9a1500a9e6e589a0c6deb2bbba896b0c373426af5509ae214018aeb9dd6b9607

Analysis

max time kernel
142s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

269b30907ee4905b03f54bc3a2dceca6.html
Size

103KB
MD5

269b30907ee4905b03f54bc3a2dceca6
SHA1

de8b68e71873f6d69de680f45a3fd75f593f2374
SHA256

9a1500a9e6e589a0c6deb2bbba896b0c373426af5509ae214018aeb9dd6b9607
SHA512

3507c52decb7098ecf127d964fd3e3f523365bfcad998f75b4adb261cb9def9412c43b39d59515801b96ddec12fe8a41e6465f624f69753210da5e683e746322
SSDEEP

3072:FSLodvhRyDQ6/VDdWDiPfnqyZntKYbnkVRtML3pt:MfDQ6/VDdWDi3nqyZntKYbnkOP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003bc96cb33e61e6328404581585142805017a66f26d1b06e1f796bf6c01e523ed000000000e80000000020000200000001c87e1a8a965577b6f5d0674f02a3fb24b7848a4e0740b7cbb73ae22fa7e25049000000025d6e5c1559f15e4a37861eb120578fc7939ea44a6339bdc4320ed4a336bea5cc235511fb8b24098be82e4980dc46d7a1cdd1eb6e0e7f85359019f794e497d0a87d46d8397030e203afdcb67259feee4e048a63b993794615b4da4557d20a2f9fd7791c8a75caf912b7e2cb858d871cbbbf9446a224567cdb77a823fd6ed4e3d16914603fee550e0c16172c3b6a8e314400000007b19ca0d2508ccc70514b8e1689569020cfdff697c288c23ec42ef3515972cbe5084f515da00f5d0023dbf4b761a54f0bc48b13f6f3190de0c23417ee96d85ff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f2e3255b510980d9352e7a4b192704414e943d4415bac95612bde508bd0f8702000000000e80000000020000200000009e69eb762cee18775db0243d0f5d2ad52a4ae6839fcbc23006bdfe04ea1abe9e20000000d7d470faa6a32d7c8e9ba5332369e730c83903121596c57ad9180895321ddf9f40000000536738bf3059c32719bb78c2b8bc8fd43d210e1778f8c14fb54a38f7f0e59d7b100ccf72483e3cc7ccc61f5d36ba2cd0ebf274b37f2506c9103adb840500b606	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410325998"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F7A8971-A91A-11EE-8A38-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3029723a273dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1032	iexplore.exe
1032	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2396	1032	iexplore.exe	28
PID 1032 wrote to memory of 2396	1032	iexplore.exe	28
PID 1032 wrote to memory of 2396	1032	iexplore.exe	28
PID 1032 wrote to memory of 2396	1032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\269b30907ee4905b03f54bc3a2dceca6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7dba01ed6b447c492df20eb4005abb9

SHA1
1cf55e1451a33dd9db35b323d75cedb159ed95ce

SHA256
1d0cf1f780cb620a96ce2a160497aeaa333886cab95ec63caa74eaa04fcb1545

SHA512
a8e1aa25ed167d9a14e396049854466b12cf3ac481d30e97858dd7076543b72db346c6da87dc2cfa34af8805b2bf1c66bcbd235c0bf414d4fb2dd11909d138b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c48d449dc722d2aca8b7c767b9d707f

SHA1
b2b33b7b320c58b95c0e8769baea0f2d84bab690

SHA256
d4b3e0b8a2a60ec57b09951b0ab95d7e70af8a86c37b7963a72805111436c625

SHA512
c13fdf56fa5a657d5ec365fb305761c326133d2cba7d7fea43aa5e1e0250d3ec6d9f97b6f998327f69355e1a3ea1f05eaaf75d70407bfed4e489bf66998a224e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e42a31b0cc5f2c3141db2e3b5e64fae

SHA1
53752d5c6728e92f6e70965c6e683f58fe5eacc9

SHA256
88b87510654b3de9bb43a7dd6fcbdbfa1de4dfc394999b970d28c0a8a7223dec

SHA512
08474111d4cbd7c28aff5b8db012f3adea8f68c30dceab2f520963a818ccc4469eb0d4c3123468bde9107fa8437d32d690ace7000d076a6632d1d9d315198363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e47c4be1ca4e029b74acaf104d3e029

SHA1
3d24a3af211bf4cddc5b805ae839088fef802506

SHA256
986c3d6552aa909ba11e78cfa440448f917ae625cb8f99b7129a6066af51dbaa

SHA512
4b90abb9321242bfe41d1b5609673371369652115f7f98f38964d74ac3b0fc4c59181ba59cbaf5f3af8b3782aa8b89aadf6c0727d377c234ec6e8df6660669ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e22b5ea13640927460cb3573b70864b6

SHA1
3983163877d009250593efd0e253c09272d44e2a

SHA256
186a3f5a408175b5bd9cd417c7b18ab230486491dd90f4ff77c43243c5840ddf

SHA512
2cd20725908f8ec91fa646539344ed5be167d2bf5d98e8290ac86dd0e045be8de598701abf11e050bf818f5c5ab66e0040dcaccb56caacb6a54a0893c2cef89b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
689a6d72033046074583e2b0130fc9b6

SHA1
057e5a2161053fe98bff9597bf5b6035b86b8d82

SHA256
939ec1ca1f4ad1b2a12588bf08505b15b9d838287771cea0a73664d58f0428e1

SHA512
5b281c3bbf29635029476df4968270ff410ba1ca6c1d66fe5dfe3dae24a362d03a54cc6ce8c3c43f109bfe4a9b54f172d8949ac0b53134a33c2a6c3b6181cecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a3e387c030ed0e44acd91a225c4d16

SHA1
c8c136555520b3594cb50b346f2376644da9337d

SHA256
91d291c90a59682aa13604e350c05ff367b3940daf394922d67f9a5b71a4d2b9

SHA512
67441012d315400bd21b55230d1812db0a4e46f62ee9e38ab4650a8a1dc2c1aa69e417ceaeee332ff6e872b0df4eb6fc8e157e68d3839b3c2f6e8beeed368ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da03c339407539cbd6bf6827a5472d5a

SHA1
9e9779f220069bbaf0eb8bfc309ef202a88b74c5

SHA256
3a9cdb185fb739247ef15467d319f43c4c94f21bddf00d69d8d18ae6173984cd

SHA512
ffb5284335c634f432531ca436a02b8b3c75a1de142b5ceefc6de27dc3cae5e49e95a5c66ba1e6cd027e2bf36d85a4073f2e594a6279cf5cc1e2af0667381246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6e540df7386b08caa4130e34d0fa6ff

SHA1
fc4246a6175a3af01d09dd7f49421475b0ca5c0e

SHA256
04c6b4966e507cf89d0f2d417c266b3eeaf04b4fba16aa3e2d8d4ce9dba31df5

SHA512
ab45ce0792a4b13428e67bdc5abb6b931ea7585fbbcc2592e2dff14293f297f89d5dfe2ea5f94ffa660da3bf88d9a9aebeda54472dabac2cb6894d5cee9a6e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed202c4d7aad3826fd2942f046bd4218

SHA1
c5fd52b3eff2fe4e8fe8eea0339802505316e297

SHA256
fe75284555454cc8e1cefdd1db710e44a05ed05fdf501f93feb02f0ab27b635a

SHA512
2e66703cd5f5301b61d3f7538c47ee3b66be032f43cb270f2d26b0afc6602a9b6cc8c3c79b999391d5fe5a98907199d94feeae0c619e17d75a406b6c9f7e0895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a604e32951772a775e92250891258fa5

SHA1
3e712aa04bebe3aa5db3f115021b2f65e919bcef

SHA256
ba00053f3f757a4ce231a5066dd31257395196e2937d9e3c9f6f1043015b18d7

SHA512
db38ce04cd8dc60f7bf50546a3d8e760159aaf4312bbcbab73807eb38a2b277f1f766c44c7cda1df0ae82b063da45be6784a7d11548e45e82198616cf1ae857f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77f9146aed7ed920b4b3999f8356dd6c

SHA1
41ff0e15795bddb144a3ac01d9f48b586bc0d2fb

SHA256
4ee913ca7ed2e7e98a064aac3f10da50db47769bfe29904b33533a76fa3d2d24

SHA512
95dc9d60d20b118d4f22e30e2ed031178f30d2edd38918ef3b1aeb016c01f292650fbbca65b1d2d1956a31d2eebbfd845643cdb654c8984eec41482b3f5a7614

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7b8db437060199b96d64ee0150fc50

SHA1
4dbdaa8c47c82fbeebe1f373675a919fd9aa6cc3

SHA256
cf9f939e8620017d9c5d372ba3f04422fad31ff83edd4086dbbfb2a71710eb0c

SHA512
518d61540727c118817b67f761e21f77a89d2568b8b21f26bab93be2103f25e24aa9b8e5dcadc105db3999e0d77d5b74b1fe3992bc673f9283b5803083fd39cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
560511c1caa23fe94bf404fb371babf2

SHA1
665d466b6d10530d92ae85114fb36631c7956e18

SHA256
8d9369b4d49b52d267574f3e929ed1d823e71d0306de5fc852b5f427bfa8aff4

SHA512
61f31d9f0890c0a17f39405efa42c209147be6229febcc2a339f15157c1313ca18eebe633c31fe1db3d0432bf3bada5dcded71361b648f4d811af8655e8193c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b89f54ebfcbd615ce92e77636b0c9ea

SHA1
010fff795db3e8f9851d6c580f459beb94256a3f

SHA256
866f974629cc8b5a8b01be0ad86b562869232e77e8cea0208a7903c934c63654

SHA512
2e75f232a96c94e213ebbe4d17af29c1e3783cd5e852aeeaac43d8fe549c5e06822ec79bdf84d0d0e4f972ae8f78cb694aac8225584183ae5f39df0afbde1d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d47ca686cfaf3688c0f4ef547ef4e0c9

SHA1
fddd785c5976931f72a8e2ad0073441adc836594

SHA256
fb6834ebdd8092b20a12592aa25a2b21e5792816c11d77d5c411a2a27bae97cc

SHA512
52617df87bed703d0e3680a89946f484419db985bf29ed224f7ac2bea604ec9ed4f2edaaa8d33468e8dc3e0d2cced1dcd2775ee4e76ce832abee2daa9de7d7c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3F3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD405.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit