de562cc79b9903f76b12f8f3abae75daa59dcedb34527c395d06f2275ca752545310f7fd5a80ca35fa10ffed8b74fa0c423a3c079e593f8181bbc4d59de5a845547d380610950a4000000002a1726210a486b335fbc1f97312d4dbcf5a5091b8e326d5c7b007594193ce84f6a792850b213a6d9e6073dab612ac0e4355a90b4d4dddd4709b86e333600eeb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB5B4C31-A83E-11EE-9D00-76D8C56D161B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c8561791d6a90ff95e875f802aabbfc8a989dca18b652c141eb7a0918377eaec000000000e8000000002000020000000fe90562f0afcdf68ebb7b918a222c75b75a7b821f67ab4e0c6eed90d66bed72220000000667764d3a51bf2462c545f0423db84a1cdaf1a81d41d76c339438ac3a4f01e8340000000942f915443c91734803e2593e1c9c24e3aabedd2c87d5b3f8ab150a84485f5ee460adb9eb1c98d62b120e5f883e45b3b1cce0e692c20c256ef76411ed35fa8ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410231638"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2028	2336	iexplore.exe	28
PID 2336 wrote to memory of 2028	2336	iexplore.exe	28
PID 2336 wrote to memory of 2028	2336	iexplore.exe	28
PID 2336 wrote to memory of 2028	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a7a3c6724d55d8f01c3561496077b97.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b3cc50a775fdb749c499adfaded1213

SHA1
52b1f50604d2a955a0aea163308ff4c12c24e1f0

SHA256
88633b3648140a793685e245b337019502169323103f3f43a542851a5c286ccf

SHA512
3f536914d5227de0e52ff85aa6844f23faae0aa9d7ee3075e34c3bfb651b529c3454107445aaa55a212714d662cfc9faa7662ddf3fb5091046f989248f9b553f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14cd5e575e287b4e4da60e752327e604

SHA1
1c21102aeff7ea8d7a920735c35a276a187746c4

SHA256
ea6967726b500c541ddbbd6c216b8381626c908781d707762efdbc13770ba29b

SHA512
2ecf82e392301204720ec1afad56ed65936cf6d751cd8a4cff990b904ebeff315228efa3ebc54bd16d7b99a09b6861d6332bad4036176470edb6fe7dd23735f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
498ca31597d3c5e042919ee32025a001

SHA1
73786675968c3e7deb9f8785de37ade2f7f533f4

SHA256
e137204ae7071801e98fb4d40f4f42af7acf4778242038af108c47568abc9d68

SHA512
51183a2540e2d47d3c03226123f95c86e291facc6bdc3288f65d2bf951241452c9f2868ca11ccb44b62274472996cc39a1509387c2e9a1bf07ec3b11ff97545e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c7b257a77674922da43988c28ee372

SHA1
e63dabf675f6ded7420572e9ccde725c0b4413e1

SHA256
dbc742804ca3572b3d622dcbd59babbe668405548a8e0c4ef0015bf6ab233082

SHA512
2f9566fe76f9dc5536bffb61be66f5342ef4033fbe1ef992222eb51b0ceb3155f65cf4cfb15be2413566c5bf940e917b8e23e777c421f1d9a2407371b6a208d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581f106532f17136150b9fbe6641bcaf

SHA1
f860d4aafc019915ecea51df878596cec2614a11

SHA256
2f30c553b40fac599815e682f39117ffeca768fca5d13e2f9ec6b85cbd553dd4

SHA512
fe6f94662220008eed185fa80c7dea0e4908398d2208ca4b954c4ab5b6ed090f849c0977c8a35d74fa2619bfd116e9f64db89d290b3df37c699f95b02f6406c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e889f9caffb800adf081eb435ef68c29

SHA1
234c60f878b1b2201cab96e70ada3250d312b859

SHA256
4276c0f86a42c51e9ed184d4b80429325a8dd3f1beb7321483fab45e5efbf42b

SHA512
8b41af6624d1448127aee76a3b218394a52321849c0ad759b09460f7c1cd1053337e927d882fe142d783b2146ee91424486992c6c471748385355677a35a0a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2269e3b8e0909d1a75b2ba09550c2983

SHA1
a93d3e12d88f468e501c82306dc45abf774fc3f9

SHA256
e3f53f98826077cb1d4598fa04e1fdef70ba97c50c0fe0909c6d420a17873f3d

SHA512
b7588331a1eadf6644830890cda1b4dbd22752afdde2145b30f01ec7297b17e1b94329177da6df3052e8bfc57cdaebd4eeb78dccfdbcb3e2d11baf99ae619683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d408fdcd64527030b84e44bcdb74f5d

SHA1
b7f92d0a866bd009be3befa6ba5f5786d546ba84

SHA256
96790a5b6a04b8d304761592d446d27acc9942f5540027fe2cba3ef053168a20

SHA512
5c6125ca92747981f525d0897448c771e57d2e8a9cd96973f3303c516be2716f87c85dd5e572e2e236937a0a3390c5314f58ab0b9964b1136478fae28bd81249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f62e84afd3d1cd455b92d53220f0e52b

SHA1
3f63da841aa18873d29434a4103d1664d8d2fc59

SHA256
8db5126c2446ce8a268faa68f69f9659d02306d2f13b451fb58a11b67146fd10

SHA512
f1b385dd5ed0db93b3a6cb996bbd6e6685b5911456eb12ad1264b96348657a36535f55546747ecc68609629727bd7cbfb7cb6bfcb1157e1ae42793a13f248f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f59f4b71833045cf8ac3642d8b56655

SHA1
904f5d82a84a4f77e4d7742dba116f371c25d515

SHA256
7e38bccd62a775b4f14b02cbc9ab3efade6c90056b900e06f06f0df12988bbe2

SHA512
62f0a6cf310a203a4a0bdfdd7b1f4bf6a8c8cf93d1e05e5d495fc0e69c43729ea3b6fa9a719e60ed93360f780f16bb74aa77f9feae80db3563d4ce006fcbc0b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e98a58cad93cca4addf80659b3f7155

SHA1
caf2d0b0578f62c78b00f90efe53673ce5b8373c

SHA256
a47ef3e312a0423b3372480de21a49adafc44b303a3a48eabd08124c356df447

SHA512
d955e248131604867485bc358aa48e052d6cd37418715e526cb72728847f0d25ad82baabe7efb3e700bdcbf6fa085ac71e57b9731c154dc8cebe5d3cfd43201f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dfa680054f32c8932e03b578c143a69

SHA1
5045527547638f849fedefaa3182b8fe2584c3c3

SHA256
4a92ec375c23517497bad00e03ad95428840b6e7147c13e8c03cbbbe84c24334

SHA512
833f7e8939af49705b0f1b601ffea01aa213acd718e385f16c1c0efc06f182564f33eae015fe6c621d1732ca462a4f9cafa84e633d26925c512f33495bd47970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e2e9cb9d09bfe0e14efab90568ae6e

SHA1
355a9e12aeb3e97b05c9c77a68630716422a3858

SHA256
726810801251610fdf31445295021015f66af4094a248001b03d82f9ee9ab268

SHA512
43db377df82d2fbdd12a563facea39ae5f8f314d7359d6aa2f8e038015a66f8d350b2cf044e1bf9c135592e9615dc56a0341e1c1eb4eb9bf8b9810a144574502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c5335e7c76d326669e7ae12274d6c1a

SHA1
6a2e5e270bd2367dfe9b69c2d2b55d98b7036766

SHA256
18cad941df24d0f944f1fcb75be8c7c3fad6acc555e422f8c8f0fa17998379be

SHA512
9af59eae8d1550ff5c81103159f44c536d8e183a8b652c3d35b6bec539946309cd90d1d392439e0ba86e7e9206c63ab8fc729e74f040d3425769a3f5f5c9245a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64906d4850b8a778e661e9c4714dd7c5

SHA1
70359aa1acbc17c5cc770c132b21c84a7fb3be9c

SHA256
e30d5c0b330a4d8708177c9139512473263f70c6847f7cb9461378a21fba38eb

SHA512
cf7503118b5d352e208b9aa9b1fc81a536d08e99cb4c5d8eed4be53cfe08a0620fe34dd46569bd37c8d29969c093af03b10b85c95dac9a3ce1f7a0c7608d5983

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB77F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC02A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit