b60725e6bd93302b244ac82ccc8300e57d3313051d98ea374bf92b8770cff26b

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b726178c0fe8c4ad49760ccb4f33732.html
Size

82KB
MD5

2b726178c0fe8c4ad49760ccb4f33732
SHA1

8b37531550dcba492dde5099748b61a0a552239d
SHA256

b60725e6bd93302b244ac82ccc8300e57d3313051d98ea374bf92b8770cff26b
SHA512

f1ad07cdfafb0f59ca12d263878b806a6a070d46dd4593599d80e22eae0230aa0f4c43f2bab8eeffd686f60a11ade795e7c79257e8873ed78cf6c33da21cf5aa
SSDEEP

1536:lfNHi5nJDWW4l99R0L+3r8UNGtvGBQDn7JewwKYghxdYd7d6dsBkaA:W5JyW4l9zGtvGBQDn7Je1ghPIhyikaA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000233f465be27fc87ed1b9c4729cd10d117a12e7429894f0e90ba386f22238799a000000000e80000000020000200000006a8e04c6e5831b9d9a9284df01d7052989adde7451dcdf3e6749f44b6b6d166e900000000e9219917f448784f4b912c6078b44d267b1f41e81629601eb013c43fd5ed509f09439070ce9fa408af40b1dcf5bf85c7c440304d68a8a393af216718029e707027b9a548b02b5b4b0766bdecf27fdddd2b3107805090524e53788a8e4965d077f7ab5750908c3ed9a33618b1d47d3562bcedd9df70ed936c74c8119112dc8b6b0ec4cb19604302768d4a3b4ad0380aa400000003e67dabb6b3a1152c76ffa9c24b30c820cb6be38040675402d78360e4c83178d722c659a706989f2eaeee2324d1976cee8581129e903df2f2db5e016b02c610c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005c9b6a1430d80250055654c94f526f1347ceec6c43015562bbbe848249fbe57d000000000e8000000002000020000000c7a3450fa8ed39266de00ea8a738f415e847f3fc6c38c00ed9e73125bcd88259200000006bf6223f5aab829cd05516f206b23e380e7be430074949721bdd9fdadca3330740000000105c2232b0923a81793ef520188f09fffac66a73c934f66ffabd79c14c470f1fbb0885030bf3a8576dc7808d0850f23386f6edfbe3eb8383229f8cc1089555f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BC38271-A958-11EE-A5DE-CE253106968E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0acf8f5643dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410352507"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1672	iexplore.exe
1672	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3056	1672	iexplore.exe	14
PID 1672 wrote to memory of 3056	1672	iexplore.exe	14
PID 1672 wrote to memory of 3056	1672	iexplore.exe	14
PID 1672 wrote to memory of 3056	1672	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b726178c0fe8c4ad49760ccb4f33732.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c01c85c9609567b606bc456e52074ae

SHA1
95e331a193ee4a1147242fc50f1dcdaabd331ebe

SHA256
ad4e7d4e1c8d72af3bad82cc2d1f64cc9c44fd9f3cd592859f9c542a96c2ef81

SHA512
cc7a9ee9dee0bf148d80255e932da58822d7a424bba723e6f0b882de7a8c02a190842bbe7ccbb5ab1e0d1044d85e71e7328f5cbd67d17009d8c5f7efeb1b4ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f734ef94115f5259f6eeee40019f737d

SHA1
06d475c93220ee7708a928b7524873ce15c2b819

SHA256
57c396b65b29956b89ba7c299f47381c8af97a01c47f14fe8957da072c891cba

SHA512
f68884c8cb34956de0352e10c34acb5147c706c38d6af4d5ce6fdacdecce69488016f344fafc878143aebde7c965bdf3d126f25d52a24e88ba301623af741f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a249d40c542ce1b4c1b71312bafd7870

SHA1
c0b6f2ced47874e16dc812c0918b29c683675351

SHA256
47f9163fd7d1ed8ae8efcf281759ffb01d41ebedc56deec6f59372a3400b8e2f

SHA512
f0b681771bef6cd7c0b94dea6ca522555d2916783e3a61cea3ceceb76b4364c08841b720ed59249415c328f1866349194889ba92f6a5341a29beb6953e872cfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c05fd1dac2025b234c3242c3b496739f

SHA1
df4640bf43af4c467c8b632f92c730e5e0aba209

SHA256
fe89b95243a006c710a0e0116d87c2de0037c2242d6fa668c2bc319cfcf4ebe4

SHA512
49a43567c7b38b774eec16c9a47623db02ea03dedaf8ff12471d13f8bd45981b1dbb2fbd93dbf3e76730b2b912bcba4623002a1b600b84874adcc753d53792c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be25add78649bea4cb5f7e391662048d

SHA1
b5695e641f7072630184496fbc4a828db3de9264

SHA256
70bb2a498fb4efe81ba31bf3d2b2ce6088c53aaaa5da77a227b0aba1c02cbdae

SHA512
4b18de06ca967bf7378c62d46ee2dcdeaef7e6113d6f0c34daf9151e82ab76ee74c8084cea0a612f869f70b63ac19f919ab4ef9c9d4f428bfb179951cfe57acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2d5352eece6fedb32a9b15bead3985e

SHA1
deca686d553f671fd0aea146e9f38b07875ffc4c

SHA256
2542a31c3ba0d4e9807ed9f56f8aeb02cbdb61885ee5757c296b6f26420f5931

SHA512
b91522ff6d0693645778a2c32176cef4091a7110cc50d362f331b4d075ff4756ddc6c7865c2844410d806d19a3fe811caa291c13aba7c4b10204c6ad2f71b2db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98b4446bf05ce5d56aa31d0b6cc6fafe

SHA1
1e163f2b7b670d77e293b15c2179e884bb552841

SHA256
75dd364cd51b3dc333dcd4e0f04734ce15eee103c9ad224a4b3e2d093075e167

SHA512
50ad3a4caa468d7438fa305fbc7a473afb630da41956d8960b7ebdd6c0b60176f4db974ba7bec9d95212dc92063a229a897649fb7f1b255564ca47eeb530f3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe8af5a8941c46fc3465b3fb90ce292

SHA1
a6cc067445042b3e3931096b785fe9b713cffc42

SHA256
6880282a824edc88e68c48701f77a93312b4da4dbdeef31818ecaab071bbb92e

SHA512
08e2bd7e90885aebf4e28dd90cbde5821452f9839f948560165b270067230525e2a1d1c3336be517d6065395beec779b0b00c40d3b919a196ae3172dea2224b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8c91ee6c42396febf63b47f13684474

SHA1
12986ae67803621126d6724c5f219223eb1e8e01

SHA256
a46909f9581f29181c8d8d37b25ae43bcb0b19a0bfa5dc69b025943fd0ad2709

SHA512
b8a00203b804ac9d706a1ff9a9372da21fe082a4d71250b0392fa12e69bbc84f28ce3ff0ce7b3caf155dab79f7931bb76c906d0f6f6915bc9e18457a835603b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aabbfc0e5c694d26846a165a82ad21e

SHA1
48e1ce2d2c86dcefc17550a696ac472337f207e0

SHA256
8842778dc99bb9caba0667f38ff89a1302a6c0c5b737737ae29584551c84a040

SHA512
b0fb959cfa627094bbaa90e7d6cc40042f30dee27f5f3d78021abce2e56c33925f436268db009d5d4abcb9fa09549d3dbdd3e1bba3829d6a43760f777b259a4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d217324916108e9914041ac4e253463

SHA1
ffc005017536be1f16e6a433b41ba69a2520527e

SHA256
034f36d3853b5552d6ecb3bda0686da5bc9e9edcf029b1c2f17bb62cb1759aa4

SHA512
3e53f004b89a0fd9b2632bd2c9542ba2986b8698a2156ad4ba070961ac72c0e79932cfa19f521cb842b0f8f5cdd30c51634f5b32ce735f15c7a25ff0784c6312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4882a0224acb4372d9c11629826cf8dc

SHA1
9ba59530d28a3ff92efd3c85847a751c2f67df9f

SHA256
5f764029136061b2294ee719646f14da7d805062d1003797a5468a682674428e

SHA512
ef6c27552cc3e90ad0e1e837987597e28f010b4c7f22eafbe3638f58487d2ab10d4752f7922b334dbf5e80f1a365b23760981f7d1fb6d5b60a28796919178533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c88d7dfbff24ee6835a59f98c1e5b348

SHA1
cfe910931d671d31a93d3eb8e5ddbaddefc9f390

SHA256
150a1cc98b33c4c417060461e900659768293ffb80b7d81276173f89befe52b3

SHA512
2724a6e613788e92aa376efb3a4faa670973d4772b26450e1414ae228695903b3953982a7a44774bc08b3251de9f0deb852fa15d0f45884a6aef376117b2ceb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09ee980779066954ead4f7cddb80e019

SHA1
2016e722804f0a4db53913da0864babe57558c47

SHA256
eb5b53d0c48cafa5b1f6ef7cb590b6cb8e185a0d1f73e98240f8626b7ed74193

SHA512
44feaf3ad17ac5aaedee3d56c1c57d6ea3f67953ca3e0b12072a461012465be4e6501f337aa3187989dba6e224f4fd7ffd93b8b115db573d34d1146401f63a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05dc3bed15fadce8de81fa7b039d172a

SHA1
65410840965f34f61de24cc2cd3f4f490b8b7758

SHA256
60839f16d13f8843a93c1d18a3f207b45dd7d711b3b99e4cc6d97c0975be8930

SHA512
91b13f3447586ca714839c8c06ee8c01f30808c83d28b326f97fc89a19968bee4e7fdafb180b80dcf1894c1ca7d2a417654de3b6b70e175782c40385f1ddfc4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit