143ddf727d071587c93674ed2d1bc6563031a3788e9d2ff63064c50b7814319f

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ad6b9c5452b1affdf5f78de38c4732a.html
Size

8KB
MD5

2ad6b9c5452b1affdf5f78de38c4732a
SHA1

b4e405ef466e946f7151e3c32cfa829637ee685b
SHA256

143ddf727d071587c93674ed2d1bc6563031a3788e9d2ff63064c50b7814319f
SHA512

7e85a0a5b05d0ea0d2dd60791f32f199b552ebff7e6b5712291b540be24d3248c8850d9f5e4df54b2ffe9ea61f1c273adb409cb0acd3a9965c80adc2b6be543e
SSDEEP

192:ln8uqnGDSSW0nqk7AnJzYW4C9jfg9SfeidJuqKq+W2cQwrUg1r6gIb8dFu:ln8uqnGDnW0qk7AnJzYW4C9cYfeiTuqA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59242961-A950-11EE-9D0D-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f07fb028c313221a28f03a4d897da4466b9e4c8a8212f9b9b19f2a9872349965000000000e80000000020000200000008e13bb72e41c31fee13f0ad455f2ff45e10356382bfdee1cdaf16a0ff640ca6a900000009948091f8aa57a20b5cc67bee7e205bec9205810ebb04f8bcf2704b078fc4bdde9c2b5e74d7f21bdfc0fc610165c37242989191b9b6ef551b338fe643510e7d0d868e1e0112bd76ff164db79b7a6bfdf49f2ed1cf0e509987428171597641106227fc76d0a89dd3570fa6fd29c5860c9b939955addf8cc7265a0cf7706d71fe079874be2f4d12bbaf9fbd332a3e062974000000041d7d63095bce2fcd2f10415d5fcbf1f502237a70f01d01ae37135f7a1c7dbdd72ecaf2b802ba10b9d14f7008381f95d59911e86fd765afe73ca2107ab1e4873	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a744375d3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410349178"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008096b955f59f88398966187957b14ce72698aa9a04e5655df3017668d83e8af4000000000e80000000020000200000002e67e5b4c90d476eb1969721541ab1bf68aaab11b5f9e7ccc8adef9fd07a13c9200000003c3799076172d7c4286ff8471dd9637fdf62452a5de209bb4f3eb0b63a398d3c4000000076736f87029233f7debdb8fba538ffcc42dfba6f0b19ffbb9e5dcac02831154fa1cb77b90544ddcdc9ba2f329b1d749453fd868e33335cfbd855ed02184f72e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2704	2300	iexplore.exe	28
PID 2300 wrote to memory of 2704	2300	iexplore.exe	28
PID 2300 wrote to memory of 2704	2300	iexplore.exe	28
PID 2300 wrote to memory of 2704	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ad6b9c5452b1affdf5f78de38c4732a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
928166791ed45c3b9b692f779564bb25

SHA1
42b91d2b01d98ba29ea18328501f1fb6c6fdc366

SHA256
a97fd508109fd412b0dd054e965e8ec1cd559a6d29d7bde2ad4abe40421e7865

SHA512
e768f5590b67acde13dc9570f02ab7ed83ea371643fcf9ea46fbd9c52ac2b8f3d358cd131c73c1beac5f7eb683916ee6ea5fd4ceea8ff4c211c1a64d95de0026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b96103424116dd3c40524552cd77c9a4

SHA1
e24a8ee7ae08e9c06d70e33bdc477a93f1025121

SHA256
c0a61d9ea31fbdb8217865cd12faffbf7584709aa2bfd1a5f0b1109faa7cd365

SHA512
1b8312d05f843772ada14cbdb8ddbd09e1360cfdf8b7359b67e4a2626009d348350b3a235bcfd0a7251d98c15ccb117f1eab812b644cab3875a71ab7f9f4051d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
394688e25411e0d0cf29250a6e08b21d

SHA1
129c38c1bd1f6057fa6d1582dbf7c36ee0e60513

SHA256
c1038ec7f2675f8d42248dd1502cdf70be093716a763c02206e4f1f8ae5308e3

SHA512
0a06ed1847e8617f75f1f82f0934f04f41cbb8ec0d2b197aee7433921469edc3a195c00ea6d7d8040d564e9d79fdebba5369c60369de1c082891ed40e63ddf8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f078aae78ce03557b18fd07b68f780eb

SHA1
a3ea20f60f2c5155fec5124d0c8368d1db132dc4

SHA256
e8732006d9dd0e856f8c18d7676a44c2c0f880ea0cfc8df0615de28352134049

SHA512
ba4dff37ddcee91a4e20c53435d33fd5d5a2f68599d1f192a20fcac7471b30f85152499b88d0233b57bba10d42aa0eab223d57f6ab7c25625b47748cb2d603ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c2316d8af6623d391a7a84e8166317

SHA1
6c85966037155cca3911621814f64337a180f7e8

SHA256
877d67f3958499949d23d504ec35bc1874b9658e84c24932dde8be6e5dfc87cc

SHA512
342b75b4e6bb2024af300a7733e050550a9438659aa18f8c1e73c402ca42bde72d16bdd1f1c8d9d1562115b1c7460bc3fe4f123ea092a4b7f641e8ed6e71ece0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cee8933d35676a5508ab3148ca328fe6

SHA1
7254a9d9e3a9401f19bbbd9d016730b28165d4ba

SHA256
0f0fe6ef4c472f60f9e2794819369843cbcda9222daf647206c71dfc715b1c30

SHA512
7fdebdaed62ea80cbbab72f3b117520d39b474bbefd577b39edc651dba0484a8d1f88c252fd303cc8edb0099932870a7cb3503b24b710566c641ed290dde97b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfe46bd5569827bd5d4b1f672157097a

SHA1
f53bcd5003263e82c7ea08a680d8b74f0fd4629a

SHA256
0e666f2bfb7922646035e18ac44750a51e8a841e6f2dbad182abece6ab5c8848

SHA512
735c4c6e8a70480a047352b85c5b37b50987c05656b6c1e59af920cfab06e389b6ef56bca74a0b0fb65b9ffbf690fde3c6676d2ad0492dd9e1abe996a087779f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81533c67ef0990a1015c0fd1a41105b2

SHA1
d992ce47381520587de9f6106960f4c80c157290

SHA256
6a7ce82fdf79c93198cc49d7317802dec59f64c29d1aeb8b509bbb9359726249

SHA512
7867cc097d3750726b3a0556715f785131a95f9c8d2a32b5807b7326e4ae0fb3cbb23e97338e7792df872201e5f83668ad1db6f093e4cc4f9d7646180ac39590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53aa5fc164948c9ce9c14c5400256074

SHA1
107c2ef6b2f49ba133686d1509fcfbb28731dc48

SHA256
99320365ba82cd1bbc9fadea4a04a866bbb1701c2ebc101e09b4dbf7aeb00556

SHA512
b851bf8038c149ff26728ce3348014ce40a65699c04a80ba7b1f511406ca017c77024b62d3b94cceea932f5e942165365888b9a4b8ffff73cf890895498e6f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c44779f742d6915c76d64c0828c3ff81

SHA1
223f5b7098c575e827e02f797426cbd3826ff1f1

SHA256
74b8c295e01b52177701e8907587edf16b3a1f9f2fc4e5a0a4f992b1ce6d5ee0

SHA512
5efa2bc095480f74fedf47925637c7881ad7bf96838b16001d6988c5c05ba0fbcce00cf22dc0d5dc2f09001188b1f280b4ebd8442b51722a780608e82aeb9d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f40545a90cdb6a23343b75daa891644a

SHA1
a423a4c1857db460c61ca0b9bf57a3d84506c4bb

SHA256
258a7ae7b5defee46cf6c40b8a4938f83d05300aedcaf9fe4b2526ffc1b0fc85

SHA512
fa53c79085b8e1bf7b1ae4cc9487d6f55c1692cce49611b62212bdcb190545939d5b3cdc465a5c28dbc39974cf9496ea22c7430c5def4ef2f800fb9b9d12d766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aa15df0183dc6d21441740ec17f159f

SHA1
c9170a3c0c5b5eee21fd7fbc177b0d69ddac690a

SHA256
895844c178754404bc2a0b69c29a7a0ada8b987172c00b3551b29960ae4db562

SHA512
722d3f51e943dc7741826131d07d60d95041ba0e6da9e0075b2930089212802ad6d67ad3d8a5dd7ad868ef7145b8fb2397fbd94490ce278fb2130d7a6ac74f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e320a2e39609c62321a9b6c85a50dc7d

SHA1
fc8ad0fc5ac169892c8db278a1cedd7eb2e58ea5

SHA256
42d691ec612170fc0eba492930b2ae79aa8a379268ee9a2353676673c6f88763

SHA512
a2907f004d1ce6162026702835c86cf926bcadd81616900c9b7293470f7c4cf328d272f2afbedd02781ed656e2742b1da8252bbcfe0deae629045aabfdf33940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f837f93b009a30352d6444dbd39359fa

SHA1
676cb0fc3da6a283856815b5a5c3559c4e8f14c4

SHA256
e73b73851751597cdf23ecf9c69ad1365ab79b9486729db2823eea5727b1b05a

SHA512
4f59c370648719228ccfadec282ca2d6382dc1738befd86cf0ff0c6192a9e568586e5d4369adb4c078cc8b480ef6549b6301446bbba88aa27cd9fd5ce25d2959

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9243.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9311.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit