e18ffcc4136b338241e1b815608d9d1ae8d599debee057c80748b1a42842d91a

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26d489d6b6e1c94e0fcdfbd565251389.html
Size

1KB
MD5

26d489d6b6e1c94e0fcdfbd565251389
SHA1

8a695d903ecf685e78d874ef7bf2b4d1fb18860a
SHA256

e18ffcc4136b338241e1b815608d9d1ae8d599debee057c80748b1a42842d91a
SHA512

a79ec76a2707f8c27a553c3c68ea69ad5a7ad4b0815e0361187c524c914a4eb87e22f051abaee2884d75db68cd6d4370404bb6da3dcf15d04b98068f0834ce51

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000084359bbe8af655450767810da9b189c43f5cbc4e733ac39b02de0b019a23a340000000000e8000000002000020000000927beb86f3a7e7fe705655c61c41e14b22a65c292f805c611cb2777676b419482000000037c82938a7daef171e51cefd012e56e0019a0e177410de48ce7d89d9a376b50540000000c6650ee54bdf30f9f5db477dcba519fd437a3f1f55a3251ca63a1b653580fb1b46480fd3042c8dfe56541b733370bd9e7c2719a366f6448a78799f6fa19ffea0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d5ea5dc13fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000324cb52018deb1fbd17293f6fe6fea975909a26344bef8bccdd4063acb534b5f000000000e80000000020000200000004dc1026d6623148a737bee5acb41e79468ae80a367490f0c297a1e5f735551cd900000004ff848a45eee61c0375440e5c88eaf39dd6a786695f663de96a7b7fc7be1b8a157fda28fddb448efee4fb1462ebe02d3774db9f44a73cb17fdabc265b0106d4c82349720d613266d83976839d1e82df76da96668344e726472192c5acb9afda15365648ae9c6854a10b7a86ee5cfc0d4716055c85167b3e57f134a59ca7dcb36ea2d14f65ad9300a0cbf016eae22a86440000000e4f26ef1be99b542e657482811b70f5e8fa148ec33ea19874d9bf5e89b08f3982a2ec56cff0119c0c61ac1d456c5838e67ecf33479a8d9d1fb7a2f9a0dd95d99	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410612133"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{983938F1-ABB4-11EE-9AF4-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2132	1636	iexplore.exe	28
PID 1636 wrote to memory of 2132	1636	iexplore.exe	28
PID 1636 wrote to memory of 2132	1636	iexplore.exe	28
PID 1636 wrote to memory of 2132	1636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26d489d6b6e1c94e0fcdfbd565251389.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e8c24d33d70cb4121512c099ec0df3

SHA1
ee67d86726d00787d77dcf9573eece0eac8388e0

SHA256
db5b8b5ea3783d626cdcaf9da11918ec22e516d4859204f655cdc4914cc8b94e

SHA512
31839e3e12195bd99da10954f4609060b89b04bfb36e6c28cb558dad5c73edb5f825aeb7cf6ceed7a2c9eece0c91741e26c10651cb76bda3086bbedc10af73a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04f63ff4e65a0884c4c472d111c4eb1b

SHA1
540eb4f2a727c95cef85aaaeb33acebb12516f5e

SHA256
e9f4fad31e068a40eb736a177a63999907191c447409fd9687b59ab6b01e22e8

SHA512
820df97bc674eb2d256e0e585125e0db18cbc7716411fecd63c52a8da9764d54b39528d30752115f1df39434a87e27a988511a24a3228006e4882b3ebb44e1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb7b6508c1bf1af5a9ca92258a4e73a1

SHA1
2e483bfb0d3df7e00a6c0ba357ad9e4e7d1689d4

SHA256
43e0c2708b8fb53d92440ff5bc9c2a72cfac11b2caf943bda19f8d4542613411

SHA512
c891243a9d3e3794b842829d6d289375622ef3053678b62618e39d3d102f20e971a52fb6b5240b58d6cb4c943da3c32e2aa4f55470b2cd058f2a2a4f5e3bfa28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6d019e3ae41e09d438edc55933d7026

SHA1
ef745e301fcd1898c1aeedd6ead54e9aecf69706

SHA256
59803e8aedd81f4c35151c774c4d835129ccb0db1fe7334380c2982a1031f5ca

SHA512
90f46296d73e36f411c3ef991b944e891d24336e51cd97e71be13e2b0ffd79f90fb1fc55b293989ddbb49cbc03d893cb6b8c6093f75399dc92d569ee2a0f4659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dc1e4b2b700ff84e96af26d77472b8a

SHA1
17cdb077c3c93095beb982a4c149844e23c06cc9

SHA256
dd0c662aad9a32430bfbfc8e6cef6650e4bd670efdb4cdc145e0ea7724f65dad

SHA512
ca313989f339b530eeb5ca1593d23b80f96c70c65364e677614d7871b4091fe2c4af898130215df2470b606c08e157f8d46222ff09870bfa8cad424f8d07833f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
388db8d1092942a9407fbd021d5c2f27

SHA1
d59a6bbd3cad5a2e25fd918ff6945554b92dd02d

SHA256
1d8d56d6b30c3551cc50e897a80ebbe72f94bcaf438284236cf76d14de9f8081

SHA512
c57f7eec946f4108bfb279f6d844777dd870fa3962ac30c857b27510d55bc88005667641c1dd9ed1a07e785fb1531144e746fd14cfa583cd40371d361a834008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ec2028ef1493a3c5221dcf9529bd1a7

SHA1
9a628faf7c0bdc04096fa7a079ed8a2ba34e6160

SHA256
9e92d41fe69bb55de3e1f9684750c4c5e47dfd4688002810edaa2ea15cec4905

SHA512
c86684132e38770fc97ac60e4d10215fbf72eb543d886f70e4d241e4a7b4c967b4816bff6d8493e8b2b81469092c274a5eead582f144840b26fcb75e3df051ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca96b8d9b8a913e96514151ec2a4478c

SHA1
e11a5e173de098eb23dc10f8b63cdc3ca7e9186c

SHA256
2468e1a4bf83f36459551c5d460be1295d8969dff75f4b7f3692f006ccf05d9a

SHA512
a9ebf50cc8640aafdc1a52fca9f6d1fd760d6302e00a3ed4c3a0cd853901bca9279869e3dbf6267524ba24a062d8eded011472046985166016afcfa194357e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a04eba8888e66d9b1fbe5c84b281ada7

SHA1
7d871c321ef3ab799d64036f321d6d7fed90d306

SHA256
1feb905396ffabad87eb7ca7397c7e7178576e6273ddc2cdf6a6d7c24737b675

SHA512
0b4a0625f1b5441ebc7720f63010514b773dc55a4f6eb4a2861310e5df6d591d867e6f20e0e231e581387ed2b5a89adf76d4482e8c2a5e6b9ab071e955465ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
773fd6e3ffbb628852d04f0b6fbc87ac

SHA1
12ade34eaaa71fe5b2e03e192aade1fd2567db74

SHA256
b18fcb7f8144bedf82865d5a71cc573a2dfe8e54fc316bbddc6fd8201688d810

SHA512
72793f1241ed6245d9a6021cf68a9a9d95b61c9e2277d406a3c89ec0eb6b1af695a3e1e688ebc635f0352f8b397362bef0fd0de1965b21708b344e92a688f6f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9de64a31b7fbe1a32e9c972819fc8d4f

SHA1
493c795be0db90f3afcb27743555c907f8f9e812

SHA256
2d1062fee70b8059296a904dc92ffc847e6ec7081738a91c23acbb6a052bf6d0

SHA512
b057d461fdf1f5e93c2b83b0a503aad473d3f15bc176174281779b3168adf8d715ab7ac3d167ee6856480b52886ebd4d7b6d740383854f851e90425da518468e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
648491be5d91329c59399054b5d3bd55

SHA1
8205eb2790b18efba04cd58478b34997229fc2f7

SHA256
f26e17078a03cceccd02dacb07a787bd18d59d34df92a27d3fa82f0e4e452c14

SHA512
0d888559fb621b488901b86ae6365b3ebbebb8f0ce95d89c3077fb0ddcdff1c74a3e016099ca3de8e4affb492eb092ccba98cfb95d97bdecffa56e22aa59a4d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65584b6508fd83c74e92d6ec2b02d760

SHA1
26af7c02d6af9c4fa9d761506151113a0deb18a5

SHA256
8202fa7767c2840134292d8f360c129d5745d8bee5e68769b4aca7a4a0106e74

SHA512
640c826d087833b0ab3693964d0a09b58dbcc3e83b7311d6882eff2eb2cfe485ce5f2fbd7e583adb30f02fc9cc557a016811b2936a9e4ceff8fa3391f3e26c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db696cf059d2a1cb03695fe631e590f2

SHA1
f5e72504de964bacb0d825d42fa681b20a63fafe

SHA256
7be71c6f978aae1d643ff45918d11303ae0d96266c95f0e5311fd33f55f528dc

SHA512
e2d7b1331533fe4e192e093b5b3157cbfd0dda2e5d7498e0f05db67a2f73700cdd5be5142ec593eb7398a509302589bde57c93c908c8f64ce6cf3bd31ba9c35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8FD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9053.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit