6035c8f949c4ff9fb103ccddb7bcf4166b6d933253bf1834c8b71ba4c5e76cde

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c39e836b3f4ab3ee810b262d2c05687.html
Size

7KB
MD5

1c39e836b3f4ab3ee810b262d2c05687
SHA1

c68fe1eaf42427e61ff60160f2cb1619cee04632
SHA256

6035c8f949c4ff9fb103ccddb7bcf4166b6d933253bf1834c8b71ba4c5e76cde
SHA512

49fc3c6b571d8576c9071b0e5111e215e9d2c64963b2e6df7a2dea02830e755dcef4b938ba904393b8122e6a5a26a1dee9a97c9f83cabe1749f67a2dc29b9629
SSDEEP

192:TT/a6OPqgHYSKutor/RDAV2/ELrMJKNtzrpccrMSKutor/REslELrMJKNtzroZS3:HMq0fFCrJDAV2/er02FrpccrTFCrJEs8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05D23071-AACE-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000eb907e922ec3061fb8a367f6e9fc6cce57f5cd7e41fd5fb92c89ccc2c0a64dce000000000e800000000200002000000086fd9eb45d018336290adecd9d455afbbd28d0a479a416ee48b50c721bb0814f20000000b33522dd142d6df5a6645a52f12bafacd0b74ffccd165f0ef14c2129bc26e5b440000000c675000f61cd07fff2ad1f5a62a580763553485faff30bc58d70cfbb282ff102958ba97a6ccbaf12e9cec91b667daa2449924af4e8b3b9a7c406d218528350e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000cde68d3bd8de2cba95bc370c4150cab3ad8b5231d8a63059c74ae3aad320896a000000000e80000000020000200000004d402f9252652c386db45ab57cd727268d71a1b1afefdd0ad32630757d43c5a590000000abe1e3d52d7d1d42585dd2c15bf7f3937085db597196e7dc0cfe5d7915dcec88dde2f03b215134df4f6496411a03ca4c4f65e49b93663ad03f50bfe3d09846a5f4e2ac6b012579dbbb00b26305c77ce35314af87522037ca4945a191490889e1171a3d01101c8618ac9d0d9b8e13f2f771d1b1df79247b18f2899b52f490ca5244d4904d833fa7fb701aed6c93d2fa8f4000000072e9f15b9e8ac880b97aeb9a93110cdf9aacf5f3c4320286035fbfa12a2c97b33d137c1f00cc2ae1c586d8f680ee254f2d07e20e0230f56a7f6b56ab4b0af854	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410513105"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f8badada3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2712	2976	iexplore.exe	28
PID 2976 wrote to memory of 2712	2976	iexplore.exe	28
PID 2976 wrote to memory of 2712	2976	iexplore.exe	28
PID 2976 wrote to memory of 2712	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c39e836b3f4ab3ee810b262d2c05687.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f2cae68934bde7143c9ace1c5381ae7

SHA1
b2d63c3e4e63a3e90205145e7b05249236d9adf8

SHA256
ecd6c64569893ae1523292b012736dbc7b39dee9d74dbb7d1a99965c59d4fed2

SHA512
ffdc03e046472537a8f4dd6886ce3e627249f2e9b38647c210a894178d71fca470d296130a0ac40764b1fa574aeda0b5fb553499e2a3d1e4e4f5f7e8bc80ef08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbfd3b88760c55db72dc34074d7aa832

SHA1
1df55010e8f9d3aa8280226d989ceb345b335f6e

SHA256
21ba609498a3dfe4a33a494e0aa25f237ce74dba5ef710de6e449f04eacc022c

SHA512
30bdcf2e2e3306bdb6cd8101b733332523b1de490ea40cd84c2906c38a9b3b0c9387d84dc0839c61e432c2aef191cb08d001fbc88ee928c3aaff8f4758655008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd70ee018df86ed017344e8593747514

SHA1
2435e8322d6159106e0ac2e7a6db097331975727

SHA256
aeac72bc6573e1ae5346656d3b2fe371316a0456522a545c0c779531e607b9c6

SHA512
5811a5bd9376569b3b99d96e10a9394d7355bcfd515a8db3d7ab11afd0059d1bf71f49dde275ffcb74e1efe80ff5075e73f828183627562b768952d4d5f2cf47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2645c4ec9297fec47d93962e2e72af4a

SHA1
f48ff88e776462535e9268ea08800fc34090a593

SHA256
605b1df51f28b094b3bb741ff8063a71fe6553d4782975b7274dc994ec55cc15

SHA512
3904215795b92f224c08351820bc51c7e5a1eb01e3af55353b29690c4fefe4874a5387c4aaa765e9d9bfe18e6df956d944f96d505ae6691c213182e7d6255569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0973c41a85b41cc2ed3a2cd645720819

SHA1
98e621adef838c77a95ed5312950345ca8bc88e7

SHA256
6feb8862c84d6e1cc890cde10b269330542b06ae1665d031619c922bddb4813d

SHA512
ba9e3fd97a9b330a3848560f2a6b031a80eb4e21db77a2fac342aa30f11ee3f12519439d805149db955c675addcd6a9a6928bae7f4a4d702596245faeb53258b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e476e6f67e416d29087aff2a377880

SHA1
5905573803a84394f37afc32eb2ff82553768da6

SHA256
d24dbbdfc4e30ff2c7178cb65ccf5d09d7a136fe4d500998efad07803a20dd50

SHA512
acbab6c3cfebd06c266fcefa6b77e9be6ae5d258e6e01d22d34b4ace0e8f5c4c4469129404f5ef1c1b2343acaa23d976a8baf14713d586a7cdf29486e0a74466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a5c67c1fc7d922d2aa20c782f7dc4f2

SHA1
fb2064631a1d72158855c50b52f5cc79775b7a3f

SHA256
ef972f735c00f5c15b87a850a94b9f8cd528c0d82665fe98c03b39f8913cc30e

SHA512
5b71b70aa725dfce8d5f0500a4eb4877a0191ae1475e924e6bfb602947296fea96ef8c44bcadfe8863d8402f4baa11cda6ddfa9f97faabd29f06e2ad340f1fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5ccb8469414b89d7303c199b14ea1e4

SHA1
a7002ea52a798b8a20dc7ae04fa200e85e5710bc

SHA256
9396d22ec750089a8de39b16003e2246027b309ae1fe29f5992d9a685046cdb3

SHA512
d18964db9f174a76a6b75f921ff1a9d32aa7dd459b253dfa4f30a2d94093b0fd6e2de21b853c1e2cefe29888f33b703a72035bff7d876a74c4812ff69167b9d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2953b43399760ae0e2e6eda6ea7de897

SHA1
ba33cf0b40605c550fcffedd69f15e586557b4c5

SHA256
b890a66862e4c0f24de28fe079ca73874d0a00752c0f7274a4fda2c3e5f28cfb

SHA512
338d06e38f5ddf61b650f67c885c46cfeb333f007cc5517482737e8a0e63f4d4a6de3015c14f92b5ba6ec922d898ca674212a1ec97e3b216ceaf1fb0cb99e64d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8fffc2faf39858aa4a4840cba7c09bf

SHA1
4397aac408ace976a484a11b233160525f92eced

SHA256
761205745f7492149556160850f1b1d227b6055b72158d6b31e857cbca7a821d

SHA512
43a388029fc2420101b65946f580d4388eea8889c6f0c7b05cae5539f6fb77ee4779ca8ad9fde8fd0b9c63731c15c153c2351ff877a8c9a5214c60d128ee900f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b8b4e486b090a856b4ca0eda85efb40

SHA1
0e2d977334b0e7af1476eb141875099229bdb994

SHA256
03d47ff228165907551f1fbec86143cb3a30c32ca7227a444e8efad84387a9af

SHA512
90eb1f9065eda2fc1fc07bb405d2bdfae27c00ae62229c9170c9dff60eb3f9d1a8f7976b28cf19761c60b2021f1ffdd8174dbccfa5f0fdc3012b10bad7f81ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef5ea640b97d08156fa29882e13aa667

SHA1
90f4d34ed052b4010212b22c292610e523a49c0f

SHA256
d85120bd300bda08a1e94e633d022f1e605e98861df582fc645fe0cc540088a3

SHA512
8fac89b9d200bb8832f64fc9fadca2ec368a5dd9b68d7d1abc42ee4a8fa0da0a1cb262ddf1713278f002b2b547ccbff0ae26799b8d32d1beec4088e5cdc253e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abe286370d640635c92ad6ffd356a993

SHA1
5ead3b5f2a915f62e4ff309c1d4997fdae75a288

SHA256
9254af95b73965f828ba008818a1f504ebccf9bfc99bdfb3f1ae514250252540

SHA512
80bb1f1919267214beb3fcf387f1552186405c065e75b70d689fbf505a9a533f112a6fd1a23d978cdb919220237f74518679ccf822eb68239e2677590545c89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b75321ed9387b1395838ed8029badec

SHA1
4f3aa1b2b9096bc6f7dfe05ba222d9f5b5de0d82

SHA256
13319d19dd1a056977905fd33559b4e2b55909d948b787b6fa65697993243751

SHA512
12cc68c8472592feaefd6b63c7aa8269771249b9655ec5364f6fd35408d10fda529d44d64a86a3ca44be41cb795a68c6a24a43b847babb7d0b201eee4172a441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e575ca6a070176c95854c63d0a0d6f0

SHA1
12f179619f0d623640dbf1c1a4578b839aae8d47

SHA256
24ed93e3e412ef4e43d859d7cbc4af9d73d3c62162cc8533c25d19fee4de3729

SHA512
8f5a6e97ddbad515a83f1ddaeb98792197d08f2fd0b84f9acba9a7f21592ee2e7a0043bfc0f1abe441d2543eade69ada3a35b0c4aac1773e6a9493d227554054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5b13e71f2f521dee7121779fefba7e3

SHA1
adcaa3cfc713bb9a62e450e6e827c9000d096174

SHA256
0e0cdbabd294d981a1c6a2aa014b81432e6d1d97220a4b74776075067695727f

SHA512
e1aed92bd6401073707aa7c2cc423c080d5e892e33fbde2ceb116487721a764853f96e7249f79b58fcc4b80a6a104e04733b04c6e95dec089c413b1b1125429b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab767A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7748.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit