cd971849a35c5075bb8bbaed0b8d09d909eb304e706d6701b73bf80a7e0933c7

Analysis

max time kernel
153s
max time network
170s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

251b1dfb47d23dd6179e93fb39960785.html
Size

3KB
MD5

251b1dfb47d23dd6179e93fb39960785
SHA1

3f88f68ce931555296f642f2957d3faa6267fe32
SHA256

cd971849a35c5075bb8bbaed0b8d09d909eb304e706d6701b73bf80a7e0933c7
SHA512

0d5904446ca996cf6f4ea4aa17959c28ad2194135d458091c77c484356c3c4adcba3bec58d9ae8fc4ad0b18c2e0509345c5059cdd5cd429f368e051e1129422e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000beed5fc548c7dfc753ffd0e6538e80a945d2e8cba01fbf9deb6a7f59e44536ac000000000e80000000020000200000004de7bfafd02ab6378859ee9bd33bc3c04bb982c4c85c46a7e2e3dc1f3bc922492000000022645ecc16bb9faaace06d80c10b59529e0fa91c97d0eeb7abe2bf5fd61ba05f40000000d39b43d99cec1fe7ea4c4476909daa6c3c47bc34999eb56bdb97df76b5c0dc18452b691d7bb0b6f26d782c8e96e4a2b2dc7754b0e75bb26887788e626f2c4c43	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410317012"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000bf9c24f3d9fffed396427635a91a41103e95749fbedcae9d2439e1365ec02aed000000000e8000000002000020000000e8b3c7a2dd11bc5d9e80ee27d980ad5b4dbc373f6f197493ab5a88728374b7939000000091460c3c9c42983a3d6327da715bd715c13b01b118a7f3dd625a1b73256bfee179bb9db5e077c8409564369da9d41efb1787ac38453587b93ba671b125c70caa3f0de31b9090170e7fdc7309954555cb4a429703fff388ecca12eb4c89826bf1121713d278a50462ab7d7f4281d5490e96b5c9c7bfc8aacb5243c80432110379d8c2f4bbeb141313f92880f8ed0c329840000000d0dbe2ec67cdab5dc17393b1324ecbd51f33450666e42ac02b8f9595a38b9bce2b959c095f609f30f4056c9dbf573c817843b410fed5441cda8b75a6afe18242	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76356F01-A905-11EE-A2F4-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7009b451123dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2692	2276	iexplore.exe	28
PID 2276 wrote to memory of 2692	2276	iexplore.exe	28
PID 2276 wrote to memory of 2692	2276	iexplore.exe	28
PID 2276 wrote to memory of 2692	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\251b1dfb47d23dd6179e93fb39960785.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c35df08e10638275d38d09210952ffc

SHA1
ad7bd0c255641c99ec4a161a78322887025bd8f2

SHA256
1148342ef4558d6cb1b034c0208b551405c442cfc3328bba34b07175f46493e2

SHA512
d99ab76ed137fd777e49acb455391534509e875270c54bbc540f2d97883225c139fd46404be26ed2ae203da5f327d86c866732d226d259706d51fed5fc4b7b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25e0df63bb3a8874dcff9fc23331b585

SHA1
f7825940bfab3d680bbd81852d824f2377a76611

SHA256
13b2914fef47b91905bcada25ba5c4745aaa66e271305e177ff68725e9c585ee

SHA512
a6cfe904fc921738fad44269fe1a97fede137339d3b202c702c5eca5c7370252288daf15ea76f611a0d10dc1c42aa51c8749ab2d71042a6f42914c0408a6d83e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4155dd1d77e0c348453b0d80bc870646

SHA1
504a1cd466d7bc1536d0fa1236ffd3f42633d8a0

SHA256
9767a9eb30e8f9c879d305b1bdff65852eff2e6b39abafa86d75906b36d1d2c6

SHA512
e1d67ad1367885ac97f45cb5af39af2ea30eb53e88076096d2265a527e4e4141c4cd08dd25b2760d3d6cd2813d928992ea339cbb21d2a07f42959bc2553b7175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa32e5a29d6a2233b7795ffa9a362146

SHA1
d3d095c7a8668d8b3ddab0f06fb93b8f4ea2e6c4

SHA256
e8577735b819a6413087b0810d137875793fbc76584edc9ce2b4db457ac07d89

SHA512
767b3b98a15877d06a106c8723498a38076ba0af7daa63808631b74853911f3699d6880bfab816a2dacda51cbcb80130a36fb99ba268deb981e3c555ceab10c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2498c70c86cd894cbcd535ac6f337ec1

SHA1
cefc4c4604e4098c7394a8a2e046fb87a80aca24

SHA256
101859620db6bee0d4db10619b50902c43760c2f56e711dd463bb06930cd98af

SHA512
6ca4322d0bd8cb923319768de7f9076bb1818ec83209c9d9db87793d63d9994559bb8fb48ce0c97956a04d7aaafd86cab189b7340a250f541ea30c84b97ddd35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c876004d8044a598f4ea4cb3cbfa59

SHA1
077a8fa8ba265d0e6ae405215132195a3887afbf

SHA256
bb687f94627799d0ddf0b7de7cdafb6d2a2500567d307910e4d7edac1f10f0cc

SHA512
bc518fb14cde4abca20393fbb1510fd354957a11f2a77c93a260034a4485ebe9178343fbf9e614798ae0b6cf563f4adce1961e166a6549eefb636b65920a86bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b309fbae00f88073c9f4254e631d8742

SHA1
bf0257117ecf274e5f294d97d1444aaf636f18cf

SHA256
3704e4b6f50bed5dd57e39e2f7accedb1470b997b0653dfc231cc1d3b0a06621

SHA512
e00ddfa8734b35fa527bc4beb4d17c531780d42bf1e32104163fe76d4d73a8aa010ff02d13a7addcbcdb653a7cbbd968706a043bb5d93122e7b22ce9425100df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc82dbf532b90836a2648f4128bba49c

SHA1
74d4cd960a64522ce454aba389e70e73603217cc

SHA256
76fea18240d0630c9ac26ce23ae7c13994d2938592bd3f90341b0cdaa7270476

SHA512
224266342c5144582fe941b1a206f9cf857ee0320af84285fb3506ed6252bc77f699af49895a2abc67385735a157cefad52de1e933aa6dd8abe03e6fe03dff47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23927b0c890c11c7ac032ce3369bb4b2

SHA1
7e019814896ef161d067f8fc70e1b1accddb4232

SHA256
3f5b5c7fa3a9d23e5d0cbb4f72a843d475a9ff2189b0e2b7110c0be41af6f70e

SHA512
857f142b6ec753e4a68500591fd5e084130437235540ef4679b8e0dec1292674473f59ca15ec519da0302a39e1d7a85bce8f7841261cc5cb8e966b043d77e406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47fa619ef32750e74f1d4dbdd2dde9d3

SHA1
489dc44f24db3049b11758c25d7696f2dd6068d3

SHA256
814a64d7120a4fad973096efdd4a222cad56957fd7b38425000cdf71e40ea976

SHA512
d84ac0b559c15631772d5a89db2fe9b4d53d3ba8420d30a965fee978acf8474213cd28107f75da46b57bedde4cdade65d7e86d546d5a41ba8416063ad89e5595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4552671d4764df5bf935a5272378929c

SHA1
769e88e88c7d24f70fd1d6779cebc314a3dc0f6e

SHA256
03d93ac2a996a1da639fa65459942a3bbf4d98e325430878e46c8f2ad29b308a

SHA512
9c41acd3ade36bf6d80ad7b042fa2f307dc11f4c06e00b20ebf687271ef0a33d8d5aae9f1a8efa8ebb4cee01c896800ef0cdc89846ad9a2c1a19e3099f04c32c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6bee49a8c6a138f021ae5b54496eb62

SHA1
2b34af824c10b54a4a0afcd5a5ef51a9028e8c02

SHA256
6810120247f19a5be12c807f83b4dfe838c783fc5c41b0dd7bbcd752d9b6d958

SHA512
85276fb9841c21ad3dd4c700e87c1c59cfdf3d9b514dd1587b4d0dd8cd0eb3b40520d0c97191221ee23bcaf79c94be2660b52ff426a66abeb32463872d38c08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c4b21331f848049a4e098875ef357b2

SHA1
9ba4b8f802f691532764347b6117e712f1903d95

SHA256
5edcc0b92da4137ebdafde737c429d2acc6294cfe727bb893513e5ce7bbbc9e2

SHA512
45b7f45d406184377ba1a17c012a734698bea0c21484d6df8c37bc2973d467c4fdac0f4ff8f6422f52c2bc9f0304857fb2ebdf51060b0fbc15ac1fa7aca383ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f96842a4d13920d4d91a1cf25f2dce16

SHA1
a2cd91499ac3268812acb5df5bd91ffc2c18d87d

SHA256
7cb4a0eefaa46874ec6d3737140447aeb163729cc6ab4776eafd175fdfcb511f

SHA512
f0d6507b209dabf2dbe112f63b26710c5a1490d2f7d16710dcc9f409ee3acb11c388df92d1f1c415455b6671b01daa5307c8c38fafcc71ae87ad3f1e02229413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
052842ff46040d18de80ffcd7287a198

SHA1
2ed72aaf416fdd338df4cd552709bdb34de01438

SHA256
7e0e67fa5de5009aac571b8d2ad72de6764f88aa865f2aaa3de86ddc23a2168a

SHA512
fb132f757c4e1b8864ebcc6a6ebebefb060e749f555ee9276d06a5a9a65a87170f09a43d91b89ef0b8be24fb5827659c97a82594fb6064449c8467be2396e274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M61DDFBK\px[1].js

Filesize
346B

MD5
f84f931c0dd37448e03f0dabf4e4ca9f

SHA1
9c2c50edcf576453ccc07bf65668bd23c76e8663

SHA256
5c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584

SHA512
afc3089d932fb030e932bf6414ac05681771051dd51d164f09635ca09cbd8525a52879524b6aa24e972e7766ddf529484cc1ec416de8b61255435a89ba781f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOO61SKS\sale_form[1].js

Filesize
761B

MD5
64f809e06446647e192fce8d1ec34e09

SHA1
5b7ced07da42e205067afa88615317a277a4a82c

SHA256
f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3

SHA512
5f61bbe241f6b8636a487e6601f08a48bffd62549291db83c1f05f90d26751841db43357d7fe500ffba1bc19a8ab63c6d4767ba901c7eded5d65a1b443b1dd78

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabABCB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC1C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit