94930e118945f8307f8f3f55ddd1bfe846e242d06c53467a8358ea820359f37a

Analysis

max time kernel
160s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24e32371ae1bd4d91d37f52a4b11f082.html
Size

121KB
MD5

24e32371ae1bd4d91d37f52a4b11f082
SHA1

03f68600a16ad5cd5dac96a1aab029f2b9d4e5ee
SHA256

94930e118945f8307f8f3f55ddd1bfe846e242d06c53467a8358ea820359f37a
SHA512

8cf0a16a6a431192ffc4577a48c9f0570bba58e99e051dd48d0a70bd9ee63fd8431419a1f22f7a0eaac3570d8f8b889447d5338e91aa53870d3fb540bcb7955b
SSDEEP

1536:Wu6Z2pTbw5dVRxuVm3w4yY4zYHnfy46XcLxg1fBR:iZWn0l1y9EPyT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410594918"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000005e27482a2f1a5e0ae16f61f0435f39b55a9ec7b8535ef6d502dcbc2fd7305429000000000e8000000002000020000000bc4708cef880ff1fb33b52e5b7cb30441030f4ed91783bc975120cec8b12ec8e9000000005a4594e7b32d0aab306fa7eb3eaf621ea72081bb67abe012afd716bbbb329fc0877b3868f710389f2fe245d7b79cb569d157ba4004996ca1489cb3d444469fbab4f5a9980b6b037fb449730625358b5d48505e2a0263131a32c7a5f8b6610fa0956bc622487dbbb4b233089d00dffa43f8e3c59e82125290374259932d34c864608f9e52453a4c2e787e7427638102140000000ec5fc620d1be55e25e96bd2fe39c4ad9d7553ad7392cf97040f881b579342b60dcdb376a4b6f28da1b5bec224f5b4de3318a8d499c2565cf7e64c44e673a203d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80DE1FE1-AB8C-11EE-B6E6-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d553700840b3a82ef68d95685325343dbacd32c1206ff16f7ed6f71dce72154b000000000e8000000002000020000000f324281cdf9c77eebfae5e5d314aa111ad9a0eea1773eb21e7bbf9ed37a9476b20000000599ee1ee79f5e8901de2445f34c525b5477715968c17d1cd7d69c39ce78018444000000045e88f42e279326e4e27eb74d129fe076ed96178efb25e15309e59257091fde16a01af371dea02e0da402ada2cc6739c827c98be47c2aadcf439c2a37d6a425e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0efc875993fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2684	2688	iexplore.exe	18
PID 2688 wrote to memory of 2684	2688	iexplore.exe	18
PID 2688 wrote to memory of 2684	2688	iexplore.exe	18
PID 2688 wrote to memory of 2684	2688	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24e32371ae1bd4d91d37f52a4b11f082.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1e6116df86dd844ac9a04dbb196102f

SHA1
72a52bb3f8f1a232207068042c398207d14e9211

SHA256
4bd4637a1f2a0b59bf9a1bd079743331087deaa96bf50bbf38ba989bc01627e2

SHA512
d913417f16ee3db8402d19bff739bba416be57c28271de9dffa2a0adc2579be90837a6b21eded4c998cf21f9a3dd6be0fd121447b84f790264cfe94c9ec2660b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f359a441c76365bd3b6cbc86f7835952

SHA1
3ab35fecf658838b6e1cb30d77fe40d2f0bf7fbc

SHA256
57b65f75de76665f201f38b6d3c42abc508550afbfb6510b8d891e318f89d2e5

SHA512
abff01af45ca8f020037e384dde290f01b0148c8177903e449699d291624c72279724a24073263698a7e96398f64557e06d74b6470a5a3e912f5eb4ccea63947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eafed7ef30af44263387a64423539507

SHA1
ad1db0040fe19c83fb785880c64caa6a15c25bdf

SHA256
4691a933932ffef2ca08690550161686637f46aed8ecb73f1bf7ebf1bf2f2b9e

SHA512
6b7084f415b778146cca61edcc68a49e1e6287fc2c362b5a7487ce7d8fa13af5b6782d403a7b881c39affb79b753af5a1f510c6ae2647c811a42b64766add98d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49583921a4959ba1113c4b628289c0a9

SHA1
957107acf881281cb7cbeb5f6d42fd3f9a3e56cd

SHA256
a74aa66098ba5fb993f7f80321ed1526249ed5f8866769375720976256f585a6

SHA512
1a0630239df1726cb1c08da292952d59451a3f660ea7447323892f599bfcbefbd088ca8f1d9531d1d734d8663a1a2ed1c99358d9697792092ac4185b7b5a5b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b65eb4e6cdb5518605d43d1ffb3e740

SHA1
3f64677c3089c19dc3a33829643bdb37b9d04a84

SHA256
29df3d7dcf2cda38dbb87cd4b5b2f9300dae66a09c139aebca1367a8c5e976cf

SHA512
2bd5e78636c9928338164d7f6380594201f403cde432d986622b906f2fd1fa8f52afe113eb0f45aa6dc92df3cca4679df56854ed95f9cbafb08ed5971147832e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de47eb7c5252e289b1ef8ec62eeb269c

SHA1
3c91ab74e2028a4d89b205878f59fd85be9f7fe6

SHA256
8edda6748d8f56b6db2b7ab4e4239830902612527f03b2adbe32122c4a54168b

SHA512
3ab291bed83b64b71b999669df973af1ba0ecc1e679c6f19c177d7b300eda5d922948e8fcdaa6d977ff5ae7ab02a4d4df41e49d62df0ebd3b781699b136c9ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
792f66af120024640549fa0c6f85b234

SHA1
2091f1470d76e5bd1092e75927cd832a7a3b777b

SHA256
1d970ea71b970fa7788be5c622d8d8608283145364f4dc21ce4a188704bc7633

SHA512
75eae23772d6cc2776fd5cee0277f93eed4e397c28d8fc196870db765886dc5453b0c0c95bc82c344fff4ab2e4a0c10c1fd836f349bbdce2ed3d5c55745a30f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21530b4985f2865a03e23d164a3e9792

SHA1
143b4418e2302d8e9ec3db63dfece73903f34116

SHA256
7156be5da0eeeaa1df14e2f8f7530b2518b4975ab63a59c7cf13676bc852b879

SHA512
5e18c29456ba9a4e759625522ee2e90cc75f2bcd0236067d53236dd30902b1dfd8e8f03304542b228dca699ed4a7d58aa7ba0f108cd8f62ac5a3792122ef4197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d429abe7168c7561e5ab017b201bfeb

SHA1
cd999e432f5f48075701a3496e1410fbfba69ef3

SHA256
dba24221b014e0fd1fb33c71d367e036747afd11630ca0f228cfba52827894e8

SHA512
6ab7f4cc374f291a54209c5b180c9da6a0c70242ff7ead528a7ce031749cb23fabf5d761fcf2757b7a06fb649892ead10617cd9b14d6c4ac15bc65bb30abacc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3216e2e7808323630d24c35421509022

SHA1
dac7d3d018f76426d9dccb2cbb400a81e9c468c7

SHA256
a4e7038a25307a9dc5dac86cd20aa9f5a22f1708eaf36372dc597bee48ea3892

SHA512
c5e6fc8813b35adab6fc1198887d88b321ab7beba7aeea383770d51b9121b11520d8c88669f934d70f18182360e0a298a1894480f1ab0f6caedd55bcb5b7f2c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1294e8a97ea59bdafd40240f987a5902

SHA1
c68543cc3c312e9adb2c03216fb791a5fbc906e0

SHA256
f781fefd27f8b99acc02527bf368b94cb3005aacf9fbd52778bc79c4f2ee5544

SHA512
4ba4eedfab6209484278b0c7ec9c83e21dd5ebf5bccf6b1d92fec1ac741c298d71c9e0a4ab927d152b07d4e8b7d757245c690bf997ce2eba72b2c9851f135316

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8DC0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8DD2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit