74f221178d74570059e9529df976c4ee9c747ccbc5e0ea6f4e72d19d8abdb8d6

Analysis

max time kernel
176s
max time network
183s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21fcafa75a44e9f63d5c89b5a3b455c5.html
Size

1KB
MD5

21fcafa75a44e9f63d5c89b5a3b455c5
SHA1

0a275b3d3979071eda414305bb4273d4d389ee8f
SHA256

74f221178d74570059e9529df976c4ee9c747ccbc5e0ea6f4e72d19d8abdb8d6
SHA512

6c8776d2bd5a21f569f46f80b8576a02b1f6d07bd8580d772f5b16052f9d29eaeeb64788bd3c4da3522c387b0fef1a04173d41d47fe6aa91404c4474a40aa24e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d0240ad03cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000bbfcc56029627fc93d45e2b5f8f567a64d2683f0a793ce4d4cc7cad31f0ac106000000000e8000000002000020000000fd3a04838d421a2637fb1b942d3f22942ed1712ef8acc65dc315c9a38bfb71fd20000000f07db2cf850524a91249dec28daaa80d91bdb778466b3c9c6384566a5d0826d240000000cee95b1d949b0c46cc911f1365a72000cbfec0d54fa049217c536445177ade2d312169cb3e484f7ffd0b071da0ec991a16268d82dfa84ca5a098978d20e8bb40	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32613AD1-A8C3-11EE-9BD1-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000bbf528c9e20c8fb389f518ca082651809a40dde985bc020f99dc04138e72eeb3000000000e80000000020000200000009885b37bd9b47141d019929a208b7f95b35bda43afa0a260f7271e68f2500a2c900000000c31ce972f69350cb514852deec71d2dbe81ed2d0383d80fe51ad8981ecc8f5887056e6e2d1436398a187168df272fbdf42089cdbb37054dd52a2ee9cdb0784f522360dcbdc68cb831a5b599e8debf463c411bf2e783bc67a9d296089dde474a444f6e63d72963cd79d4f74f2905c3b5c9e2f6cc30876f026c0a9fbc65d0ce3f7ee1cddd3d7d7d8e4d00fb6666e75729400000005a29c206251303ea22c6b37efbfe93bbec32d51ae09035124d08d6eadd5c249fa4f898db5a4ce70f9b4e5d5ee0857956ddf69048ad8363e651094ef12e77551c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410288569"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2624	2868	iexplore.exe	28
PID 2868 wrote to memory of 2624	2868	iexplore.exe	28
PID 2868 wrote to memory of 2624	2868	iexplore.exe	28
PID 2868 wrote to memory of 2624	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21fcafa75a44e9f63d5c89b5a3b455c5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f615b6149d47ba2ce176e041a646d6fe

SHA1
1eac80533cb026e0a0d043550d5b768c23768670

SHA256
bd03448a0620a36e0d9cd86c05fb0fd38cda0e5d6b3da6e4d2b09dda408b5035

SHA512
870a951173addf78a009955f6afce596fbcee9eccb7545607a41461fb06e4e7b7832d299a7de0b08192bd58a6f714eec05a60711c5634fe4475673958ce7b949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37c5501d750625d901821ddc49f41e04

SHA1
7f78a20054051b20b35e28214622612538f23bbd

SHA256
5470399807901fe94acfdb63f54fe492fffd54e0ca84e5de3f29e589a561593d

SHA512
bb5b90ddfc188ea371c32ef5342b95e7ea6303934a9e791a7bd4ee0d31630efb07b79da6b8ddc4b6423c8a7f934a46ff2fc83c2dd9f1b91a0140c6c0a283ee8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e81035433ffa36acb60daa057e008d6e

SHA1
2a0b6fa3fed7eb6f2152408bf2c1629a2e74a819

SHA256
05f60bf4d2ddf7b01b718031fdc6c9881f72df0533a736de55a988dfb952b641

SHA512
8416268eaf3b1187227b596d08e03400a56e4091e93593ba3a7780ba49b559a3a2c865f8bfec198955b8945cd95d0031934351a1a8549b674b1f6c436a833cc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6634ae6a1541aa9e9b5855d3726e8dd2

SHA1
4459aae19482ad938a134d721db02e4611b44189

SHA256
9731c10f2e5d1751b2f0117f87ad27c206ac68b5b68e0ea408f3ef681dff02c8

SHA512
cc82a9156d12ac8c4a8d606ffc695868070cd76570e9e8c79fb896d65d4a3e298fda67bd0d14d6d9a468c08cd24af7fc39881fb4595280f8d2d18fb1c34593d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a23f2ec1b2454f5b0b63f56847b04313

SHA1
47b5f6c6ff411fdcb30cb9740b13890d5e849921

SHA256
d26e93c794a164540d939edac3744964cd961a15bbee64778db2887b1f12ee2d

SHA512
f1116cdfb86de27d0bed08099bdd72b1c08ec858b1c5914ee067eb06f2ce2f1439fac272a0ed16249d84ae0523cfebeec6102bd32ea88a6a4fd00b5c216c40c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db5ebd43f46bb18502dbf526c34bb762

SHA1
9f17974bca3fee2a21d2e63e0d1d7dc8c798b014

SHA256
63f4ff500889436f76da6bc0e3dafa56be3c8f737c9e30874a4f9403f80e3f84

SHA512
c15e1e8d49e996f87f337dba06e36ce106af925f5ae4efc843d5aad9dc0daa104350ea4e88412fd56efd221827e29c96db2d8da46a3acfd1ec82ba1dc065b5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bf9685be331570bb6a71c319bd08598

SHA1
de408d40979fddd098c0550c861fec9bad982c4a

SHA256
66e75511dc761c949f7c59a7e02cb64856f4dfd14189fce6563b5ef2f9ff776f

SHA512
5cb02055c769e546c9f83bac29f206bea4f991a5d575beee5c92e181e2698e4287418cec3fb15097cd756f9bb336320a0c88ebce401af4520c70959a9a41e457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30bc18605dce5bc12f4e9ea41ccaa7c5

SHA1
588084f2ecf8bd6eeec06f2b957d55cc29760f2d

SHA256
2f2110aa58d6f723f76a841dfc1e6a9decc6f49a2af59a70da3d1dc1ba006d7c

SHA512
2b1987be11269a05c8ee2c001d37779e73b82f072fb0373470166e737a2dc1df119f9f0773d809f4858f360299fe688f7261d7e27d7723f618b132cc23269004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46ff1415671e2f9e107096599a81ecf2

SHA1
c2ab358719a011a89bb8aef10d3821d3c881dfc5

SHA256
d848f049438ec38144765b45ae2ff5a533751df8b08d536413ed89fc5664cdeb

SHA512
13ca602ed8e2acc28e1b55df2a484c38941a8002ae7bcb9d13af7fc408a7a773bf2363bb745f43b74cab0eef9a75c517a5f597ce741530155a7b35ef9d47b821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ec13089f2b6ba797f5ddb2515af303

SHA1
7b264891e27bad020f4642793588473543620ef2

SHA256
11812798420b808cf77d1f907a59bb76ecea917ce95f1bd366e3bb180ccd989a

SHA512
2fdbb7130fde64868663aa0e0cb7d561352b504f2f561913101194ad588282573aa74a717a64d102dd9e6ce79e621d9db9875bd6e37e5d2ee23148d0519d8a1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
819c8857f7b1f5b5a2df1702c4b31392

SHA1
284f029bc6e067e77e3874bb04c47cde59c4abee

SHA256
dca55d17eb2e9aa8a4d52fe88d10337d3b23db6d2cd7ddac12785418af6e1b77

SHA512
d40121f354b66173a10dde821ca1b174b00d7129becfac38244cca0efe97ddf05baf9d7e80499d3d4dec6b5dbfaee8eb28cc2dba758d11f6aabc268f2545e1ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
899b2034b7282e4d29ddd650c63ecfb5

SHA1
7fecc536bb155e2d6763e726adf29434ac0740f3

SHA256
1d4f422a69a08bf1b659a1f1c63f9c53cb97b278c7bc7039add3434065a20d5f

SHA512
0947efb529f57b890f53aa7cad07d7c05f58e51b06b3bbc6f5c1ba32d014eb06386a5040db5cf1f24da5fd39b5e254cdb8ac8e8021e54b73bddfa564d4e47594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef965ece1fe4a7f0dc92c6fc69d96b67

SHA1
a7a55087f94978b58e3d61a0874c21b1c551a98e

SHA256
25820d5fe7195524b17b6447471927dcf6c11fc9f9b409a6ced12a047b4364ff

SHA512
a74c7dbdc86ed63b884374354493ea91f4b17d107320742fad6d70e59e5837480b62678dfa8e649814bda9ac7f61d39485b8e4c180bc140c684a8fe7521d1b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188bf7487bb39d36c89aacac1319b9c5

SHA1
1cd613d139dfce823409b6af54ef320a0c14820e

SHA256
b15f0c1bb2cd3bb2b6150929913b9e3491eb95ddbb34e80353674ab4e7375ac7

SHA512
e4c527b5e6b99836856bee63f6d10d9132f15bf0044a91a8a3825bce81064edd44421caab65481ed1ad70aab042e8b8ad82140a304c7384b1dcf7274591a465d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0756ea24b7c60c7fc033aafc0367b8cc

SHA1
c1a2f7a4055f7fad7830b86b88585e334bc37963

SHA256
43bfccc5b2e01a329e25d6439d4d2b1627c167750d245f60882c223166c9de64

SHA512
2bb08ef4bcd573757690de0046ef5018c938ec282366c0dae80360fd23e75d900e404bcb505dc631d8e9746514033b91ded28660c6c52a1e56df95d552106dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627d2c7319b8a0b14519140d66e65ee5

SHA1
6c4df67fbb84f53f3ad40d96631fd302e522e0ef

SHA256
e822bf63ceb02617f3bd8de9b6ebaaa49efeaa67d78dc1681370b228fdb944e8

SHA512
28a4c76899d0a11fbb9d0fecd9e3bd10230d0290c4d473eb292e32c8754f9ed5f168efc82476e9c00c5937ef4a238a36525385804326cc6b393f22883e3c3219

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD839.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD79.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit