6506ec81bb9ebdd67d4446b6af8e631ee853bf2e098acdd25cb71c7c7ae90cc2

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2561d38f34fbc28a01412026aa28070f.html
Size

21KB
MD5

2561d38f34fbc28a01412026aa28070f
SHA1

d7e4e9c305e36e3c84a75446e28a9848310f5cf0
SHA256

6506ec81bb9ebdd67d4446b6af8e631ee853bf2e098acdd25cb71c7c7ae90cc2
SHA512

94e519245190609f92985a3c4d630baac7fbc2e78a2d6673779d9b7a02c360f9020e8057c1897160f856378fe3449c797d22b703da044911b52e135d88078021
SSDEEP

384:QfRIjUDGO2G9kLL9j9F2OznoECdJ11vFlFt9kitZbRJgR5MKxvQH8A5dCjG1BZWX:QfRIjUDGO2G9kLL9j9F2Oz+h4e4RWKx3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a46cc4ac3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2512AC1-AB9F-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007e0315fadad21f9a4817bd731be8fe32a11e57841657726a7c98af60fce1ae14000000000e80000000020000200000008e05f4cbfc709b47abf86f94892689492977e5a4223cc955739e5ba9562a3608200000008f457c5e8381ce2628f5fbbba6691036e8122560b544ab84f4bd651e7c45cb2740000000bf3f4246bb8827e2123931d4cc2723996ef3192e883ff63c4eb9ea2618893ceae654870de3a6b96acf7166bfaabc00a988c303d313928d144abc65177393b6f8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000018744a0e758dd4b8f4d9493ca2b54b4e67c17b180901a7ebc062c1a657a7e0a7000000000e80000000020000200000008db9269f0c02d5c68156e3e66ac6d6c0200b3f964820d8d5960bb4adaa5c257690000000e2bb816bde1faba482cecfa8bbb7a6d49b34144e6c0aef2b1f4d4e5c1448de06ee96d5ae9ccff653f7298ccbe49891e58c308411862e09d01999b54c00a36ec3590a27ee69568ca1839cfc3397cae038f6f205ee49b69b5d25864b2c0884e3b8d2417e0ccaf75e01ae542e1795b2c891ab1d8a2438b9a30210a23b12fad895098099ce7dad35c5854ad0959842a7b71540000000ac0f29bacef510f8cb851a1371e96b9995a711095e41b75cea4492c295eb6e39ed01e4d12c508984b84dc1c6e45efa15ff74f1a943301099ade932ea82ee9f31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410603240"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE
1428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1428	2280	iexplore.exe	28
PID 2280 wrote to memory of 1428	2280	iexplore.exe	28
PID 2280 wrote to memory of 1428	2280	iexplore.exe	28
PID 2280 wrote to memory of 1428	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2561d38f34fbc28a01412026aa28070f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b4316babf6de29b1eebe062c4f2c4e5

SHA1
30d0a16d23a73fa56e1f1197e24e47cbfdd7c4b6

SHA256
43bb40e0a6af9ba8b51d5e8e68e1a28df352d1f7e17692b109487ce724ac39fb

SHA512
79aa68c792ae5c0000f0a60c9e7abaf6ba76f4d1273d4c4d4a9c0bb976ec5b2c7caa59178c0ada7f1ea1d8f08af3716edd1eba50765e98849cd30d5190d85364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba33b7c417beb22ce93d59fea4bc643a

SHA1
18b2bc6fdb75365848180a75688abf27769da70f

SHA256
1c1d09efe73f11bfe955432faaf260a5e49ea459fb94ddde30fc1ebdb38c14e3

SHA512
1896e9ac569ad15100e463ee2c006984b70c04afaea3ccbbffd2df80b7361162bd5ed12f7997126ed147a4356c34398666f1617247a1734d4f2784c60dd67b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bba5843c441c77ca809479e37e9008f

SHA1
8a10ae5fc684818cbdff54e916970268f36a5f55

SHA256
e5dbf0ef37f4decccce826aa6073990491a392f8a9c7079af10f869631a84e2b

SHA512
4fc958fccc371056339a9b39d842bc0e82fc5d8652e794b2b5db5cfb80a066ca4fb1a4c1f35ea3d03ca5d720b83a128144789c15de2a1d6673f61dd87e57989b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d96d87414591bfec6e038b3954f5e1

SHA1
723d0480b803763d9773b3158fdeb952e1ab5797

SHA256
adf43c4e4bd50f81a01b3fa056e4527feaa2dc9832ac7510682f370ea51c8481

SHA512
d3cf940e056cb9dbff883ba95d96ec2392c88952c2972f6083e970795d880e7c9a6a3bf246c097bdaea8d35e84693f88b2cc67c9cd4f3606f069fd2642031fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
487430562ee6e3eb6fb54943d2ebd5e1

SHA1
f53a7ce789dc604535fe765e3c605dca30f7a668

SHA256
337e8e436e69074a6e0047cfa630d145c021b417b7fc8fe9449a9c03f4bbff0e

SHA512
c4dc63be2e6dbaa404e54ebfe99f73f8f99747e05a8c3bf2d5d95e2d25150e349b79b0f05d62f042d30dfe64bd3f95860a644b41b70a9d559b380796c284095b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
270e15fba5e1aa6129cfef1bfa8c9356

SHA1
20c2a73df881aa275bf91ef044ea0002df6cc54a

SHA256
49ad2a36520fd6a779e395e1db1eda28d1b02fa6f69db81ac7df0ba3ab549918

SHA512
cc0a29433a32acc52db0a217edba895d9b355475962dcb1d5435d566075aa084264aea763e29b405a2c0a171da5d9f981d10caac36da0a3c9b278727d601d281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa3bb014c046083708efec7422da064

SHA1
305b81a9455dad29f559e0e205e2cdd92174e2b7

SHA256
a4ccd75a46a465c3ec5a4402dbe67bcd3d37ac5eafe4873bc27bd6da7a9be749

SHA512
46c430cfd5c458f5f0bfd26ffa73a65212d747dd2e2700abfa19addf5f471a0146180d4f65f6bf3b7181f4441fc02c7ee7960c0b35fcea0bc02304520de20c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d627687be7d533ef963f1c164314728

SHA1
02757bfdb50c9156632c6731ebd6324192b1ebea

SHA256
67877d910839512f7b4541f59abd67c97bf835da443ae54d371e10762c37983d

SHA512
8c9a0c0fe201eb6e8ea3f505c7fb47a70b51788f85ed5a425a109b8725221a07d1937e0de7b2dc4269a575eb96df8f4bd7687ad6e22d0809f429bb03773a78fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93169bf4b031531de1332fa5d4d03a38

SHA1
7f6d358c23eaa10076e8305600f57875d417aba3

SHA256
a6770a625527df9ffaae5211c6bca18d2728c98f4b44a005efdc59ddec5a11a4

SHA512
c6a12f571ed232c6d27ea497cad2ffefa3a5af64c8aa26b513afbe333f97ec5da27c37d758d02f0e98776af85030c58966cf3c66599b84fae7cbca59aabf78fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e26c23dfb907a9a2d13c0e72680b409f

SHA1
7635ef532dec51c3255caaa4bcde3771ce9204c4

SHA256
0116c686d37267e9d5e588c4b4962e5af2cb6a48d324e0956ef87164f81bfd6e

SHA512
d9a31f82a2e36cbe00dfcbf73ab08deb61f63c493405ca3ccd43f6ccf0cf525a53d14442edad987c1b1c00276630739f84499501d1cd916c608079ea995a6d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3594f24c6c2c12f622f23d9c10780a0e

SHA1
3348f61102136462898cfcdfe00e3cb0e6e9d779

SHA256
6ad7a7982e62ef6256291fde4c3311883fb4c559cae4e50df73cb3ca9a8bf07a

SHA512
0438b35f1373e7b7466cf1e856216c556d538e4e1f8fe65b99ba12836728bb5292dab8b09cec77719ad903a7099d1b2762252095ad8e38c2908bd9a122c7659a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c28f36aedc6eae4a14fccb4c84a2293f

SHA1
70a5d0f1b3dd8e83289155a3e4dc7c8468403b61

SHA256
27650e64bf8d1e31967901c68b099b245d6d2778025e675b90747fbb23d6217b

SHA512
6d5f16a2b108f4b580e0af31198f1d0ab12d6aa29d2f679b5e735a8cfcf1785f98fbb5932e168177039188e75e2ce660b518c7bf61aeca8026ac0aef72aefeae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e50658e45fd6bf5ee50ab400ca9e11f0

SHA1
f4c0bc4a0eef7a84beaaa80bfa86b01e8bf0aeac

SHA256
4250fc0e5e135f2b5c64e8b79ec2b28801b09d402c2513d30a29d48316888e2f

SHA512
0b765562aa9130d266513faa8d9c970cf3d451d9d6932baa0ae7a08ae044adb0534125283bddfb8c7d8b5f810732ca2f54cf01b8943614aad2d3b898bc2d8c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35b2d212dddbfda9b7ac3b71aaf5fc61

SHA1
35612a4b5bdbabe554630553fc82edfc5153dbc0

SHA256
89ee5f2973c3359bd046cc85f459fac62e7b570525c3cfe46df57d75ccd8bd5e

SHA512
eb34fed82d604eab88111bc5d7a33cc3f9a10c1f60c807654f03829847e47500257ed2f58d6bf11ae4317bfb05d26e33f54188a871e52c73026eea3ab6a646e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356f014efe79963490c2cbdceb9f015d

SHA1
df70cd6c8983c48303671a00d2eb61e876fa8075

SHA256
ff65213d6145d8682c9a940e4993076f70e27fbf1bc1b69deaafa0714ec32bb6

SHA512
3215c584e6d57ade52fd07eddcdd0bd762602605e80329577d98eed7fa710e62d15c24d9649a19ef637cc77860af6768d8364db12000a6b1c557cae3632a0e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF77B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF77C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit