3b34188f72381c298708361a96ea090544d842cf4c8388c12dbc540febd25853

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

263ab175a0a5f74a524cb592d2bdad6f.html
Size

432B
MD5

263ab175a0a5f74a524cb592d2bdad6f
SHA1

fccdc5ff6a4235a4e6468c9bf57f76f21db8f2d6
SHA256

3b34188f72381c298708361a96ea090544d842cf4c8388c12dbc540febd25853
SHA512

1dd497ec6484213a2880faa3ae0f6f5a17f17cef845fb31ec3a7760ff05e3d97430916a6b1877124b4350032668da4ce5d5ff11e27bb7262e23e519497b60f57

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61A264C1-A915-11EE-B49B-CE253106968E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000087926cb905165365cb65db70e2f7d8e04eb00e12a13147ee58a93a378361fb5a000000000e80000000020000200000003e620497848e4a21ee9bf6c2ffe536286135edb1b849ad65da631ffe17935ee6200000009c98a3d917b3b8c7890a88eaf479192e44c39dbb767306aca156e1286b2b91684000000076a18fcc9b136df16472b7aaa347f1a85d5289494711538832b6cdbed84b2c85a2b342cb7a5427b8089817d7b535b98e98581cad4b1d22a4d5003b3addeb7929	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410323849"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900bc428223dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d41079e4eccd38af6fc331cd92e7dc305fb0132eb40f747237d2d100460a273e000000000e800000000200002000000023ae6d5856c871f0277f3e0c3d0db7f4f45b2b0f90f7c0435e2bd38dbac2e3a990000000c161052aa28592d3b3f61019b7b45861ddce98b7b17d5e0f87439595956193f0b7306ae3df0d8886fdf7cf08cec4f4bb98abf02510df0dac673a8761ba7a060d6703d74e6ce6ef370acd7cc83cf6d9ecd3d37b40f0461aa51393d294b86a03b7b08ec9e308a0b0f6c41517748ef3316ed440d2a76711a2e0685d4965f466ee4bbcf2354d8ff74fd7222c75becb6ebf9340000000091aa3e8959d163e838bedc61f09deeea553efe969c6b03fc31bd3df4a13b23d64da653b61bdfa2eec96646196f6ed4f8f0ebbe64c8afdc17ef9614eff9bf407	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2128	2028	iexplore.exe	17
PID 2028 wrote to memory of 2128	2028	iexplore.exe	17
PID 2028 wrote to memory of 2128	2028	iexplore.exe	17
PID 2028 wrote to memory of 2128	2028	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\263ab175a0a5f74a524cb592d2bdad6f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8a26b8c207d2c81356ae11fdb900e5

SHA1
7d5bf80e1d083e6e1c84a3e7c93feb800aa25b25

SHA256
1db78a60eb8f811d7cd27072ec7d2e09eeff04d8f7c08f0cce8a40311bbb5f95

SHA512
8f49221b22a6448272bc13bc88b0aebfd212b7ec412a977db74fd4e2cdeeb7c5bee25484155388ca1149b45b90628b7f429bbc4b2dfdc2eacb63d3932d3fda1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f5af923576f5157e8d296d016e1f3f0

SHA1
9d854090cf99a7bbb0f8eb95dee45548a8a97ed5

SHA256
233011934a890caee89205600598be8b7fa518fbf63d8f7850e0c318f55b3bd0

SHA512
35b73faffefc941a371f363c0f3e579ef2055f3f9ebd09b05a6f5ca2f6ef8477db359b853f9a69fe7992cf8bfe273a3342a17ce05edc99d859f70aaca998a817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db746e2a8fa42f009e6e9ec0a0334000

SHA1
c875404324aa52b2bea49aaa9bec2fc40cc3443e

SHA256
4fe7791eaf0c12eb9cdecb164ed766bb173386785549442567bcc04251ea4e18

SHA512
0fd97db4bacc31d81bfeddf08b32a3733face49d7a9cf398c12cdee07e849dcf43afa947a41c5f7086f7dfd52a10372878323bd2055ad3c608e0763878b31e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33aff831c490cd30824b2b333e08686d

SHA1
8d883476c64a4bbfb43d79d8dd1f513215c9ece7

SHA256
c490905741348d4a3a8a69f7dd9228de11eceba69d265f62cc8bfd8581b19f41

SHA512
d84d246910ea30e73dfcb6ed3e9af1391bd694eab379ae533bdc3fa526ee19c9f594abd622970816a623e9b2123678b0d5fcbd6a087f0ed109ba94c887bcde8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
255ec685bb443cbac84cda5bcff904bf

SHA1
e0249d30cdfe3a9fb8c50e9bca82b5434f3158a0

SHA256
ebc6094539ca2fe65d71a44daee8083d5bb2b08e7573c452f6395c61318dc00b

SHA512
5e84ce953d1e609edb0d47b414b7d572160e47ac33ab443d0b40ec61244e7cd2f7808ca2cbce07ea615d83bb541bd56812429272a09b1b821a63f4b9ccd1240a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1da1605df2a6c774da5f6433928a07c

SHA1
451d968693682ff0d826fe5faebfb07c20ba702d

SHA256
fa3d41813f43c6cf18bd3b5db58ffad4cd32cd80a0616e36ed3b296090271947

SHA512
343edf6d61ca3abf9e8477d68a980c2a0b65521c2690f8c56e5528605e5f333cb37de6c653c1c4e7b3adf6eea7e2950a5e2d460693ec3c50b9451a23cad28dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
181cde35f304644f0a62fded8b821786

SHA1
a49c085c21a58800c90af550d6575e99147f1f22

SHA256
5fe85836bc08a0c57a2571133945437444a35b730b730ab167cad72d184cac9f

SHA512
7d9a4d100cc645093eda10a6c05946da4d8b3a1e6a231f540444e73d65bf95f198d9efe399d61675d74d6d7b0aa419b94d1ed670bf65221e124bde04e2ef0d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c1eea800b3b9d944c8ad4026b9ef960

SHA1
535f2c3f8005f52b2d7ab6910128899bcdb60927

SHA256
3d13daa1385799aea70727909ce5a5b5b154964690fd5262811feaad5c7e2b16

SHA512
90c3df41669553ffc2f30c91aa4a13eb3d76b246a42f1f32973e74840dfcbd970a346f3a50c2e3323cb985f9fe7839a63bbd047a9f1d4aeb808f9f43d683755f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff993eefafb90371889bda576bed0191

SHA1
4acab4799b5083e029e6d646377cb75b1c54c911

SHA256
08d38b0d05b09dce2d00586ec02e031602096391b7f49b756cf95ad4ceb4aa17

SHA512
58af10cb697a557aa0b86f3db14cfc95af29674500ba52c7c6fe7b7acad45b9224ad172a586a16e93ea9c88c1d6b8ad2073e7715241ca08c1fa52492e6acaa2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19dcbf71040f7c6df92e4dab7888654d

SHA1
c95a2107fb505b487aff20533ae20739ec35b778

SHA256
f76cee081aa3276bc76d30970eb690b17bd9de6df57ede0ac6db0da81c62d20b

SHA512
1cc0f59726dbfd6c381a463a34bc6e8cc558aca6286f43cbd952eef6fdda94551025c7760c8523e8d2f24e773ef6f277a7768abe34d54b15081415dfdcf6a822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c8c59b3939d562aa12392b98ef769b5

SHA1
d0f978817b7a48ec5ee25e53cc2168bfdfcb0afd

SHA256
5d09fb7963055d516bfb2d47a5fe8983868b2a0967fc0ac3b7e1876b0f3223c0

SHA512
98d0f8d7f7303b032bf2239f5b46037f9d6931ef9f4d75b8de1a56c689675d2fd11af685aa098c5cb82bc8aa3d61c3d04916b68b5af5e3575ff13a62fa2f470e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43adbafd3829e03d76c31b491d8c52b9

SHA1
ee79947bc555f83821cbc274d96e962840c441cf

SHA256
d5f176cb619c8e67bf6b1a2addda8ce0b4a50cb9dca64b22181a6f9b9ce472aa

SHA512
11b345226b8421dd63822035503d89348532d783bc922d17668a5312a622a07b113ec1db2fb28fdef758dff4197df2fcc67e95ed6964c20a87ab06c3d4413124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e2f2a77de8de2f1790cfc414b029511

SHA1
453f4e5f992c17c3a09aa32e44fc6e37c12cf70d

SHA256
25cd07bfdc4739b8722f04422f443c64e9afaa31af6d4c36c80844aa9098ed0c

SHA512
1f4cf0f9378e8e747cfa01200cc94cdc9a14625727b4b1ff6b7d4419b36e26a3d16f376e943e6ce327344fc41abc0026f4fdf076c9c2ffd73ae1f81d4499c063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\02cy2i9\imagestore.dat

Filesize
1KB

MD5
45d218b9c1c9fb37a26c873f39e59c6b

SHA1
b4e457d942138fd2bc0c404cd9fa6893cc008500

SHA256
64c6223c7e241dd33ee520648f956bfce9a2838586ea4d411fc72444e084e4d7

SHA512
a46c4692d6db1dc43cb5bb6f62fc03cd2c590543a647d2fa596477bf4e44ec44f7ba8071d4c0bf98ffe1f1f4436abe2359de1459c380fb1dff0c821c65f76f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18A1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1940.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit