1807af8846491ec1b547989845a1d767a69188c416d99f05dca06e02d08517d3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

268af0b32fd3f11d20a0529d6545300b.html
Size

3KB
MD5

268af0b32fd3f11d20a0529d6545300b
SHA1

f3d9e7d5b4866d584a075e62f4edf64a326e80d3
SHA256

1807af8846491ec1b547989845a1d767a69188c416d99f05dca06e02d08517d3
SHA512

14a1502acc47023bd248e6aa9a3d975854c1d330aeb062afd056f4b983e20fdb525086fd51c073e5a53899d8616bf9fdcd7cecb4c9a022f56141a765786ee5b8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410325612"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000001cf032ce9717745585cace8e06a1623689adbe9b42fe7793b6be3991f8d71d6f000000000e8000000002000020000000f837bc58f91ce512cca5030220132b7e9bc5c28cd97c89670049daccf45086e7200000007bc7eedc9e8a38ff791e3827df67f316533cef203d0903ec454c3c50c5f1c0ad4000000080b90ea97d26a97bb48b0a91ccae18c89bdcc998eb233f6abb3ae071045198ed0a1c4e401ef639378ad4d6e5f74defac3e9eabf031fd1ff61caddcab21af0a36	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0688e51263dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6ED363C1-A919-11EE-AC02-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e18bf2416bb3a0a0270175300b8e98d7c135e6ca49617421f6cc901d0aa1c7f7000000000e800000000200002000000067fbba41253c634a7a01e80f0ab34072a7fbb79f7e36e1287f635ef2520f05f2900000009c87f368b344ed6fb147bdc11870c85c6fdee0a04bde81285b6a2c334f2e3988b2156f2eec331fc14381bc356499387ccd223ff277def1de220e9d3477ff9ac0c98480ec5a950dd0e5676be8ab23b175d2284b25d9a7dd4361ec749b4d34713f251a002f2ab539117affde03eca4e5291578b1fbf0c5248283c1923ef6d8ba4a98e789bc0efbdf8ad82a3bd33194074740000000687b2e07a943af41d90605acf36a75d00e1e55bd2a6dbbdaa0a20017d7b9e7da428a4b072a1eeae95728f211b9e1a18e01ce87aa7c9913eadd745a497bc842d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1276	2144	iexplore.exe	28
PID 2144 wrote to memory of 1276	2144	iexplore.exe	28
PID 2144 wrote to memory of 1276	2144	iexplore.exe	28
PID 2144 wrote to memory of 1276	2144	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\268af0b32fd3f11d20a0529d6545300b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d785e0ad0b337058393e417b7e16c65

SHA1
d04413aab4c5ddd52b87adc71e6bbe4cba5c75fa

SHA256
3d7557108e2c30cd1c210811a871dd4ab7c2408b1f028a7dfb4198150db7af4d

SHA512
7931a58f4a2908a427efe23d1fae9f9eeb0f3d675bfbd581d33942a85e04f5e210edf6a6d4d7daab7a06373a7e786ccbc082382b3bdaac3f990ccb97974ea0e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dec981628f315b4d4c7f21d37efdfd2

SHA1
c2bf56134bf030fd112c0b9b25bec7db6992e975

SHA256
cf1af0b35eefdb9a4712fed71f2f9c8c6b68fc0fe2773a02352f17e6cf1e1b2e

SHA512
da7a6d3a5817ef4398be4d113cfecfe011487292539989e6ddb24e08663a92a4fb27bf1dd1f9a0db8851f312baa670890a986e3b381273ef41c1ee1362df4164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0d2b76eeec6f3b05fcf1376bd0ca3fd

SHA1
0ceaba85a5c0db01b5775416d2c5b1a06f826601

SHA256
71f088b82a85a9bcd38f8ce4069724e587d2c817fa7b9a9fad3bc4d0926a0bd5

SHA512
a6925b8c1ea950f21c1f092752cbaaba378940601d9c226f32ddefa2ff21f0cb1982cc207b3c82d242d5ec3ceccd446d28f770336666c8123fb353807c1d8248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c5dbca643a563508e63fed3657c9eef

SHA1
f48a138af3670fef0fd41e0ad8424d155801cfb9

SHA256
8c5a68661d0affaa8cc653d14529e4ffa9ba31d052e3fe9fa0bbaebd2f85df4b

SHA512
5b71621dbb8f9de00334902c1928e463a1172886b47398cd2638baa96b8538094a9ab9e3fd9b13d53aa94c2ef583d7e5278ca3e9db7c695437dd55550ec5c93f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae490ebb82a36d304a2950bd75baece0

SHA1
95ac3894cde9cad7c97d9cfa15bf127e852af2ee

SHA256
fa5e3b6bbde4aa25c9747cc5bc933e527aeb473c0424bd562f8b15dcb7cdc291

SHA512
7045f47c1b05908751c1c6498ad6bed928ebc4c95d6dcd694a2e42f29d699345cc82a76b3b74c5364f266f50660cfcdfdb81f0c7cc287debdd0653379cc48265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
370f96e22e6e5b897b9bd655afd454aa

SHA1
890c08b6dae93bb5031e7164ad7416656b6a5eee

SHA256
1af8eb7e7f48f4a63a4633823adfb987d14362a3af290b3c20afacf9f1c98a3a

SHA512
d989116295fa3899c10cb2ea82d4f58717b9c63dc8c7e4d71a9c032f84ae6d650c1fe07cec4958f5462d765e7408f65261730e14f260fd14c3df2a8e75e376a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8327e47f27ec22a45b1c1ae586d897af

SHA1
55b3bdaadc365a6da92934d7124a96352078f811

SHA256
2255324b58d51a6ad0f6bfe29c57ad3f182968feec81b24dc1895cb1d6bbc4ce

SHA512
04a208faff682e7a1929dd9b4fcb92f2b7663eba473d4d4115ae10b62bb9d57dfe91f3c66bb8f289a124a96667f877346248870980fc1693f70df3507787e49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dc59dc77d6899d4687888f8304e13e1

SHA1
6dec34ac3587586639b0dcf9e4dbb0b39338c193

SHA256
44380805812aff53de0c60381706dadf7f9fbe59a6ad8d0e9d19159c068e1278

SHA512
69dc24064abc7ddd170d0fa04f7ad1bbf79c0cec355bc3f77a664be81843be026210019b41ca9d1fbc01b1a0aaf211921277cd8a8ef6685b0751c8ac9e1d0e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5406e3086e7c16f1a653dfe663db996e

SHA1
c7bf72ae68a3dbad76f38f938df68a6504247e73

SHA256
71e8de1be10db0f7e4a1278940a3da43c1b0738262eab1e537f0d57cd3bf41e2

SHA512
9d34346de7c2ab15da7c836b9b97fc8c881905562e22b7eb11696d3310049990758b1d8896540d1a49c9bacac72faf49af7c894efcd6dc8a6dae5b9b1560f8ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8796d77685593f7bed120f50ba501634

SHA1
7fbb978831dcfe04b921e1916aef782755b92744

SHA256
22530e4d187f1d9536a0090002970341036fae69745d645ce97d1bec3369df70

SHA512
cc51649649a8fe7cf69cbd2dda505983c7881edd7c1f2ff2004c2055622ea3d6560545e0dbad784c1d7d27565f1c961c8682fbab069ce1b214e34428c66c02b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07cd079f718f2e9f9f170c0c56bf0469

SHA1
c12eea7620665d45e795bc956a29cc146cfc6776

SHA256
d10c10e08bbd7b813fb9b83b2548f97a2a1977f8ebb3f075d45feec174380cfd

SHA512
9f5635e5f9d9c855fe795eb542d3a66dcc67f3ec49fb78896f864a670e036e24128660550606b3574003a940a949092bd3f1a443087f8f1fc7b208dd1bdbba56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68335a5aefc3a8b4166d6e1c8693986c

SHA1
fa9982a2a08c4d7f0d07bcaa1c5ff9727abc3e53

SHA256
0e093e5253680889e9e73454b6fe433e3b58cebcdefbda9c54db5fbc651a12cf

SHA512
f780329eda1ae9f02ef7944a9ba4a3fa90834074afeb446f8713ccd6a1688ee7c36e3b631096aa212ac1468e6fbdf7f21479a4f68adb0b2560155bc3d0f2cfe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fbf2cfd8a6768777fd7437ebc374413

SHA1
1a00bd8082693e7b64dd7ae30dc41322240f4857

SHA256
b877403e44f31b555588bd669f1f3556b44188ee758ebee9e5e14b552bace076

SHA512
4b04eb4a7cd848db96afe40e29f42105d5934425dd514538e4c0ca515536e127c1398cd980079ffeadc38fcfe0b8434f9668ae7c2e7be7961b52702f3fe2de6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9761.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1D0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit