85f19848d904e194ad6297f320d6bbaeebf5b6c7fa336ebfb868dbeec51509f1

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29f157aff9e4e39fdde6947164b0ffcd.html
Size

12KB
MD5

29f157aff9e4e39fdde6947164b0ffcd
SHA1

b921e7a7201a40571c44b69d93f6c3991ee6829d
SHA256

85f19848d904e194ad6297f320d6bbaeebf5b6c7fa336ebfb868dbeec51509f1
SHA512

76e9d61adb65c018f61312ee1d606b2c04b6f08d45a06ecb67b72534204c93d8530d0fb0f3c0c5d7304236b7d8a47b36645abbfff74d3b5dffac4c5818b6b1e0
SSDEEP

384:xy1R1QREDBeVliO36vU2ee7Io486XhRmY35QCPRrMO77OM0TCtxYLuZ4mXYHbw9D:xy1R1DeVUOKcz+Io4jV77Ovs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5F30911-A944-11EE-9776-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ecb347eefbbce6e4517601572de18d9837b189208a92cc10f5f4e1c94f512ee5000000000e8000000002000020000000ce7f0564d17b88a5bb498ca9830a6f1f57022e4df9841ddde3c1eaf461287774200000005fee20a55c084d22e110c1319abe107b26ca840f3eba53c68625514689ea46a840000000bcbc75d57b46de1a0354388e57bcb7af5a498edc57e906261c5723bf175a9654ea4c25d368c5e67db0c832693330e2c12d25100c0d787c7c729a73f6fca894f4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b088308b513dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000d0ebcfb7351c51f8836d58ab61ebf539292773c1ec753157eba5322e0eeae3bd000000000e800000000200002000000031aee7f183302f03bca7565cf98c8e4bb724e735b43b6be554097ca1b11b571a900000000a5485996aed5d40817a5114faca42b1be328f24bcfd58c2cdbfd27f390211d0a13193a730fe92fc50568bf00b844f247484eeefbe2aefb7156bff01d9bba5c2b884cda43e36bbda6f958bf2cd960048a4bbd49739f3239238d4e6bf1fbc0ec5b548271aedfb15191f83731b0a6c99cc55a9eb243ea8527ec8d768d642cb4832169298ea2807d592d80c8cfe3f7be266400000004e8ebd7f98b86feedb6a1a05dbf61333e14e015d3db18b470c9d924713ca160f4be3ec92da1ea2144f5827762041220e6316d81a3f860c28e8629effada3a798	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410344184"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
844	iexplore.exe
844	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2472	844	iexplore.exe	28
PID 844 wrote to memory of 2472	844	iexplore.exe	28
PID 844 wrote to memory of 2472	844	iexplore.exe	28
PID 844 wrote to memory of 2472	844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29f157aff9e4e39fdde6947164b0ffcd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f441441fdda35ccf3075aed9a8d15817

SHA1
ca09b3d25d2eb6880415da223af2a1484a15bfac

SHA256
6e6b8f6e4abee3f8b1345b4fd6e30692f899c08127badd3492be90ea1546ae0e

SHA512
bec8ca079dbd1536b531a5c3883a232ae2b1742c94a9cb0b618513650e5255be188030a8b8891c52292b3f603074ed032482755f9b54427facd668cfc68a755a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd078ab3b35eb0297ca7d63c00d1707b

SHA1
1c972fac01be83a7f6b6032032a583dea4b9403d

SHA256
58361eee4763937ec14539fe8cea85150e6581269ee97a55066de948feb9a388

SHA512
dad4244f6b2c5577dff867bc8f44abf5afc1f4e510d876ddc474f0b9291116f87dadab4b526fc28fc386ce6fcbc10a2f4a659777f8e21336db82e3be0f9ff817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fca885adc14c81811f902f36992ec95d

SHA1
5fc645919279443e53bdc248b24abfbdd8573d6e

SHA256
576a8b22cf6a8325f80a9723deaca7df5b381bbbcae332f0f2a2b772ba4f6027

SHA512
23c4ee2e81b17589c387943f64b945662946480761a27c9d14366e29cf02b95ffbfd854436b71e5717e56ec9967b45c4b254872eb10204d97881689ac2613811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
101ee337d9b3c7c74378cde94ae68d0a

SHA1
e271c24b15b1d933773a463d5587e50c12e41889

SHA256
bb14bd597e1fbe5c9baa8d3331c44eae13ed12a65a9f69551e4aede8426e280a

SHA512
5a90c8017e8384bd2c240a784c40db0da65f77fe6ea812455d1e5cabea3ca5c9ac1ed19dd250ff7c2572a67775b5a64aa36a226d2047770915e7222cc834649f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0040c65ee6ccdac29fe39ada7e164e52

SHA1
12d3b9e35fd9a1a89783fc7f494b8a72fa9b05fe

SHA256
03790758c1764f96824f64c1dbb0bd4fa5d31e98a6428a6974b405227a9adf3c

SHA512
7169fb657b2d3fbc0ec811f16759174e2cb73fdc05712afb8b4fb82144b3e44b3c6ea601fc93eca860338e55a8656a8eec0baafe8c4951c5f08d36a0b3f6174d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa4ef3ad004e889c31881be1202b83a8

SHA1
ab01218558fd3e655517020adb52d5dfebfbe8c8

SHA256
ddb8732ec2115540a814ea721d1e35fbe9df845535b8621d3f9d191a9d6453ee

SHA512
a636793406f8a1ec2cb6659850391370e150376b8d1b9a1587a14bab367b87638d6b63521c484e791b86968ea7e74cfa477287fc3ba07fbba2618e78b4fa45c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
822b8c69e26c3b265c3af28a06a89fcb

SHA1
4cae4451164ad156d55d8343eebe1f40f1297dff

SHA256
4445002d02c86d003f8f9ec5c5cc61b99a54f20f225f71c3ad5ac1317eec75b3

SHA512
c9dcceca3b901b0745d9abd99652cb8d3092f8d6620d2426da5c800bdcddc95b10abf108db4146667df35211a3158747fd3d9635e337e1e09f991e01ca8bdfe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec72d14dc640b58493ca830bb3e146b9

SHA1
2771cb92e521630751750f1bf3065f29ca3bf846

SHA256
213504bfdaaaa9df72d9608c6636f784210e7f83308766c5fdd068dd561879a6

SHA512
efb4bb25867fa4a580eb58989c761f73348cdbcb3f4c8bc3ae563646a3163c13525b46ecca6b66980a89476ad91a65842a0b90727a455a6653d49b0cfd7ee8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f053892c409739ea25c3874b82c76f7

SHA1
afdf778caf0be5de76374b9c337869fd98a0d989

SHA256
a71f6e40bd72cbccab9616b447c38f6b5bc0c0fd38e0372d40920f4737eabd3d

SHA512
e6ef1a1148e8bb057f9b479772af73a7f015b68405e8cb5f2959f9b8fce357654879be755d51774b04590dd5c8324773ecee31e4d0bb73cdcda447dc3289d870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db4ca96fd6818adc0859bd60cac0ca8

SHA1
401c5f5e0a54c4d1c35798c8ab21c66414a057af

SHA256
b03b4d6b890ad8b72c6b1c4a2bc3d8554919b0193efca2e485df7016294e395a

SHA512
5a3b510a317b9b68c71448e69528dcd90c794f52a2c9eb3780e7c2559bf42c430b3530567fee9902436f911994b4fe298a72588c423cb708e2e34e79541c354b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b952a8078982943cb8fba4c3e2d632a0

SHA1
17f67c0674e7d1fd1d1ba8d3dee3f4ba8f04b8d4

SHA256
e89078b965049db128b01d83f1a122d059959fefa83a420e9c087befcc8afbdd

SHA512
3853f60af9784fc3d4e642995289b28cd542525155dced44718d22118fd12046c79f5d5df1b8fd8fddf9d4e3312a06050c22cfb4df4c15c25e8e8d0e0d8a78db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52e098b153fde1049d1ef5d0965074f1

SHA1
31076cc64199b6b2c2f7cf663f1a5da1fd1acc04

SHA256
8ea93121a215527b28170bd8c15adc9e324bc9636d9423f0dc3d154294f21020

SHA512
9a58a64802ac526c838991f4e81c1388fffa7305a6d32a3684b8d5b821d6bf64ce439272df78ead03fb4d397871ab03c8dd6018fe1322e6dd7638d635a64ccb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7f7a3516fceb510b9247a1c93657135

SHA1
8720203ce52a4df611b6e38042c9ce4dd7570ccb

SHA256
fdb23b98f5b9c486f8e19d5d7a9bd52971d50d3a07a7f08e6993b4418fa6bd97

SHA512
26cf3ec3c997e19f5f9a6d49fdad330fc022c4450285c4b1b209d151b42a29e7ef0c3895cb8f559c92e82689b4397930d827a25d84013194cb74074ce9c67ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2aed130d52edec95509e7361e5ba2d6

SHA1
df3af653843324ffd7f21ce6da2829e37268b8fa

SHA256
b5b7a6e233785d1c881c27ccb77e0126dc1640e625cdb089481457ff85c5662b

SHA512
704c3eda42a9b6fd5813d9d40b8ff2e926d654d3f0d1706290e8825a713047b529ade11201c872137cb3c64ec157599ada375ae476037ff6e1d5f0ec030009cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
116b2e37bd21c653db81ebe0bc283079

SHA1
70af90145b4e47ef78f608ef743fa50f795a5b78

SHA256
6b49aea8b03d370ea3f7f3a843b4d8f2105b275aab0c3bc5f2e767e2d49e930f

SHA512
d7bd036981d0c0b9003af4cc80e7814c40dbb8625b8dbef3e9d37f04a3e96f7fd8efc93f5c0d2716fd3d68c408228b0b9d73dbd17067e1e7e8de3798e4c72ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D5E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5DFE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit