69d4deb1ff6d2d4fae9f257167c2d053a00be2a15c76db94c39b5446ab014792

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b9f24fe07c4aad515ea243592057f8.html
Size

40KB
MD5

24b9f24fe07c4aad515ea243592057f8
SHA1

62feebab2315866f6c9667fb015d88437481973b
SHA256

69d4deb1ff6d2d4fae9f257167c2d053a00be2a15c76db94c39b5446ab014792
SHA512

7ca855028b8a7f400bcd21c99252947f126c6ed65270140bfe2417ccadcd1bc0456ffc07c97ace8eed556aa9048e6ad756133a41e217af4b49179af0572c7008
SSDEEP

768:m8OE45s5Md5zqFdt6g5x6fqpdTfRF1m+peQik5BfvFB15wsJRvYO:mpE4aSdhEnFneoZfRF1m+peQikXfvFBD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0afabda963fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410593844"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{029CFF41-AB8A-11EE-8CD0-DECE4B73D784} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000075422512401f4b46d279555e2001126cfcda3ec1e5e912c265915ff0464086f0000000000e8000000002000020000000c410a515f02dc77a1d266a69108744d8ad2dbaf35d958a23713bdfe024189a69900000004c81b0243a7d99f156b81eed8692653ca1ee127e67883cb2390efec7152efc3ae62196e1e05127c06cd6520885098d89a55a671c91532c24b237d8fce11f51732f0a20786aa6c55c7c52999c240ebacf92fdfc02ad562247c98129825510b5c5f4d22d79c5a19c14d0fda08664fef566dbbe51347a15ca68cb7e398f7b8d5ab8507ce3313cdd346b08bba8e8414e896a400000003e933c95c2c946566e365e62d5ac520517d37ae51256cb00191e7cfb47c33f7b7a8c20a8b7f349fe14f252011c2374e36c0a14605aa836ba517e2b67b84b02a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e33f37359043414a313193bb37a0a6f33f50de7ec280bc8543b722fda2dd842a000000000e8000000002000020000000410a2e98e014e4787ed74c6379de546dd754c62dd9d3c890c73dfb28531ca1cd200000007454bf1b06dca307066f06b17b4441c2e5ca36b0815d328034dfddfc1ddc36e0400000000d8fe75d6541531aeabac93f228dd1ec893fcd781d19a6f4e93370fa62b1a20afb1fcba280f8185c4d995d621a6eddbacfd15af231a1c5209ca924ebcdba3382	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2624	iexplore.exe
2624	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2648	2624	iexplore.exe	28
PID 2624 wrote to memory of 2648	2624	iexplore.exe	28
PID 2624 wrote to memory of 2648	2624	iexplore.exe	28
PID 2624 wrote to memory of 2648	2624	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24b9f24fe07c4aad515ea243592057f8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594e1c08a0901eed5b002451e2adf286

SHA1
56a210b75759ece41cb272aa0e54207a3905a47d

SHA256
3fa54593d535f45b9c153c647d5006b96d4a883ce9627b144de1e1d7f70c736e

SHA512
4e44acfe1d46b0d000a64055cd6366e557f2e0ffdd8d1c8412dc4f35bc37d6702843eb1df66b4764b30ff7f1d75aaa62a260d4ddfe469fe25b4ca7f8f0990c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188012e28cf5da623a3a201d06107287

SHA1
74dc82d724b730c41651fe5ecaa1acfc751152a7

SHA256
6a089189075455522d7d41085eb40f56ebf0384712d39f19659427189d339738

SHA512
3dceead418f04a5d8b698113f751faddc8a819c07022994a246d722ef2316b3e4243bc2544b82d52b4be82001c9bed6e9001253291ea85faf4f75c053fe47663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eb6f92afaf1ff6e16c40007378656e2

SHA1
60814195348371bc96be27d99d15fb57bde08f2d

SHA256
117b863348f1fb65dbae8fa4010b029ab889864806978405b5ae5ca8b3f114ab

SHA512
6a9ebe1c9472dbb6836c60bef7d2f248933c26a6d2db83e44707312225ba7fdc1bc91471db4e54072930996289f853b5e05e4feca025854442c3eb067d54cbe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
521e9470f5869b3b6d3ce6a5ac2f859d

SHA1
bcc3cc67f4f7ef9dd72fb47d81aebcdb13dfb2dd

SHA256
426d6b4cfe09ea15bf09cd680dddcc36f1bc7a4ec45a0d3a594dcda995081acd

SHA512
5cf65bbf8029976d0a24d5cffcb6668eb3906cc1225a96d18fd5c1b7537663a1122644931dff108d7b9880e943747689321e00e4c118c5a7489f442184967c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9de48378e629afddbc9d3f7db90e4851

SHA1
91ccc35c9424d442840a5999a8c1f17c5d7c3fa4

SHA256
595d42229c3eb2ae047252b7cf64a8a89ec0cf0dc4baa481c49292408e729338

SHA512
8ed15d47869adbd578df1c9a7cf7c50601772d1814ea6a45df69d37f9ced7910ba51d2fb70f7d092f3dfedc055fa336e21c4017841df09957cf64ea9a24678cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
463665343de49ba41ec3aacca5e9a4ee

SHA1
4310fd307c38f147830a7c0c37ff14243a859fd5

SHA256
ff8cb646b5c6ce7318c800d64495c64977b9ab1ca2f4e3ed40cf5654fd74b1ce

SHA512
8084894e68b5b4d4c0bcdf69237d8bd8b3769171c34db7a4a0c33399c65c32f4e8628742b179a51d657970e67e1910ed9a77630265c038a511562f4038e3fe8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9ff76bae7ccdebb6586d61fa0aea42e

SHA1
ee30cca3b973081fa51ea2eb60d75c1af8caaffd

SHA256
bd2a41511c2527458217abb11e86482076f64065b363815aa14fd349f1ed842f

SHA512
f042e30b0a5f20bbdffc5b05259780ed34bfff42bd4d1eaec2ff3cf0d4593201a2a35e357b056812498d2b58eb215c7a3b47f4ce58a821fc265f0583dd7fd332

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dba08386ad430776865ae9d3f5dc043

SHA1
c0e337f4422de3457f731ea1e4dc726d4651263c

SHA256
a301dc9a34ad637eebea7689e6cdaa8fd2f69d529e5737939a1191aeb1bae9c5

SHA512
6d3f466c25fbecd0046e1e44c3d01f852e204c4a0ff0702ace233d29e4ca1e86415084e627261bb0eeaa740c1e25982ed4412cdfe016a547f1ee04f74cfa4a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf6772d8535c44d25dbc2625389dc178

SHA1
8f0f9cd56c27f095f4abb4457ff1b436f8d19f4c

SHA256
e7320abcb72b97615340d95b2adf966599d79c6dfdf85b4e199c1ea0618cf14a

SHA512
69a2e9686220e14d8840f52c59c1dbc2a0517e30ef207ab97c8057df64135d43291f041ce4e927667cfbff78846eed4434822c29bab6c641c521cd9796ede25a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f6d2f74e2b764128e1bc6ca0d3ce34a

SHA1
0782c33d6105b50928623deb1fab175215c123a2

SHA256
199a0d81d080148062cca731f9cd3759e42ab601270a3ea143f56b2eef0e3328

SHA512
abc90487692a78666d423479853dca340aeda7fcdeba9654e6bba3878db995cafa302b22056e106ebc14236ce0dc7be92cc77abbb74c6e5ef118ec2ca0a76f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7fdd7860061f054c5255343d569d301

SHA1
1b4691e1c84f6014706d4904ba262c7fe257dc34

SHA256
e13fcaf3d5024ed3418f41a131d159587c5225a259fc878d8317e1d861a4e8c1

SHA512
77e5cac51d43c107e34040fb1039665c163adab347124969a5274ae04f2c870778d4f12c855de1b6716c156e9be7737fee5b77ecf859185a87c7da3cb88675f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53c7e8fab77228e15a429cafb01ccb37

SHA1
91c6a0c9753e2d6e7c624eb6884a9ed641a848df

SHA256
8f794ba066c8bee00c8294ca993b56d37c62eafec34fbc81f12cbcbded5427e1

SHA512
f724ac74402d3b7eb6b4924598ee128a28197d8fc1364828a8b55a5c8971073e261050bafbc3f9ec6322c80f7e065cddd75aebfe5279da3508d691625493ad82

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB5F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC8B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit