83b239dde3533c953870330fe7beec19c334eb7fab0514edb79148f91694e7c8

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26fab73a2b77e53b3fe7b29fb5879608.html
Size

25KB
MD5

26fab73a2b77e53b3fe7b29fb5879608
SHA1

12f73606c45379741ec96751bb565b664ce1a6a8
SHA256

83b239dde3533c953870330fe7beec19c334eb7fab0514edb79148f91694e7c8
SHA512

3bfba9a973f30748b2da75877fa63f301aaece2986a0e97223d34a2dac7940b3ba08b6af4b5d76ba5976ddcf9dae5b4787b01a488a026f6b400c59978dfc09fb
SSDEEP

384:xy1R1QREDBeCliOcYC1jBD1hEbCa6XYa6olsYK8fXxRAYuopCPRrMO77OM0TCtxb:xy1R1DeCUO21jBD1hEbh6XYaczV77Oji

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410328301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B52400E1-A91F-11EE-A731-CA4C2FB69A12} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008bf17ced19bcc26c504dbd3c95da351597088eb29a0cca40fc47a0e583b60da5000000000e800000000200002000000054b110c10274f8422f92885d7aad81ffd45c2b2115258d5681acc8ef2d71bbb19000000021e42cbcc0adf0f219cac179bec40748ee0aadccd20dbf8266ad3ba75365f3c666b9f3f422781656819fced55d5947092cbaad5a0773640a12f336d874fae0c2912cdb64712bedc0e7177d33683cb6472f192c986ca7b8636d58b399ddb4592c2055a6ff882d447e9506ee07016fca4b804670183e7503939a906f7279c2f7c61777fb4ad22270b57b022987ed8dda5140000000dc15d77f884ae20e652b1f510b41c6fef202ae626912945518a0fa65f872427fa1778667d8fd5f0f3f6af6612850d50cf2312442e948668aaf4458e5495fe083	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000f818f6f3b005d16746a4f3fc561bebf3a47757a9f480bd9b459d9714172e968e000000000e80000000020000200000001ba061e5e2a521c4001de4620234d05ab1178311ee505728b5a0d0b7a7d2932d200000003c4eb2996ecd5a493b7bc5e2f550b7580f4314017928d19c7689cba30c24a95340000000db057c099f8bd3df8264803c6e8daab9c575047bd41867b9a45493dd6dcd6d86ca0126acf7347ccf8662f2de772da26c4856f4752849f4d51408be375c54ae5a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803bb1892c3dda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2152	1700	iexplore.exe	28
PID 1700 wrote to memory of 2152	1700	iexplore.exe	28
PID 1700 wrote to memory of 2152	1700	iexplore.exe	28
PID 1700 wrote to memory of 2152	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26fab73a2b77e53b3fe7b29fb5879608.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
13dc29d167c946c323936f7d272f6db9

SHA1
8afe41b66255e4a2725667d5f965810cb513c9b3

SHA256
4bc0d60287a1affdf35dbb18e0473e5b9ad7cdb332a698c9a77a9b427195d188

SHA512
551686cb4817f9aed765557acb836e6c0e266189646d8e1a750f98a4d09e949a772b2deabab80f572ef0c09394d0ee306b33cc1d24ff7a519de9fd954ad87039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fa3437bd17c179150c411722876e6b6

SHA1
8e2e71d3ba9a7f033b438846ef8c090b285dfa18

SHA256
8eaac7c256b7ce78befb55431d878e90143b66f0e012ca850e7df65e164917a2

SHA512
73afb0b5a29db75403dbcc3e56186fd7db8dba6a4b9543084f19c496a4a3ee064fe614b5127b5231933556e77c0cacab584ba51adfdaf0e0900b05f6abd9bea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e4a3f30930f827b9ff0d9d9cf13b2ba

SHA1
b4a36c155cafeb91b31e022f8b23d9733a7557d5

SHA256
cef277b34d4121da7605ce3fe164d4ba3d795c918dadf79e6d0df463d8a5bf69

SHA512
c0102555c580d15606fcdc4f6b19e6ccc5b910c001110dbdb01d7993b8fd519165c0755c9ad6cf48a85f4f9c1f05ce9f17e09544321e8fb0ec2b707146d129a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
347419f698d2cccfbf2139a0247cffc8

SHA1
6c1426509f3a084b64e4ca43c8425ef740ae4c65

SHA256
c40f1ba7155a87b021e5b3b320aa355baee5146dbb6d27c302449c5577cf6cd6

SHA512
f7412ae9c2beee4c6e4176dcd743b9d4115e0c604ead5998b59820b92629810054edc769fecf1b51e5910180aa603a0ebd0ab4e66137887d80c8e65058461f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5870791915314e681aba2ab3d087beef

SHA1
681fc3914ae3073e8f7c5e053f899007b9228070

SHA256
68083eedaaf2d6fa878add46bc773e9485e5ca54b6c508139e45bfa18e1f9d43

SHA512
a7ba8b096fb916c37a34740002219255c98175fbace9974a5115aada380ee92f3fd813f31e98c4ef100f7ae941c79da4b98d5242b5fe4443c1cbedf1126c0de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56f3d6a02f534de9665bb3102078a1f6

SHA1
f89a298c2c1b539aa7b947afb4567216def7a0f2

SHA256
2914fc509ff03d484b5fa4d0697bc68adfd84ab8d93b922f50689ebd44f5287c

SHA512
0089ae080ec954d4a6b8f41aa025d48f4183dbcb0bf7e4255848c9865deaaea8d98f9b2a8e9835890a66b1dba33421b309fb9c020f200bac62e958de525bc447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40dc361e7ba44e16e5380c859559d198

SHA1
d0aaecdd8d63cb559204509ae324b326dd367aaf

SHA256
fb1a162d74d758be9e835743ac08640531e2d96880d0c9da653d1667b7dec917

SHA512
cea16d1ae4159ddf5e08701ef69e60722eb5c049f0e7d868f85ae8bac15b18fffd611e47a535acdbae94309df4d7406bd86c88a1fa92267abed8d5ea2d6110b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
601e4d0eebdaf86f2991296fe4724b1e

SHA1
70d74ea2bed3270b1d841cb5551e1c1c7451a03f

SHA256
be80897f60bb5b1c93ca86e0b75284f2b1f5df219c75de605cc98ca4567d3908

SHA512
d52e613ad720ba3a824f1bbe8440e8a895419f32d2bf9a1a06eb35198e9ac454e7027294f64fb2be51cf7c92dc504360a171882e290b356c57267cd498c7955d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8f9a3e548e02cf66216cad09c02f354

SHA1
427aba892677590ab555c02a332f600009a80974

SHA256
559c07314b7795a203e688aa230187ef0de9d5dacb3ca6c63542c3fe3d3dfbad

SHA512
fc1dbdd94fb29c1f57ca5207ccc8580a16a94762ba0e5104cbc7d8c3e869872f8024ddfdc4e9a02333d9aa4684ace48a329d4618129678316468eff062235a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53dc0091085d8821be4ee65589a2f65

SHA1
9bfa150415ad8b1e48890bd10d9f9cc58597c611

SHA256
9832f9473ff9bbbbe74bc4d2a268dfe295a534bee638df69d9247041a3b1ecff

SHA512
c3a523381b79b49a9d4aac4c6a43e4304b60e7e88618bfdfe42e62a46003f4bc6624bf1576c0f17883517ca15bb6f2a8502acc564350434151ce97858b1771e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd37b97b069d86c1c6ef02a9b56ed6f5

SHA1
3e6c02a827942b6c6e8cd60917e5d8d362547eab

SHA256
3496ff39b35123b4d36ea4821d65cd84f8b32b6c3f9f3b65d0a5d209d791ab79

SHA512
0d93d92bb5856f4942284c4d5817b22b1bc37daceb51b7275500fae62e3a4e9ab0fb7e95eabf20dc761a0a6388cf4ac45467c41e503753b2ff18cc529ab12ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a7b556879ec879985e1ccd718d115c58

SHA1
4d79cb2f5db71a40d83002eba1387abba456669a

SHA256
d2bcb1d68ab5d333b05dbc7e504368ca4100aac052311160972d45fb42a1545d

SHA512
97dad24bd84d4f3ddd334bc2daffa317053d06a7b6efb9885135d566d704ed26ee65cc72781aa5d78abd61380cc8d6572b272a633d90ad8ea1f5347f7f25a675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E18.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit