9da8893e247c505c968b891a93f63975f1da042fbdf58cf81a4ae9a01705e223

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25291ddcdc5a56e0fefa156dce43b86e.html
Size

55KB
MD5

25291ddcdc5a56e0fefa156dce43b86e
SHA1

aa2af10477fde68484958dc455bd2b134a82278e
SHA256

9da8893e247c505c968b891a93f63975f1da042fbdf58cf81a4ae9a01705e223
SHA512

b4885c2f71f1efb85dd06c44a66ef10213eb54a19bbe442ca596cfd76956580bce0a83b4daa1ca9ade153dd141134f8b347a3c9b401f7fd138b1cbb2a1cb469a
SSDEEP

1536:6RtQ8tY1+MnYdlXFZR+0gN/A7UVPIW+vFMJT13S/cTDak4T69vESuXetSrN/DFMl:6BtY8M6jUVAW+vFMJT1khbFI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000009e2feecd30306f26e72b1dba290d701c1be0d142fb9c8b5737439a5ae2b40fe1000000000e80000000020000200000003d0904aa1a3e8ae4e9521f4e2c2e52d552d025c6898bbf520ffd0d4f351fc8a790000000d247c9a7e264a5235c7e5b329ffbe1f9e97d58b4f0e8655cc2315cdc9e5ceb0c74ff8bb9e55ff6216b1da0e1622b4527124b35c18ca620fff22c8f6ea9b8b3ea8c0df109ae1b563bf8dafc1685ccb6dce96a6e9f343867e4cd83601309effed56f725f7907ffd6db5d6f8ce435185985226f75f26d1b81795d408ff0959e337f10301a234ddd34c0b16ddf217260cd8b40000000703b2d673a43bcabbc696481588ce2e70583c23892703876132e596f3be9c839fd733ff6947350ce0a6f99fba9f1033166f31cd965c3925e8fce01c6d2f2b8f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000089f3c84b0790822285ecad1002248e122a6ce3052ca2201e1b89573ca0b87b9000000000e80000000020000200000002766dcb0c7925539628f657aa6efe5991f638d26be57ee9e9aeccf79939e711820000000901b5e6233be64feb5e09640fbb5043e5fd08717812e5827c0c599018078c54440000000b97aaeb63d8d9222a53caf5c7cf996791e8387015cc88aac1048409ac4d0fa027f80ba6001c0c7be99e7a8f6f50a44b414b1e9f11ed0c03ec74a3b57339e4f40	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37919131-AB9D-11EE-9324-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30cfb219aa3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410602127"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2652	2156	iexplore.exe	28
PID 2156 wrote to memory of 2652	2156	iexplore.exe	28
PID 2156 wrote to memory of 2652	2156	iexplore.exe	28
PID 2156 wrote to memory of 2652	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25291ddcdc5a56e0fefa156dce43b86e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2c270326953f3a9818ed5231a8177b1

SHA1
98d01fd335066b9ff99b54c19b4780728db2ac89

SHA256
d28ce19aad26be297252f59dd923f8306a18c4c5b0a678308f99d1781827b7dd

SHA512
3bf0876864d47fafbad13ab46e2379445e13bcca259a36d9431d6843c28150666a67f2e467ae4fed8bbfceccc0bf82006d15ce8d240f0b083245ca411817dbb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb4db2cf7264acd12a357ee1784f50b6

SHA1
b8530e40a59e1ca8fbd6cdac1629e7b50be5b5a7

SHA256
488fe1463d227dc37c1189e9ac6f63efdd584390dd39526237d3a2d9b325e8e2

SHA512
933fd839b581f3fc08791c10059d3531e01a366eb35afc644341c87c5ba8f0dddcf3364625f47b79eeb86fdd610cd724885cf8531ed67a9c9ff57442b961448f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26311a0f2c8b51b23a29667e13d7d995

SHA1
2bb766175517eeab79fcd46feefd19060f973186

SHA256
490cff302b4c34df6eead9cc9eb3c2cf85d38bcf26caa65361e85f7e29c8b2ca

SHA512
585ed1fa0df8aaab1ef7f05fe8ea2bb153c5e551ec7621ae335ddb319fba6b5f815cda50e046155a976253d9d0b50a52fffdaf8c33cce742aa3c67b5edebfe31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06d943c93259edb8195d3f73bd97ad21

SHA1
9340f7693043ba49f08f7f6f1de9fc88636d1430

SHA256
172c194f97d8bccb4664ca890791d05b165ff22ed1320d4b211f419e16425293

SHA512
44a6f11a710d36c9eaf71e9c85df56869d6761dd70d3c0153bc24f5ed798bf09c798198bd1bff27fff56670c436d8ed0127fbccb170a80257ba098c6925da0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfdfd4b83da86a6354d0364347ab25fa

SHA1
b1f0e314e33c6a87878ef2d4debeb4192f2d7c10

SHA256
6f753864b642f5e95ffe798143e52bfea959b2fbe702714fc7cd224c78f21c93

SHA512
76f20eca6f528577a0c36d148f44d8ef8d701677849df124540eb1195325286a182ff2cde1fb8b4c265d47511e6c78b06f8a290af439c0309b385fe03ee73950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d25b8c09b978f9c702c3233f9b518d4

SHA1
54d2806d26e8b0badaa8f8c9f947350ded4715d7

SHA256
3555111f9668eb52db76ce2102362b3480e2f48566109aa67d772aac5400d0d1

SHA512
b96415639e4cd1987e1c76f07c60fea1cb527c5f5108fc6852699a16aea225967c95300d79eb196866cefa0830999706c9f859a23dc9cbbc9a458e1fd836788e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe58f9b1083d62419518f74f6c9f1e12

SHA1
aa2147f9d7912908a9b76f32c56ed85a0a73f599

SHA256
38e0a157d17c152c11a14132ddc1920fefa8625aa78228747b7962dcd58950f4

SHA512
3bc9fed6c4b90e4fb36589b1003aa4bcaf6dc433001ed633f13caba41c8b54809d450080cf67b98ae3ba6616cc2c02f4291b2898b36b0b388b64d4ea2c4a8103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1b2a2ca4aed6197a00e77b2547ea951

SHA1
f5eaa3da63f32bb13fc6ffea7814793c0333224f

SHA256
d3cd0ecaefb362d4cb916c9bfc4f549e2818e0fdd19290aa225773f9d3b7639c

SHA512
1f914b0257579a35b9babfef03b21e01237c65e68e8061c3728ebd4ae3ea003c346b660c964029b62eb955b2ba9602c0c5761ace52ec76c0ab2db5f653b09eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d92ff0f8d4f456b788bf140f6ee976da

SHA1
3d9c85f00e0d0d8433d9a8cdc6d2f482dafe2c50

SHA256
c40002fe48e184ea20d12cb0625bb9363811e3c85491b28fc07f9ddcdfc04f86

SHA512
e7e35ba1cc56077b9cb97647d96a0291fcc36407305808a5ffe60ac0b0fc13d8f89bd3d346a58df2f79afd8f03fec8981bf5ca72afb5b44aa8894b8dd2e89346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdc1bd6fb11528244ed1753601902327

SHA1
2bc070ea43b84e32406781c53c311cf6ee430aca

SHA256
03c20c9857c2fa612b733f4ad2368048445fc0693f1a62dd85c201e3f00eb72b

SHA512
5a5d314b2a275bbe68240d131c67a5a035cd45a2dfa3925c4d03315d6cf041f4ceec1f4704519b859c2fbab1fd846eaaa108fe3e245a7b6390e953bd14edcb57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a8ceae7e587ba153122c69a93fb431e

SHA1
d93a6892f3b01e13bdbfa9de22d82bfe5713e2a8

SHA256
f146e2b05e97c62392186f99bdb9de4864532e42525a21a09cdac47adf1298b2

SHA512
d3f7c59e91eb09b85deb840e6f96432a5f45da3535ed9c341d78e2bb3098ff91bef590fe2f9c3fe53a1a3b331e0198f3b3700a4a426e2ab74a61dbcbde978cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf2428e0109dc3f14f35a9af78abdb4

SHA1
8845a89b3be2f7fa72478b1c66e795eb269603db

SHA256
166ff182dd58053884b16835eac46bdab15d093624ca361418870833970a9d89

SHA512
4e878224cf97eb68bfb4b6488190d6ba1cffad0127f0bb4454183c32e7d8b640baef6926954f54adbc30f8b9b9ef90739965100f5c427459bd9d0861376c3aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9ea62d0e25a06f74a59aa092dfdee0e

SHA1
47ee234cfbdf274a148844dbb32a87be5ff6b6da

SHA256
b29bbaacd4bb6cf846ae42d17fd23fb7bbc78699f069476a94298490512721ad

SHA512
7d148048f9e57c5df9dd44ffe145ce76a5d2708d0c4b2814b4bfb915cfae7637f5fd094ee4503bbe4c316d925ad0e2b01152b335d490782ef4c012519eaaab65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ffcfcf6eb32e2a07496974d53ad60f

SHA1
f07f7b321bf16975725d020a2a178add9ddf2e1e

SHA256
83ccfa3ae09d2035d1dbb9f183041e235d1335d959b2b25c250ece50b0f0e493

SHA512
19a3a68cd7f25fe1b7196f2fa5ad8bcdaca42909aa6a8eabeae289c789974f0e4725c714d3282352bc1b13def980218dc49fa112cbd3cd49227f8483e53eedd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD40.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD42.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit