af10f27827dc79a2df7cdfeb8dc1e99233271fe1465b58c0ead2ec1638b2e426

Analysis

max time kernel
110s
max time network
201s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.htm
Size

3KB
MD5

63698c63b49c3a0c8b1dd6281962d421
SHA1

d2f684eca36913dda89824ac5bf917d5934d5b02
SHA256

fe6cf5450a971f2e75ec6c3320d1d4fffa02d15053da5c4e7c1eefc485c8e23d
SHA512

bc69ae0098977c6110de3ba5ad69bf734bc33d711efbd318dedfd4d4a46004141bdf1469d701690beb6eb8e15616dddb6ee61700fa76ab86d2271ae183db8a72

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33962421-A944-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000002514a0a0fdddd7c5b4c5872dfb558f83117fbd25a66d75b8edc3d85179a5ccba000000000e8000000002000020000000a4ae14bd78838f61ad6b1b1213c4a96cf520210e6c245bed31ea41f39f624bc720000000957098859e01e06b055ba2df4112cc854f8d6cd46784b06f1444897edf06b38640000000a9a53762f1d96a10c7cf4b54afa3f47f25fc8cc28f0e3d1c8249613ab664afc3c0dd56941710c080ef2d2c5b7c79d1bddbce8121ed356bd3324f7a689b87145f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e3a48f29ad94492132cc3010444fd0b12991bd3d84d78c454be5d3919e81fcf1000000000e80000000020000200000009a3550a0369473c2416d4b768564eaf6dcb9460d183d6d498039ba40be54aac99000000002a97902204455c06dc938254d13d2775a55c88ec646829715de65b654e616fe96e768dfd9e88a7d5217958dd067730ebe3f21cfffb54f401b0e112a6298882211634dee448a4df4abb529bfa9676e53ccf0f5c83a461dd83aaafc9be81e57eaf0ecdeacf7c889e0c52ff226e625f8db189031c02ce40b780b5b3a99e1397f12e76fac61235bc1459e392940185305a14000000007ef76e50c6b919587c6711aed9dedcf4b7c6a7f73aa9afacf77a97ef730fe71217ac454f47afcaff4182533ed819e643b127d7dc5345fdbce0a599fddb44fcd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d6531d513dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410343959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2684	2600	iexplore.exe	30
PID 2600 wrote to memory of 2684	2600	iexplore.exe	30
PID 2600 wrote to memory of 2684	2600	iexplore.exe	30
PID 2600 wrote to memory of 2684	2600	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d83c670e52326cb013be4e4beece956a

SHA1
2f86920da615dc41e80066e6325364597025a3c9

SHA256
839f5a100d1c8279bdd51ff6b4b33456963d2ec285e7c5fa37b020ab2c7e0b1f

SHA512
b86529e67f2a55b42ad2d2243a1a52ba1756b429a11519a72565167a7f6cc4d5b2809017cb15121c63342ca772949bbd9dec569ab304c331da410851aa22bf8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92580842900a4e5fc7e0ae30d1764430

SHA1
7b48130939ff553055b452931c69b2dc1014ff9e

SHA256
9d62e04735e9356559f6856c7338086a25ba25a7e66325bcff84007197ae95c5

SHA512
bc6447be421d384645e922254fae8bde1846aa6e926afbddb0a29b832d9447b4fe9e6724c0815cfb1adcfff87b7400eaedbc06489376d5530160d23dd6784b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec2c72bc1e685146900937e8a493dd2

SHA1
5f48a0f5811d9b76fc4f7e19f4a3423f046617a4

SHA256
60d9d6be14a044bd0f042f5af385323c98789fa50aad52d86fa2c435ef0902b9

SHA512
41e1617f182a5680f084172e6aba4ba479231425e1d47c2c4a009f804538a76307a427cbde399b54466aae9152e183d36f07c1a11c7023108397db692b2c0011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
362a50570b302e992f5415e0969e1b7b

SHA1
cb6f619d06532702792f905ecf7faba1cfba9128

SHA256
a9a195cfaacbf31b30b2b746594d3d6c364b6ff5555a883935b4dbb071b325ac

SHA512
861cf356e044bd031dedc4d9e0cd072c57812e65f5d75f666f586ff647f65e4d257312faaf42cfc63b7b4421d280ee8d3d541127beda73b89b227a2ba1986362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c5578d10d0211822add46b7abab1a57

SHA1
00b1e9da00c85d7b2ded11c2efa5144d5ea9e126

SHA256
95024b2304ba83c76c8ba6ebd8435fe934cc53c56d238d5c4c3125bd319afa84

SHA512
ebd8940daa61840c3324561447f0d273a46d86eeab1b3ad704c00001915063440548915b9cf3f42dda2e79b896d7ccc4bb1791bebbdf6bc0b00be8903aa73c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e1171201baf740cb9a7b7a7b6071e98

SHA1
12ff9e8b8d6d7810fa93a5c9b3b9f7fc636ac45e

SHA256
e31ece7b2b7aee81d5cda737fe39b68abb8c9689ccdffdc11b8dcd6fc717b324

SHA512
76649f52a8c7468b2287181a814a9b0c626c39643a8d31b52679edadc760724d4140bb0cf43b5d1dcf8e39f00db279eec971ec09d1154c38917293740fef94ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59de06fa6b40bcf67d51c7ec5e2df316

SHA1
057fee6e51b05c0fd84ab061d8b0abb09f29e77a

SHA256
5d9a22f94c3a7d534f9d64390116b5c057e5454f39eaeaf0518079eb867dba50

SHA512
a68527a705607500559a672921c471a44c1f8520c92669ac124ccc0da8a4b9222e999129431b6d6128934be2c5d2cce46b25c6fc63719b08aa49f5b0b3c493eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b17c3ddc8e4bc17150708914a497a41

SHA1
f991b5a06afded362aedec99bc03ac1c078d674b

SHA256
8188cee90da1a04ead8612bae2abcb7e024d1e6ffd6c01753354a17c3e65772d

SHA512
22ea3bd75e2168fe294ab0d0f5fc3becbf9b9b6a436c0e5b68304e3d31bc24e9631ed8f70ddc51a9141c9e7db0b976109e5ffc54225f5ed76b255d5e7cf89b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e717580ace7a596c38a0dd6c006c0ccc

SHA1
3fb6d845ac714c8c391a0930383be788182a7f8c

SHA256
8af59301c1d647759ff5e3589c5d0797fca39298f9fd40fc4a893feb701cacbf

SHA512
a276cea675cbddcbbc16a23fc43f1486c27db0eff7afe818ea519f2af03deb1b56e00901eb1b8dacbf02ab5da38f41f6237625d7ac99cb7cde5f4436e06d93b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef72d2f11fd1fcad89c89c4bc9447cf2

SHA1
b23a740d84ec8bbfe93ac4f79f5a9535f6041a62

SHA256
ca1f959fec03c5dec08fdb984a742b9ec8bfb598940f3997ce4da1efe9105363

SHA512
b7c5e9f9579773bcac86cb23005ae1201939a79eb241f3c06bbe57c4145362607e2f5094db1fe601c230bfdfe1c24af8491a1bbfc423b516a8ba172a6d460485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ead780454745dec822030ccdd3294b4

SHA1
8925c68141e83ac56b6b483425f2119d80f97676

SHA256
f9816e14769fd6809f2e38185d2b4767845a536563d18c70a58a32ab66bbe6bf

SHA512
b981991fb1f25ed3b2d1fc1ec4f8e3f53bae15fa0c3eaed55bf35ee80a5ed1ede9538b3f4bb1dce3cd8a4371457800fded1f14df1d1e524145a4dd573ff7e9ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49298a126b9e98435b0135665c33eceb

SHA1
fc74e1b931429200a1fd344076b7ad9d67e87b54

SHA256
9b842b97933bb5cdf8b5b07998e0446a7ee884324ec5fcfa1a847ca7b932b008

SHA512
7265bceb4dc92272c005c423b6793c94ff95d13910115c849008d472028fb13c9952d5c6099a35f09dc67735c3787dc6a045061be79ecd94a10ccd31f398780e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d602dffb92e738747f355307b72d034f

SHA1
6e91b64dae139ef3f3e728699c187e31dd5105a8

SHA256
1fe9503e4ae2a6a6149a39b84ca85584a3e0970f201cd3995b6c8815783b828b

SHA512
61fee3972ba5f8f6e34ba13f2cda79b00bc260ab68e895d72dc3600f303b21538234234566e1632b91c1b9ed52733e804283bdf737f0298dda2c839217725dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1F2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC34.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit