c04278da7e0092e14f70db68c5ffb0aa6b8725b336ea838fc76c5386325fbc3e

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b3cb07614dafb1ff4f8b7d1c9cdbf5b.html
Size

61KB
MD5

1b3cb07614dafb1ff4f8b7d1c9cdbf5b
SHA1

2a5c0a13cfe76214d20074673e08ef12632a7f0f
SHA256

c04278da7e0092e14f70db68c5ffb0aa6b8725b336ea838fc76c5386325fbc3e
SHA512

2d77db43aa760cb6868a76b0d3da76fe80612698d126deeac2f6772805e043703c6e23bb0a515a707876f8893f3d269d6e1e7273ebe6c38a4fffd40f05612be0
SSDEEP

1536:HIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZXvR:GXv2s9FMY5h

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000005b2f2a293438dbd2dfc9732c238aeb1aa24f787629e38734d0d470577cc89dff000000000e8000000002000020000000c95483ee84d1c7c393747aff88eee132ae7bf6f80b3fbade78b08cb186336011900000004f864549f747b5aedb43fa2d0f645a74a1c67dba9bdb9f878a76fe7d5acc62018cdcfcd2d38ffd87e9c68c72551b79670415b8ca06833e773584a4470cc1009431ee50f8b986da8c69d502ffefa07aa13ab869c3c0df809c67396c2353d9af2203cac3fdfe9f76c62b78690c30be227ed1336d6026540279e5cbdfa20de9bf6bad0553f83ee4dc42447dc00cfbc23ff840000000c74aa0aba7a842fc73af4eeedf8aea40992acfadf8265392b7915d158a6e970334c0a781638c2991828c5aae6677708c719bf83cd6197b4f0a3bd269280597c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16F7E441-AA8C-11EE-8459-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410484785"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000033bced86111c8183981bb14bdb86bfe23ddba61c9d05203d7d7bae44d816fd2e000000000e80000000020000200000004c1dffae5c059e810304d5a0fc5feb7807dfb80a7b9d04eec3170dcc4be4e109200000006c86fcba0cd632e6b316eca042be6e898e9f7fd9ea4573c1fe9f11646a91c180400000009a730ac00bbe32615220a14481cb286fe50456d66c92d14eb678486b5015aabaf41ff89364d0dfe53b8fbb3cd98c13385c78d39faaec8538f951412ad2029e5a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0be38f1983eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3068	2928	iexplore.exe	28
PID 2928 wrote to memory of 3068	2928	iexplore.exe	28
PID 2928 wrote to memory of 3068	2928	iexplore.exe	28
PID 2928 wrote to memory of 3068	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b3cb07614dafb1ff4f8b7d1c9cdbf5b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2d7091ba4723d1912304f844b5a07e8a

SHA1
18382727ec1403742b18d525728da97c8513856f

SHA256
5e8df371c196382d45a9d358dc09c17fd7e3c2c3186cacb923eada18cf38eac4

SHA512
32ab8a43444f7f8b1668eac7aa7f2754fdf80892697820dac2b68dcf6e979acd9dc2b6045b353d9498336c37e465e3da657f0df4a261ce92051ff7aea8e70de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d8f005c2acccbcb80d3ab351507ba55

SHA1
47d3b03ac648dc6a7df7b975765a2dc920eb7351

SHA256
2b271f3a3ee13eaa4d450abc4c9bbbf632bbec5261bec1465db97b40a3ce28fc

SHA512
6e53baac618018c24f94bcb9d053c79a7b02ceb1b5ec5b15509485efdd8d47f66e6df454d48b21b5c4aaef1c79f7df05cbe2f150a339233c8943358513c381a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8ba7a50808cf445daba855df06c2473

SHA1
d8fb0866952be7492b41b9b8a6f2e1c2d6bc6a23

SHA256
83377eaaf0eb7c861e15c6e44c4b68197175d67c34a9eadc51fb622f29843eb8

SHA512
270740465545f913783d65c5dd65e6c3c853582c935a3ce46abd764ced02d49c42d2711614cfd3e72dda6093468e4139bc0ad93d8a04f4b02f3f5deb5c75b9fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de03f578b5435d61981aeb7e308808df

SHA1
fa49f61574563ff7194b83c25f653b7e7dbf4c35

SHA256
b673269ffaaae4ef7ed2dca2205467eb46b9bec2031a7fec8b89c95e8421c5be

SHA512
b11919affa8d70e8433a337e6f1a0c478e0189659d82b82d8960125133928dd10764fd36a78727d01a50160897bc8f29557aa0dc33b09d31829cafb52559f0a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986adc00505b411bc4c7a883dd72f09d

SHA1
c12d9b2c05b07a2edb754427aa934f452788c12b

SHA256
2506b86913f98f289d301b31284c277f2e7e98aa6e20d710451621b752cd1784

SHA512
c32d27b0297be3867ab9c5a342c53655b5a47818af56224ac3df494050b2c69b4bc48073966ede32c7e9e226d80897646d3dbb840adc229283173c6f9be5eab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79becd9977a9ffaceb83b60d481f6fc5

SHA1
5f38af9b6205d7aca238d4182e752ba94181ae2a

SHA256
fac369df8e921d5ff8370d2414ddb3be21959546788e9a6ad4d13759afc209c1

SHA512
ba48c55a60e9056f4a98f7e7d631f4756949371ce9cb0187478370f526f6a2574f7964e401a76680a38c6b4e1127de64f115ed35392ab52829bfdfbf4d8986d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
060dd8bc88fa11b17a2ef765e074ad9a

SHA1
9ec60ada36d6b71760c74a738e135a15f9904696

SHA256
8acc411f9f45415a60354756787cf5af2ba1b19af2804bf506dbff78235ae324

SHA512
db1a95e1b62edcec28652113efceb2f82e08292ccb8184d0aa6fa01b6aaca1893a347df0dd2749cf1eeddbf66840e26108770146a60702a90245efbbe1a6a171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fda050a4361c889b8965cd3be9e3b816

SHA1
e0b475d75d69163113df53170be7128616ca9e22

SHA256
3ef3edc5234156d3c49864f1a7127e5312bcfed785ffa490fae7004f9e99f6d4

SHA512
8b9da2f83694e0dd2f1b66d2ee4829e263e98fbad48c4fc3cfca8a6c103a17cb9d91908e5d96cabe078e037e3c48975f918988001d48a2c6f839f31b4582df3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f424c452827990ddacd5aff7be59db94

SHA1
4037bbd07650106994c17fabb38939a007e86403

SHA256
7c211e4fe8009aff1cc82607747dc32fd5026f1f4a78f063a9b131934eb256c4

SHA512
e167e7d1c471c308c9357f8ada2d49d161723c7eb89927589c054d8b459af4c7587a75eacab968a7ceec8c23336f31af539da0b57b6a757e8ed2e1bde753f8ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06f41e1fb49d4986308e9fde6c0e6c68

SHA1
e7c17e9c5f597bfd196878487a926bae56823924

SHA256
23ddbd9dda8bf3180c69500c5191dfeae9f32d1d869f07e9968f7907261d8197

SHA512
a265b4e6a92903f61a843f1f875a28b862f0291de97fcae4aa9a00fc8f2a96487a1c22ab1e6911ccc6af8cb7aeefc7c80c1e05a4ac94e08a49acf68883d63d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
cfd36fd9e85cd6adf32999d1f8798e81

SHA1
1d632203710570ca32fa94406ed0fbc6cb89a2c2

SHA256
bb9d35518b4404335683bf542c14b24e004d4ec21c15d9e913bdd6c23323e832

SHA512
98bc286a39b9710c87ed73466a3f9e2d89e49beba1d11090705d6775f58b3cf4c2d5555c61a8b00bd4d92faede0d2d314f836d600db93875104f0e3049070aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit