f29fe22e0a9a008517407be2d35eb63eaa384d4e7dfcaccf058291559eec1a91

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28caf2d14f24cce169fee898dc2faca9.html
Size

161KB
MD5

28caf2d14f24cce169fee898dc2faca9
SHA1

55ec0312b1f26dc2e857abb082eb79f0dcfab40d
SHA256

f29fe22e0a9a008517407be2d35eb63eaa384d4e7dfcaccf058291559eec1a91
SHA512

8f8ae150056afb59b593ec90d7bfb271328117fe27213d30764532fe1cbeaa71b98c73164f753a87ed50b7f33848964496adc2e62b4b9ad12d59a2496e35a47d
SSDEEP

1536:LIb7wDlGBw/a1fIuiHlq5mN8lDbNmPbcNyHcp6xnF2:LIHwDlc1iT5HzxnF2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D89A9AA1-ABD3-11EE-B517-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fbd5ececb30526c905de7ba6c2e43622e741bbf892979591b9adb33edc21910c000000000e8000000002000020000000fe8cc9ea311f2b87b57a69ed1381098afb135e59837d1e2064611c8b0c03c16c2000000081b02762628cb762bdc34782969c1894a02de09542a7f2c3a295d994a0578a364000000088a1b8598ca3fa4881d94a460305ec07b49775e93e54c77405c347001db4357dd83a1071ca0d9d91ed8ace27891eabf52dea216ea0be36ff23c0a67247b69115	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06970b8e03fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007d6dfa3cef9b3e4a1468fbaebc11c9e3a6df38a34e86bcba64ba1691f1241df5000000000e8000000002000020000000a4ead72e580c3724641686facb14f63e5b533fb859dc643cd3b948ffc2f67e2c900000004f448a3666ca187c24f409212c02a96a8f0d4de2c61613e2825a87490bc1e6203fad6d0f8f77b47ec4ec9e8c7012c474dacd26132297adf69458b06a9accd336c78e8f4f15d815b758d17d2dc671a0c9cc8657c3370272cd3e4e47a60fa34cf7b84c34e3a1cef47137f61773526ce9347063fc03e345788b43924a6470c94accaed412625cb12effadce2b12f7d375b14000000082dab899557d8aa16bc522c93901b572af6a2c7ca6feb6983f903db220b3c14192e653790e301e7ee6e74a5cec02257b84afba9e2707309f96d1e1ea57412a21	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410625559"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2708	2124	iexplore.exe	28
PID 2124 wrote to memory of 2708	2124	iexplore.exe	28
PID 2124 wrote to memory of 2708	2124	iexplore.exe	28
PID 2124 wrote to memory of 2708	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28caf2d14f24cce169fee898dc2faca9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
407e1d6973bb0cc7b35e4aa3f9823bdc

SHA1
35b5fa84342c0f4d2f59d573658a2044ef61e0a7

SHA256
afd92c73833d8bb3c59131d20cae43af53c65c1b7afa29e9a2f49bcda72d076e

SHA512
22ac5fa9d2154c1aaafc4836b8917c257e3720cc1fea4b08cca320ee9e3358d8708abf5ba02ebabc994aa3ed34aa64d3b294192315f6785f217bcad4d8056a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
29cad99c9c3f68a402072669f11641d6

SHA1
bfcca53fbc688e88c4fee441061b160dd9f04ee3

SHA256
e799654fff11c49fc8254f1e53269f15bb8711e064d0340de4a5473db2b72ef1

SHA512
28456023d81fe5e0c0e5be6814cf946d33c08bab95fb95cd33c540ac64202b33c85b83f33797c46a3d254c3881d5058398469a188569baa5b840f085ef4b880e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05f78f232f637ab293b10ffc469bce44

SHA1
8dedfd478995e28bc7459318250b25021ee3ce04

SHA256
726a7fbb4cd1a30d9534c15bb75ad2d943d85c1c1d4bcf8477427babad82711a

SHA512
b5b43a2e060a10828c8df9a35adc62f6a19b3a1b458d2879e113ec9829d2f106ac53ed5958c8bdab0e9c947b7f54c5ed70fe3375e4940351423a91753be44c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21c8cc06a5390fb4129ff4120bb2d6de

SHA1
c77a7c336d592a34f14369142f9c1a0fcabd0221

SHA256
effc41998e020561aa37dd5eb3becaeea886b9400e9a1563568f272af2943d64

SHA512
b6d86a02b7267fce91097dc9e88f1292689121d8e03ea5140dd79555892e1aba494c95d6df6f2decc30ff7476c8e73c646c66b4a87e2fa2c8f053ac6e1d612a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4b5b7fd022e5f9c83855aec5288ef22

SHA1
73a6251bcd41879a2af695c2e5992adea204116b

SHA256
b29bdb44889197ec2046f9f2d638e118d0cffde72b2230ab714092e91756de62

SHA512
726811a2f361f8be3256c969a6f5f43f32bb9626363d3e6854d204bbbf8f46f46493f281561dc02b9c7fc3369a4e5ced29c93f6d5e9230d706b8f683017541e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4991552af9d2b9b430fed934eee23fde

SHA1
c368c52da94e6a4922fc42c3b04549a390de6ca9

SHA256
80df19f0787825bd1fcf9eb73f690bc5a56d27f66073c02dec47617cc70e65cb

SHA512
05b7154d827cd2ebdd8dfc79e9bdb5d282f3fe0df23941b1d0e08275ec1efce6b165a3566be918c86d04ffbb68e76a83c5c4c822aa0be61b09e81c98e677ee15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68b794b3166ce75d5636a21fe3042761

SHA1
c88eed549b1219705dbdc798649ddbee36617f2b

SHA256
29de3feedf0cbd55fa1e6e140ddcae392521593cae1169fac39979bd4ffbce85

SHA512
837ce66740a684987ea8e40a440619248e248e2c44dc2f304506f4a41d2a8fb1fc1b5d5fee672f81265b5557c594b597a90ace4c030210ebc3c8d54ab1be9d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f5f1f287cb0dd308a03e1b74cd6755b

SHA1
05e98b8dcb3c9f71e4c18fe5d62e87d3a8653edb

SHA256
ebd4122dd8760a42c325a5593995b9c9a781c054b9859c9cf11f6620aa7f0ea6

SHA512
5698394081b0d07ef8c43c35d4adec7bad4b86910a41e40c6f26d86879ac17fd889c76eec85c1aa9c5d9d36382b8b96cfb66701b1251c2026277616093ca972c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95561ab1dd3dcf9660e78bb20a29b50a

SHA1
bd504f6c926d129cf0caffd2273bdc3b4a73cc94

SHA256
4616984bc679e4196ce5c77013d948a0e6912062cc58e54db0e2461fd9c5b973

SHA512
60afe5350ef9511d046b75b42c4431d11023e916169b5ad012aa9d2e7f326c843b59e93a0a253139cdb8d199faf1852de4be24c168fba83ebc586ac38b7524d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb5056278ee14160a669757fa44a564b

SHA1
e38713c53f032dc94891637ccc7ccd3e7f273507

SHA256
6ca21a11d4d24ccb9add08dc004a19f66cc8e673f370c13f0e2a1e4073e83671

SHA512
df3723f671250165a408c49a8feab30e2bf984a933e80a4acc937b09fc929e6bb9422b0666c67a7ce6e5dcb48712417710efe06d4548a991b7fea437dd43ad66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f3e9bc4415173e6107b62de8e113f76

SHA1
4ebc750b55f67bb100d613d504259b73bef90494

SHA256
f2714e7958caf56beca7c1056023017305df771cf87385fb67d4cb7f29a1c5ee

SHA512
ed8279e055850fd41273106433fcef7fc9e45be558006ead7159e8abe9279ca020bd2dfb95fc1d2900b10757e188012c2c263651b626b155d87c5034e697ad47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540647b33b0df98b912db4f37f6dd81b

SHA1
3f42e60a41ba0e25aee76cadba7c18532a5b452a

SHA256
c53dfa44d586d4f607982f707c37c85923045db7f5d34b3025ef3a592591dbfc

SHA512
a17a84922f8b5d65b07e93fb3516cdeacbc28045717e9172b6d9c835645a57f816f63de4af0830d22d1610234a12e0c82265a3b6c7328ddc90e6630cff6fa8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1401319263202a154aac9b98353750b4

SHA1
b13b8642359a2ff3257ac120c8672cfcb508c900

SHA256
b46a01aa03a4216076e636a4f67fd4cccfdd8777ed4ea4b4141a109bd739f024

SHA512
39b88cd4e49d73c2df8651563197a15ade0632555d56ef02147a0078703127329cc325258bf70cca4474eb2e85def5bd2b7f896a327243c44819bdd5e14b947a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f92ffb9e66af125bc4b79bc74940a9ed

SHA1
0a8958f95e815ab1be8fdc131f76bc39eedf903b

SHA256
4c1b9eeeba2b7f02130f465ec6fdc0e92a50ef97d615389a39dce8b768e41339

SHA512
4608c43b5695a550e23439934cd1f764bf8f39d4e72bf0d1756a1c286e9664890b2785e438f914f18e8cfd8b37c80ae55c57b176ea193da82b6a6c42be576c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8436e9f5656efccfa48cc16dbb5eb18d

SHA1
de5b2d95956f9a295649e39f77f0712a91ff26ed

SHA256
875e87bd9bec47c257e3d260b0be8e0af85109a3a7dffbbf1ececa17c30219c5

SHA512
23434f33734f51a1374a26a11961c061b6d38fe022125bcbed7eff52de2308356c4f7d218ed69ceb305b323f0bbb47f509d497f6750a689b9a2e891124b2e6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9cea213e88cd61d4f5a654246ab3624

SHA1
5b2892a192aadb11389b0e41b42303a2bb4dca3a

SHA256
7be424dbea50b8fb1fb9c008fbe05d96a4365155b3a9b057486b03e6bcae53a2

SHA512
cf08d7130fcfdcde13a3fb32278d096681b3b40284811a51f1da3dcba07b71256c42e0f5ff49458da9351c36c83c556c50b14e781689bdfbf50d9d8fb2d2c114

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F5F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar805C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit