1f297063f2ef22e4f522f6b1519949ef0ef91093d774d6798ec08e81b92ed640

Analysis

max time kernel
118s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23aece7dd388c2a83379c865ebc5babd.html
Size

77KB
MD5

23aece7dd388c2a83379c865ebc5babd
SHA1

97b07b63240a39d030068550ad39ebacfcbcf6a0
SHA256

1f297063f2ef22e4f522f6b1519949ef0ef91093d774d6798ec08e81b92ed640
SHA512

3f062b905648048dc8f759d36dbdbb3b133126d7c9e3d0d0d443e1ae0ba79382305a9749bd2f63ed7c6df0eeada940341d8f76846d7cd335e3a6b01f6086cb4a
SSDEEP

1536:5+ycJIhgEjCKYz9tOAxGpJNoVxz9tbG8uOIOII:T1wz9gAxGpfoVxz9JG2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d0bd6c94b001eccca9d9981d8a97d27f102bb740c9076320b561038c102d054c000000000e80000000020000200000001a05eca05b8a50527f2f6a6551b973ded3eaf8bceafbf85ad6d8f4aa4eb9d11890000000ae85468ef6527a0bdb34b270912ccf69ca24f8ab4891cf4c374ee7a7bc0d03244b3b964b0a9b258d2b34cf400bf0b9f9dabb9f451fec10465be370ade80454e88181f5873d5527236b2f6b6ef0bfb119292f9e6ba53da262af1593a392c800d572dcb1cb63ce421f84c986f8f83a7e5d8b4ab0c9e39f51131eac4773d9bb43a9f253de33b913e1c90330d524077f1ee140000000086928888f14cf865ab8b238bb2d4fc0d034064af2d717b5b558799d832032bd03370bd9de9b83aa7f962f6ef4a927ee8242bfd01d1549b1440e862bf0610a6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410305458"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E9AFE41-A8EA-11EE-B092-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000487e6ed47bbe4b0fa86813e0f177a9368495b568d310201de2e66bff36c72636000000000e8000000002000020000000ac0ce41f7d9dac18c93d6b0674820ad2971f03c250c4f2db582106d01cc2233620000000afa1bc419463d5aeae1647d3003493c7426d633d3eb0beb8784fd3be80bbfd08400000008b36dd42e6d9665662f34a686bf8c8f4cc8d127ccb7ad5144d958d76a658a7bbd6bf75e8c0c299d40a84392e563b3c4576102c7bb7c6a22a40b99f6ce9af918a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b0b76bf73cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2688	2268	iexplore.exe	28
PID 2268 wrote to memory of 2688	2268	iexplore.exe	28
PID 2268 wrote to memory of 2688	2268	iexplore.exe	28
PID 2268 wrote to memory of 2688	2268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23aece7dd388c2a83379c865ebc5babd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
174689de674e227b3b8ca4208f72c2cd

SHA1
e6f4167406cc7ccb417d4b3ac40cf1f62ee6e9d7

SHA256
7b562294bd340e013f7fc7943775843e776303d9902b5c7315fc3ebcdacae0a2

SHA512
2c6288cd60d9639b65c6f812d51c4e47f539afe8b9fdaca7b3d3db1c9a6085ef55f330c9a51ed559e298390bb12b7b56d7d31e4bf7df412b24a773c7111c9158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
987b705960680e33405a48d8b6342c92

SHA1
d6d8717b960d8026ab8b7dd6714b7dda5eb180f3

SHA256
083f8891ba55735c4c6532047b7402d2717db18c8807186f4f1947387dadde90

SHA512
dbb363f5f458d4a1fe7062f862f6cd2f5e829b605a506cef5f983f2432a48cd40bbcd7f52d46cb54615f8c96da24b402ed3249ed2449112e3b152378a48e25cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6570afa8c98dd668875d9ceb0bcd8d6b

SHA1
6de75201c3a25be443cb115b6417fffd5fd342a7

SHA256
b51a5691ba37f089551c17fdb1a49e071f2551695671d2c74c6e73a0d22a16e8

SHA512
fcb67c8ad56e247117f99d7d71e7590920fc5e33e7a46d27d201e1f67c7ed78e04fd53d779c52a4911635856955a30d3dbe58acecacbadd259a127384ee79033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
514df11c308dca4872cff0ae49093b4e

SHA1
2cbef1455dc5e8685e29e7f3d394eaba357366ee

SHA256
a93f51d4e3f3ef55053e5275c22e91d432dacf62bcc2ee6ea42d2ae66e5e1f20

SHA512
ac0b00db807c5e808154fc4072ace616016fd9db14fef6b6b60404c8cb04258bd2db9a451c5b969c0c0be35087455ae06b6fe06f8c628a9ac074210c5d4d53c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90d831ace30d893f915778b05cc13df7

SHA1
c27003887f0f22a24477910c6936810e297fe2b5

SHA256
e36d4f4a75a96f26e8eb245dd6df598c66846b77662d9d221c42de264ec73f15

SHA512
369fcde13e2b636d982763399d83b754066b025f5854291a55109904345927ab47350c24338ba988eb89145325c9a2c3ef8f7ba0544c21c4755948ab3d914c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b312110652028d865fcba3be1ddbf243

SHA1
aa52c0f3641062fcedad71b963f683c32bbff505

SHA256
c2f76f40a7b84bd71b6e450e33339731fa7d6031568ce0bdf46537ba309c7b47

SHA512
774235cd0cd4670eb5863920ec79e1e7200548974da5be05165253a51195f5af1cf3ba022b357673c3aff80b3917bf2300e8cbce79ff7054037d84e36d9ff76e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a848305193b7b51d4cfc03f3bce33b96

SHA1
e0606b4a7078c02aaa8773afd0e44d8b7a5eab53

SHA256
c2bc178b00ad9d29c644f3355ecf9f7f575819397b61122793d5f2dcc81b37f8

SHA512
3cd9d48af46ec8f03be83342794a66fff456fab1f276b9e7c08feeba7fd3df58e55fe87636ce9f81488680bf34eea9ad8d2f49f74f4f51233fbbb96290078e88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f92f47894b68ced3f3c1fb500f8114d

SHA1
e930a58970e98a606935e027653dd189c7781d06

SHA256
7dd6fd855d646b2942e89bdb33b8435444835b89e74053caa5175c8dc245f3b5

SHA512
7a23c581bf5ddb5b309d4fcd2299740a64c9519a1bb5434423125c4b6df5e026a722a9cbf0672070cbe666acb3020c8c2093137abdf5c50dc0f1432a383c0254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16b14ea6c08e06761d725fb4a2bf1f1b

SHA1
f9c52b3fade7275a4622636def8af91200f9beda

SHA256
9416b2246f2efcccba24bc9abce60715159341ea2d94f6ab915568862b5d96ad

SHA512
b14b06d6896e22a2f472cdcd277f6e70b9995326fa9b3b241763f106d935fe5bd882105c66b8673ab15aa28d27de32172b88526c396f91ab49fa6f1a072f5ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d20cef95dac96873153bdb225101866c

SHA1
45a3a48eb9c176f26406ceefa142ea2ac8f025cb

SHA256
a4f524243000cde101c23a9a5f00bb00f0d678d65b9b0684c25e2c3934629992

SHA512
ffe0f9c316a5e8a006536ec29c38e84c1f58e7a7736794b9cd0ca25ed30b57807156335f3c906fa3f44bffd4a96169c0a3c5cc88492c0c914b83449818044fd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d3f56f6357523ddc4d67fd8d0bee65c

SHA1
eba85ae138fb7588c5cd44c164ef5144612b0229

SHA256
e81b2bea7c859fa53581aef9f1458deca9ec5c994da776edc324f4e7f81003f4

SHA512
2cd7aae517e9e9b4a2ccff8c5873e2f66af05b4bdd0de969aac0d0840ea07fd5295eca029ff423cb54ded47aa0cf7f141308a6534b61f8c0b86f3971478422b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f328282b266df3ced726516116bb2d89

SHA1
dbf00eb86c8accf5577ffd37773ba2cf062e6ab4

SHA256
5d4d2b3b2b317d18d2ffc253932a0911088a5841c65b0e96d18d0910b1770ca1

SHA512
aabd5c5aa4b99124d2ec633f473d5fb95aecf643f8b3042cc84629b6e60d7e84eba2f91e63308dbd38e25d6554cb9de34870d31347998633fd564f588a7fa9b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4676e9da73de0da228376f0f98d39185

SHA1
63cef675a8e45e41cb8492bd705e2a4b6a99d95d

SHA256
5ab43c0754c35c61aa939c22cefe7de6e312edd49b6136bb241abcf422abf709

SHA512
e276f7ebc012914482f228575a03c58ec11a37e4298023ed309833c5958f71cbb99fbc3122625b2b5a0cf7a560a5fcbbd4a3cc1b73e1efbc3b28a7d1a6935049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
280896eb89f84b5c6ca44512c8770718

SHA1
da19999f5e011776bb83850682b163f32e7a6d32

SHA256
e60527182b426645d2de24345974b7f98608d5bd1da7f8564f832f0bfa90a68c

SHA512
40b0c9067defad959fdf163a5b7cd2c4e1a197a00b0f895dfcacbede7a4ee3d50a2d0133bee10d9851a2e4b999fc073c6bd09eeb3b8bb3ab014e6fd004f6aec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29ccaf4d296cea39af8deef78bf55c5a

SHA1
0d39dbc23d01fe2b212ac9b0b9e18c94aa7efa7f

SHA256
b63899420003cf9eacc7f490ece1c19511538434816f9d91d710e55cd4726dcd

SHA512
766a517cd846af783c9c2b2d4e7128c8712d1cf7d6398984e14e8d032b84c062ef2578a22681f23f1faedbd1ed357afc666b062eeef02ca9a4e7f021b19fdb5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fbe1429aa092d8962b4a6f75d7b20de

SHA1
e02f2aad0452bc2eaf28e2e7edb74b92059f91a0

SHA256
d790130307c49f583025d8cd45ad6ccb5cc2bea9c8c71a811f2fb58024d093f7

SHA512
a13cfd621761cf57afb48ea3a381af086790bcd261811ae594424456374086f54d06b2fe9d445366981bc94f3209b7501e719a6420280f720f604a97ec4b2cd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f6f2a9bf3dc7c96c2e964cb836c475b

SHA1
6877f2fbbf551c9137f9e63b23a25185511e0188

SHA256
c8c5c94fbaa1b1f1c8d983287f89bcf1a3bdc442d59b1d1e4d89d5c089561cac

SHA512
e532dd5c17ffc404fcb6cb1dafca5cdff88addff71bfa4c16696c7bc267bfe84bf4dc042f2c72c64022d31ff9440db450dffdc6273c35948dd6f54c91480bad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8255111ea73cd7040be84c9bbe81588f

SHA1
fd1aefc511a0c38c4ca54898334f337de23b6fa1

SHA256
6151637e4a28ef066a9a9951644d619cde31db4dd1e7773fa2ad29aaeb063c1a

SHA512
448feebea280ac47fa2cf8b0de810cd32169520de1538f8ece24e5445c8ce53c86a25817544314008580950e77aea65ee82347b59cbd856884daebb382d3cce8

Download Submit