fd12ac640bc93980dbd073051141b26ab370024a4667436aa24a06d798e79e4d

Analysis

max time kernel
137s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2110dec5e4cca8593deb5ca404e62b40.html
Size

96KB
MD5

2110dec5e4cca8593deb5ca404e62b40
SHA1

be55c91059c2e133d50804d8ac126d986fe39412
SHA256

fd12ac640bc93980dbd073051141b26ab370024a4667436aa24a06d798e79e4d
SHA512

0a7becf305c010ffcd54d578fa19925efbeafb261ec8cfb26e09780f6af129cfa58fb3b4253adf86c3f308840a561bb3559c19e426ac03fdb4775dc16f8047ac
SSDEEP

3072:SupEN+5EWeituGzXbHFKyMpagoB4H7xZkecqGAU9AXIKskmkyS+N:1pEhWeith

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9843B81-A8AF-11EE-9201-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d676d3bc3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c3d512e88b874b673c76b0e2f82f86fe711e454d24f8d163d0d2cb1245891ef5000000000e80000000020000200000008aa3da461c58974650ed8cb1d6d33d32b951cee6be3b6d100e0f85e19312680a20000000a10407a8fd10a00b95207f03e5f02712a461a1fc19dede3d5e5c9f965eb91c5f400000003ef5618c5b4f94479bece55381d77d2f89b007a4613c4a4fb52f2430ec8ada34f6396522a13e2d0181ba0325fcadf606dac139438da5e4c3f3f4d50919174b26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002f3f3a67d1977fabc7c392b3598ce336c13e65cfcf19d9d9618d5ab9d8f90d3d000000000e800000000200002000000048e036bfc4af839e6a030daac4f72a30c9e6599fdaa2eb7c716dfb85d189f38190000000a81211c7d4aed01227886133cc67b608992a50c41cb8ca49e6d7b35214fb01e4b32d2e0a08389afa84981282b05539692260ed96ee45a6d7aefc8ac2e7ad65b9692d2c9913a189e516bf73afa5e152133fa164ada76004aa678a771f486d6c68732afd47aae676316cf817673b4d04b5722b9298d2d7d4f02d33923686b021fe2b95b29c98e87e15710b8ad34ef98caa40000000d47b51c2e55256717e04f0bac6b895cd1fddb3502871ff7b0ad45eca0305b88b42ca414ee3e64d1a54f4c6a3629fa449f4003bf581448ef902d03e46a0d96e8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410280296"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2728	2024	iexplore.exe	28
PID 2024 wrote to memory of 2728	2024	iexplore.exe	28
PID 2024 wrote to memory of 2728	2024	iexplore.exe	28
PID 2024 wrote to memory of 2728	2024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2110dec5e4cca8593deb5ca404e62b40.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33

Filesize
472B

MD5
3d0d34d7f157900f31e08a8d9227b391

SHA1
4ba1aa027c754e385bfd537ff87ac25ff8ae74aa

SHA256
cd6a46788c77159ba2519f2aa4d3d39e83f6f6a4a3bc62014249c0ab5a316aaa

SHA512
54c3be67fdea3cce963d8ea96c47070e7dea75bda20ec9d2e3e52930998176e1a2be576abc704ebed43d558bfc8e4a027949eddfd4ea65e4b8d979c8b70a320a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d356ec94ca6ca28141a1ac5820be1995

SHA1
24e9aa68ffb7924904e28e27c5895c30d32be6c2

SHA256
b336a9a73c4cc2021046aa2a34413b7db61feff1fa1d5960fcaea81d91fdae41

SHA512
f60737f9ea6dc6c144f1979e81df32d461eb513110692de33b68bf397488eee0d95d1493d27bc746c054c90ea3a649eed470283d746f8ddcdf7f63b4e6e972ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
240cb254c0059f1b78572daf28c9287f

SHA1
13408d93ab9abbcd7373c57b6bac0daf9fac9a7b

SHA256
2ffb03db7858caccecfe454d194792900045a97ccc3d879ee1da0947ee960b19

SHA512
45b3ec29f6f66e64b82f75cca2f09366ad3f134ee79b58210b2899a9dd730c6075baa2c3243cf4c4e80dd3ab3890d4e29cc0aeb3c775f77dc8a14a893e3e3742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c8c0b47b5d5dff76b5f4d7799443e40

SHA1
5250250b22ca353da8973955eacdc1afef72a148

SHA256
1fe0cbdde190e38c8baab1e7a830ecd4702995de05a3c9abb95ed5bc34283635

SHA512
40144a5c8820df68c6126cab9cddca15f91d956e01d49a3e15f8fbd9a1cd935c4d570a176c63b78939c6afbbe5282547887527d2faecc238b008c56b825b189e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3439e8c37fbab0e3fc0cb710835a749

SHA1
5efe266cf548fcf8dfbdc3a1d05b29a4f01a5a96

SHA256
e2b38a5de77826d33ae48ed08881d01e5fb93903194b92349284bfaee1fb311d

SHA512
cbe930bbca2b52b01ecba4108e6c68705d36911ee62113c058218ed995c8710053a92f86ae24331d4f1a5e64654ebf7ad9f24e7ff3e105766293a45a127a29e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0bcaa46afca30e42003d87047e9e91d

SHA1
f51da5b57a8b97fbbea0ac80c02782a6e537c925

SHA256
27b449b02a3afdfb2ae86913f794d484381cf9fa07d0c74d826c3703e26390c6

SHA512
d6868a8b0843f226599c320d7418932d3c3b5dd659d7ec94a591184fa234736098bf81b6b8da16c44cf6a98a4ee4dde1647c72b84d5923b2aee0cd6cb4289abf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d776afd2fdc8fd26916a3543f4046a36

SHA1
5ae435d388d4c7f4fea969c8b87d6877d2188410

SHA256
13d7c7730f506b0ea346f1d6c960d424213e7630344af1e1dc0e92318e08b14c

SHA512
4dd74528b274c37b3b69335289e0937c14221a94be745afb5e1a2b3df907cc710c19aec84debc39c8a2fb44ccd39af05fcf48f8e472d84215bb44ebb85ed7fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb858fe4977eb971fcc8239c63598049

SHA1
ae0609b862efda36e6b560709803a9bfbeb30b0c

SHA256
a10984c1a53629474205a60874cbf98f89fba91a037d9c72dda5e9611fc6313c

SHA512
9ff2789b52403fd15e6c0ce47464c7508c69f3b6d6f6faa8fd331678c6c84a57f6a13ffe718dc741e3557ef4e36a4f804efbec590bcc459b89bae29441bb7b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5acb347a2bb7731f2d8cd0b29f1b4bfa

SHA1
0cf9f23c6b47912fe039bbd067eac7140c4d9b30

SHA256
19ce36af0bf98c5d6e02172adaf3bd0bea48f00f37692de1325d80682ceb6c63

SHA512
238b65c4c4cb446f4a58c25108ea610d5536319a3db31b033b8e21e53a5d9d7b987883110078572fcf34e5b289da4c9c937cf5758793f8430de9cc6fb75fb5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c30b0c23c58ee160305ff9636c25608

SHA1
1c90b5fdf953db42ee468f4f9b79d15d1dd748e5

SHA256
7f5f0e20ff67e5347559ff6cb485c481faa11eb562cb8487db48a0473a012d19

SHA512
3806dd2c57b7c289d571b176a18cd7e3113949ace5a7f7d837df1f88bf9a9cc6b54c9c060c4f7042022ecd128e1d461d94d6ac02a55801d574de7ba9ddda53e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9409d26d22d131a142c13d019f043e87

SHA1
19c3d1954b7fbff4589e869b82b1a626f57d7571

SHA256
4050a4d33c7c85534082c8ea5104dd5036c3b8b4f44eff72cfa2ddc14b4ad4ae

SHA512
44610ad8b678aa479ba0ec46e7933544da8939b0befb98da2cd3c2e6fe90c8cd781f61022f05bc8c9d162aed489cb92f084cdba2a6f9632861ed549f1584d5d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d5d6d15b79c4a0272474e82140f363a

SHA1
66e79266adeaa7c8eb1372e43b6df58605a019ae

SHA256
7b3c0219743320acb96b3e17c2611300810c40d74b0dc95e90b24393fbf5315a

SHA512
90ac409b61e953998004e05d23e859b1a2c6f616b2734641821efaffa6b032abc0d865bcfa847608d98b74917f80c74a685699920cca3806f7e82645e2c35d1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e7dafd4a3c709c6ba5ea52ed0af607c

SHA1
511bfd303a63cddd6d6fd4051d26941ac0e75e18

SHA256
6eb44b3fc2cc75f37b1cef72a734f8dca0184fed5eedeafa39bd2d0aa74ef73f

SHA512
4b8ce89e05f1c8886c9de077e130995dbe7acda77224ef7db4399d732cfce77ca88da4988d6eecbc47dbc835a8a342844ddf6fca427486faedab8806360b0bf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7095d6d74ddab5503881bd0d188551

SHA1
6cddff14f9a5c7f91036fe79c0bd76f2459bda08

SHA256
ed124154c102e84143fb76dd375aad19250831a5b1cfe78105bd7ed537d0a8ef

SHA512
18c2c53aab8a21c15d8e2bfd9c9c3bf560d179fe06239af01854e6286eb3fbd92ece69551ff957a643c87f06014b4a459dc3a694057f0e6102996d2ef18924ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b78363d79f11f2ee96cde3fc5ad2b80

SHA1
f7ddef2130f9d77d93ec8605f639352ab5a517ba

SHA256
9db83175b081eabf1a8f6258d39cf3fc1dba9de65220ba9574fb3a1925916f69

SHA512
cc29dd07cdda1ef54d97aa0b26276c5d7f5c9a5d96bd815a028cc2933d68d897fd311c2c43e9661079a35a9d66ac2a3cb97b0c3519d8495229d60e4ce5128bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B2C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BEB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit