46a60cf6041e7635dc2d9fc0dfb644126378498d9d674a05d8fe380bc35a8ada

Analysis

max time kernel
67s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

297497b0a5096b0828b4405e6fbf9cc4.html
Size

432B
MD5

297497b0a5096b0828b4405e6fbf9cc4
SHA1

228204acff682111e100b0c0690d52c630206dfc
SHA256

46a60cf6041e7635dc2d9fc0dfb644126378498d9d674a05d8fe380bc35a8ada
SHA512

b6777ef0e71bad831db4c617af2b95d7733758732c1a9d90882f892b5b23470a0ddbea41ccd1409186e850046c6800c77dcbb38b45ba7f7d1acc36f609ac39c9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000006aa8a1e8cb24fbf38f6cafbfb60a120e79885fb6f43dc66a28743332473e1bc9000000000e80000000020000200000001766c2b1ed13b23e03f1f50f4f70d0cfaf31a2e3ae7a61389e97b1753ed3f1e020000000ed17cc83d1e369ede8b281bb43bc2b9f0be0232e51d98d22e77bf70f2ad3bac4400000003b29217f6bef6a765c8c77959dac14f128f1875f9e56290e1f7ddf45b683bf8f207ff478c48e6321fd71c2afc68b03a2f0c8a8d7a69330e37d06db56f3db6cdb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75AC2311-A93E-11EE-A2F4-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000006d68694647a9b296989455d2e267fb6fcd797af5a78453cc3fc8fa4873cd1f0c000000000e8000000002000020000000031d4f71e771ed6d4be39a12c777737dba95ba4df944ee1e47f268b0396926ec90000000f977fffb3f847aae82145624f3b1b01d606d8a235336c0c527ff3bff810ea950759742bb821e45f3e968508a04607090e83f35a09f707d7f36a6d8375022f383652657b3db2ea18acbe96d03081f85f13c9136491bf72954e30066afb44d4185c14de53f55433bc2f248fd26347305c1455d4bd57f0d83a5dab2dbaa6bfa29ec062922f4d6477f7f295e817b570e5604400000002dca94edb6e6401f4e0955ee1412ff585324485d54a3d89692905d469672cd868cb48e4c1bea315f8ca2f71532eaedeb97a4bb4666d134b4c4623de8774c7ddb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002acb3c4b3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2288	2240	iexplore.exe	16
PID 2240 wrote to memory of 2288	2240	iexplore.exe	16
PID 2240 wrote to memory of 2288	2240	iexplore.exe	16
PID 2240 wrote to memory of 2288	2240	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\297497b0a5096b0828b4405e6fbf9cc4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee0f22891224cfc528dbb29e4f9ee672

SHA1
36152c374f8af892628214acb2d3febb4fc862de

SHA256
c1ca1fdf9f25e67e293427c2e5cbda20c3d9a8ea27902c3244665f540d8c7314

SHA512
010c3b0650548d3505af7285be46ca50a85a24a98fce9df3de0fa6a7d91fc964cc57eabb850e17bd416dcbc05410a90fe8fac74bb533f8fd8534431b42eac7ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc8ac197a25fbe39031ab5a27a283f75

SHA1
49ef2fdaed10af01f9a6bc07ca08f252e15b94ca

SHA256
e63094595837b1f96b8230a685da2a4e6436601c585706b04cedbd019cb145dc

SHA512
8f6b8b3ff9933587d4dbc3f0273e52e1698c09cd8baba910be040ba3aaa390b17a3efc5874ce861862be97d87c365d58354d7ce59f5005f67ab9bf37ef955f55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adfa1bd4ee44fc7755da05fd3a262530

SHA1
e819c6e6c3ba6840361ff3a52e6b2e5c913e9600

SHA256
a6a803390c3b724049be3ee55ae2fec8873ce4438782c95d0b1e7899cd885d3c

SHA512
27ed51accad523dcb29d3958484a33c26233ed5bfdcb62ec06748ea0c518e050482ad6b58c872260c3591f5a0f77700b0d39cde8bf73068cb14925bd74f5c998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
904a74b5bf8bd065e0de236c211d00b2

SHA1
773fe5f58b04b8b840d43c30a7cfab1a8c5d0bb6

SHA256
2a81430ffa8517facebc70c4e586e8504b10efb33986fdf0f96d04dea8fa12a2

SHA512
30db6e3987aec600f0577c9b26a30cdb3dc7c984fb0916dfc0612a4532ea59d85b2ddc68b77c59ec267c7db6a3cce23c9d45cb0fa62f08be6a599808b9b655bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ab75baf6628ce0878ed9aae9ae592c0

SHA1
7111bf360c0ed059dde62045dc6edde4fe610275

SHA256
cca3e830f3ff75ce026a1ff77e9192db39e9d16ff01cd9cf30d39b701045ef6a

SHA512
20fa8df188d760e98c5f4872f99f5fa6c623168bf7400c56a706984cb12dd20992b5a29de880580b868a09a17ab3dbaf7e10a0270f0414196787109eba4e8621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9212d8ab340e0afd7bf7547fd493eb45

SHA1
e99999f12769ead989212191f24ed97ed9a17bf1

SHA256
24046c36f10cdadd43b68678907475bbce2340bbc562016e1ecc9a28393cefa1

SHA512
3e83d0c750ba42ba43d21b403148d8890fd566a2b34aa67e03214b8bb1741ebf9bfbe9be059b15877161369d9c617fed6e8757893f7b7eb55fc686588352fd3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3637eeb8b944e4966c8a9ea05bac2cec

SHA1
135ba1e82a13713ac557a83519110f4a0305e5fd

SHA256
1190ab4820a7b891505c8c205b6691670d86bbff3f3bd8703049e6235e89d8a3

SHA512
18190414929265f6e1a990912f6c7f3bc28eded75f494f7d2be346cfc56b858155cc968d0018232d412bd309cad1cc4b4be31eee9bb044775fbc70df264c1b42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bbee35144e4b2749660eafafebf2c36

SHA1
ca6453e80a98cfae06f8589b4a92aebbb3e0ba5d

SHA256
fb86d373f43ef54bb7b903dd4f7fe9cc69017df40eb95b36cd301c7749dcf0ba

SHA512
17ff2c3e9b82a089934b54893bd1100c1d21388b5672321e0b59230c8f8a6be333810c8a5848edbc065e33096245c93a2945edd50a5f457baa6fdd836a5cb090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86cb2f319704c5f4a78b10083b5c1369

SHA1
4337923d7a0b81546c5603bdb8cd32aaee490019

SHA256
9cfb7144e5c3b11be00036f748837a0352f1d2bfdad93ed518bd6536dfb60960

SHA512
dfeb2c20ac6bf3b310976e708404c1a1c71adad5d40de8d90fd214e5132129bda8350f459c799c42bae330ac85ea0322bcefd15266ade821bcec6bcbc8164ae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa7851584babdd5fdc49ad24f86416d4

SHA1
71bfcb9dbc2436411c9364da505a37b75b5ffe79

SHA256
f80249b793ef2089d46058e699bdf6ff258ec9280902b464c13a05b61c09b092

SHA512
ae88a7b00379773fef37a5326c4296770b1f5ae53cd10a6dd643fb80014fd9539bc44c6f97557c4cace1d9e8f4a1df5d1cfd7e043e75098484cd5b46a0a5f039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a30986b6eee4f2c2fd0f865354f9cbac

SHA1
78660da86da5eae876f83ef9160d99cbdabb1e22

SHA256
aaa1238eb7807b863e6057002d836f25dccc7d9cacfea8717317d8ed413de2ed

SHA512
d0c3ada44ac6e00a4359dd2ce05e18e20503a6f2f7aaa1da7470ba69e1b9778d42a5a2c2c0e89b7668af894cf25f4da50752d9745ad46ba985e03b436f779533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b624f721faffe5689fffab903a5848a

SHA1
784d76f07fd73427f4b23a9e7e6339ecf0e39936

SHA256
69c9f7cb6aa19eb6f9e8476298d73381db2bd37ffa00eebad946a10411ae0705

SHA512
5d8b8890ef03288197b7fd983de85d2af1e72f2cce1988704461276a4d2bd233f6e9d945c514cdaca2ec9193418c7b9c4a16e41b405c7bf2d08c00a2e1d6d42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22fa36bb5ae17007bb59e21f479f2996

SHA1
12e69f7a52361da18656dee6508c7c2da765b0cc

SHA256
1d82a50c51b94c361cb2bbe94221267830f71346b9e64f36bce87c75008ca88d

SHA512
8c631f226968825c0fa840a4b68a8cc49d4ff707c338ad08a6352446c9c605156d23da7e27032a3f01b8e1679339142d32352fb59543fe1b0034aaac27dd5e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75cd13b2b1050743e8155b05334afdba

SHA1
fb60661282ea5342dc3d24afcdbf906d76c4f1a2

SHA256
4d4e3d097628a54480fa94e6e425b5f4858dfeee8b57066287faea48f12369a4

SHA512
754e9d6d44f546ee12ceccbd417a8d3bed4dcd24afe42e525aa11605fae60f8e9ab5f2d61807a6c9440f3832d7bcb3a92122e55a560dad5ae2feddcd76212c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
7298d4b13f5b4dd27a653f5885c0ba7e

SHA1
e9fdc85897ff13f604359cc494b4de7c3f17f5ba

SHA256
759793237825d1ad0ca0ccb138663d331d5b4646a9eaec97206e5b53c3c7a8e7

SHA512
2c074960aa2d692d68df461c4b9b6be08e62cfed77fbfbf3924a6df63cc06706247efe5c2d447df369537c181b7e846c46971da3684f418faf98cf93a8d2e86f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2s0hu3f\imagestore.dat

Filesize
5KB

MD5
277e4aa708f0944d63628fed5ca28cfb

SHA1
3750d5cd931ea3b5eb8209da61612fbf92d4d31e

SHA256
2f6f50cc6a0179911212bbdb0fb2d0716175fc4ed32bf985eb296f957a0d07d4

SHA512
5a006481ec91db87bd6fcb045e62e7e8ef5308f74d65d6f2381ce3caa2759b658f940a5e8df25d6b97018797650ad7ee764f45763331eb3c12670edebd0fc642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOO61SKS\favicon[1].png

Filesize
3KB

MD5
a75c230f34b9296e6fdd8b0b855df5d8

SHA1
e0b9e32053d44532fb4e8bb55b54c3211965517b

SHA256
8adba20b1dd9747ec8ac6ed5a26a8dfbfc7ab82213d8051b76ac771c76b87920

SHA512
950b94afc397ac760f38f4c68691bda6b541832e1d23f496e36568def2b9f9dcb6984c6a42ff6b5abef0e19b76c37e40baab22e9dcc9360091b609333029b24c

Download Submit